Detonate URL - Group-IB TDS Polygon

Details

ID	`Detonate URL - Group-IB TDS Polygon`
From Version	5.0.0
Tasks	10

README

Detonates one or more files using the Polygon integration. This playbook
returns relevant reports to the War Room and file reputations to the context data.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

Set

Commands

polygon-upload-url
polygon-analysis-info
polygon-export-report
polygon-export-pcap
polygon-export-video

Playbook Inputs

Name	Description	Default Value	Source	Required
url	The url object to detonate. The URL is taken from the context.	None	URL.Data	Optional
Interval	The duration for executing the pooling (in minutes).	1	-	Optional
Timeout	The duration after which to stop pooling and to resume the playbook (in minutes).	60	-	Optional

Playbook Outputs

Path	Description	Type
File.Name	string	The full file name (including file extension).
File.MD5	string	The MD5 hash of the file
File.SHA1	string	The SHA1 hash of the file
File.SHA256	string	The SHA256 hash of the file
File.Type	string	File type
File.Malicious.Vendor	string	The vendor that reported the file as malicious
File.Malicious.Description	string	A description explaining why the file was determined to be malicious
DBotScore.Indicator	string	The indicator that was tested
DBotScore.Type	string	The indicator type
DBotScore.Vendor	string	The vendor used to calculate the score
DBotScore.Score	number	The actual score
IP.Address	String	IP address
Domain.Name	String	The Domain name
Domain.DNS	String	A list of IP objects resolved by DNS.
URL.Data	String	The URL
URL.Malicious.Vendor	string	The vendor that reported the url as malicious
URL.Malicious.Description	string	A description explaining why the url was determined to be malicious
RegistryKey.Path	String	The path to the registry key
RegistryKey.Value	String	The value at the given RegistryKey.
Process.Name	String	Process name
Process.PID	String	Process PID
Process.CommandLine	String	Process Command Line
Process.Path	String	Process path
Process.StartTime	date	Process start time
Process.EndTime	date	Process end time
Polygon.Analysis.ID	string	THF File ID
Polygon.Analysis.Name	string	File Name
Polygon.Analysis.Size	number	File Size
Polygon.Analysis.Started	date	Analysis start timestamp
Polygon.Analysis.Analyzed	date	Analysis finish timestamp
Polygon.Analysis.MD5	string	Analyzed file MD5 hash
Polygon.Analysis.SHA1	string	Analyzed file SHA1 hash
Polygon.Analysis.SHA256	string	Analyzed file SHA256
Polygon.Analysis.Result	boolean	Analysis verdict
Polygon.Analysis.Status	string	Analysis status
Polygon.Analysis.Verdict	string	Analysis verdict
Polygon.Analysis.Probability	string	Verdict probability
Polygon.Analysis.Families	string	Malware families
Polygon.Analysis.Score	number	Polygon score
Polygon.Analysis.Internet-connection	string	Internet availability
Polygon.Analysis.Type	string	File type
Polygon.Analysis.DumpExists	boolean	Network activity dump exists
Polygon.Analysis.File	unknown	The information about files in analysis
Polygon.Analysis.URL	unknown	The information about URL indicators
Polygon.Analysis.IP	unknown	The information about IP indicators
Polygon.Analysis.Domain	unknown	The information about Domain indicators
Polygon.Analysis.RegistryKey	unknown	The information about registry keys which were modified during the analysis
Polygon.Analysis.Process	unknown	The information about processes started during the analysis

Playbook Image

Polygon Detonate URL

Inputs

Interval — Report requests frequency (minutes)
Timeout — Report waiting timeout (minutes)
url — URL to detonate

Outputs

File.Name — The full file name (including file extension).
File.MD5 — The MD5 hash of the file
File.SHA1 — The SHA1 hash of the file
File.SHA256 — The SHA256 hash of the file
File.Type — File type
File.Malicious.Vendor — The vendor that reported the file as malicious
File.Malicious.Description — A description explaining why the file was determined to be malicious
DBotScore.Indicator — The indicator that was tested
DBotScore.Type — The indicator type
DBotScore.Vendor — The vendor used to calculate the score
DBotScore.Score — The actual score
IP.Address — IP address
Domain.Name — The Domain name
Domain.DNS — A list of IP objects resolved by DNS.
URL.Data — The URL
RegistryKey.Path — The path to the registry key
RegistryKey.Value — The value at the given RegistryKey.
Process.Name — Process name
Process.PID — Process PID
Process.CommandLine — Process Command Line
Process.Path — Process path
Process.StartTime — Process start time
Process.EndTime — Process end time
Polygon.Analysis.ID — Analysis ID in THF
Polygon.Analysis.Name — File Name
Polygon.Analysis.Size — File Size
Polygon.Analysis.Started — Analysis start timestamp
Polygon.Analysis.Analyzed — Analysis finish timestamp
Polygon.Analysis.MD5 — Analyzed file MD5 hash
Polygon.Analysis.SHA1 — Analyzed file SHA1 hash
Polygon.Analysis.SHA256 — Analyzed file SHA256
Polygon.Analysis.Result — Analysis verdict
Polygon.Analysis.Status — The analysis status
Polygon.Analysis.Verdict — Analysis verdict
Polygon.Analysis.Probability — Verdict probability
Polygon.Analysis.Families — Malware families
Polygon.Analysis.Score — Polygon score
Polygon.Analysis.Internet-connection — Internet availability
Polygon.Analysis.Type — File type
Polygon.Analysis.DumpExists — Network activity dump exists
Polygon.Analysis.File — The information about files in analysis
Polygon.Analysis.URL — The information about URL indicators
Polygon.Analysis.IP — The information about IP indicators
Polygon.Analysis.Domain — The information about Domain indicators
Polygon.Analysis.RegistryKey — The information about registry keys which were modified during the analysis
Polygon.Analysis.Process — The information about processes started during the analysis

Commands used

polygon-analysis-info polygon-export-pcap polygon-export-report polygon-export-video polygon-upload-url

Flowchart

Source

playbook-Detonate_URL_-_Group-IB_TDS_Polygon.yml

Download History Raw

id: Detonate URL - Group-IB TDS Polygon
version: -1
name: Detonate URL - Group-IB TDS Polygon
description: Detonate URL using Group-IB THF Polygon integration.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 9501b3b5-5523-40bd-8af6-ae6a9d6ac607
    type: start
    task:
      id: 9501b3b5-5523-40bd-8af6-ae6a9d6ac607
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 540,
          "y": -10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: 3515a2f8-6b03-4061-8125-756cc50294fd
    type: title
    task:
      id: 3515a2f8-6b03-4061-8125-756cc50294fd
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 540,
          "y": 1630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: 70256af8-c846-4973-86a8-9c3361ee58b3
    type: playbook
    task:
      id: 70256af8-c846-4973-86a8-9c3361ee58b3
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      AdditionalPollingCommandArgNames: {}
      AdditionalPollingCommandArgValues: {}
      Ids:
        complex:
          root: Polygon
          accessor: Analysis.ID
          transformers:
          - operator: LastArrayElement
      Interval:
        simple: ${inputs.Interval}
      PollingCommandArgName:
        simple: tds_analysis_id
      PollingCommandName:
        simple: polygon-analysis-info
      Timeout:
        simple: ${inputs.Timeout}
      dt:
        simple: Polygon.Analysis(val.Status !== 'Finished').ID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 840,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: 6948ec34-2400-4760-8be6-a298743c12d2
    type: regular
    task:
      id: 6948ec34-2400-4760-8be6-a298743c12d2
      version: -1
      name: polygon-export-report
      description: Export an archive with THF Polygon report to War Room
      script: Group-IB TDS Polygon|||polygon-export-report
      type: regular
      iscommand: true
      brand: Group-IB TDS Polygon
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      tds_analysis_id:
        complex:
          root: Polygon
          accessor: Analysis.ID
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 840,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "14":
    id: "14"
    taskid: 4a79b7e8-4212-4b47-8078-bfb2dde6e1b4
    type: regular
    task:
      id: 4a79b7e8-4212-4b47-8078-bfb2dde6e1b4
      version: -1
      name: polygon-analysis-info
      description: Get THF Polygon analysis information
      script: Group-IB TDS Polygon|||polygon-analysis-info
      type: regular
      iscommand: true
      brand: Group-IB TDS Polygon
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      tds_analysis_id:
        complex:
          root: Polygon
          accessor: Analysis.ID
          transformers:
          - operator: LastArrayElement
      tds_file_id:
        complex:
          root: Polygon
          accessor: Analysis.ID
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 840,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "16":
    id: "16"
    taskid: 987e1a83-e302-4ddc-8aba-e27e41baebe3
    type: regular
    task:
      id: 987e1a83-e302-4ddc-8aba-e27e41baebe3
      version: -1
      name: polygon-export-pcap
      description: Network activity dump export
      script: Group-IB TDS Polygon|||polygon-export-pcap
      type: regular
      iscommand: true
      brand: Group-IB TDS Polygon
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      tds_analysis_id:
        complex:
          root: Polygon
          accessor: Analysis.ID
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 840,
          "y": 1440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "17":
    id: "17"
    taskid: 4df106af-8c5f-4bc6-84e8-7c9617694f27
    type: regular
    task:
      id: 4df106af-8c5f-4bc6-84e8-7c9617694f27
      version: -1
      name: polygon-export-video
      description: Screen activity video export
      script: Group-IB TDS Polygon|||polygon-export-video
      type: regular
      iscommand: true
      brand: Group-IB TDS Polygon
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      tds_analysis_id:
        complex:
          root: Polygon
          accessor: Analysis.ID
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 840,
          "y": 1285
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "18":
    id: "18"
    taskid: 51f1cc88-20ec-4c3f-81f2-2825221bcc6e
    type: regular
    task:
      id: 51f1cc88-20ec-4c3f-81f2-2825221bcc6e
      version: -1
      name: polygon-upload-url
      description: Upload URL for analysis
      script: Group-IB TDS Polygon|||polygon-upload-url
      type: regular
      iscommand: true
      brand: Group-IB TDS Polygon
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      url:
        simple: ${inputs.url}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 840,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "19":
    id: "19"
    taskid: 466aa1ae-b36c-4232-86f0-89cf7d19a2d3
    type: condition
    task:
      id: 466aa1ae-b36c-4232-86f0-89cf7d19a2d3
      version: -1
      name: Is THF Polygon integration enabled?
      description: Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "18"
    scriptarguments:
      value:
        complex:
          root: modules
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: modules.brand
                iscontext: true
              right:
                value:
                  simple: Group-IB TDS Polygon
          - - operator: isEqualString
              left:
                value:
                  simple: modules.state
                iscontext: true
              right:
                value:
                  simple: active
          accessor: brand
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 540,
          "y": 140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "20":
    id: "20"
    taskid: 1bbc3dd0-04f3-43e6-833e-93f803184027
    type: condition
    task:
      id: 1bbc3dd0-04f3-43e6-833e-93f803184027
      version: -1
      name: Is URL malicious?
      description: Check if a given value is true. Will return 'no' otherwise
      scriptName: IsTrue
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "17"
    scriptarguments:
      value:
        complex:
          root: Polygon
          accessor: Analysis.Result
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 840,
          "y": 1060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1705,
        "width": 680,
        "x": 540,
        "y": -10
      }
    }
  }
inputs:
- key: Interval
  value:
    simple: "1"
  required: true
  description: Report requests frequency (minutes)
- key: Timeout
  value:
    simple: "60"
  required: true
  description: Report waiting timeout (minutes)
- key: url
  value:
    simple: ${URL.Data}
  required: false
  description: URL to detonate
outputs:
- contextPath: File.Name
  description: The full file name (including file extension).
  type: string
- contextPath: File.MD5
  description: The MD5 hash of the file
  type: string
- contextPath: File.SHA1
  description: The SHA1 hash of the file
  type: string
- contextPath: File.SHA256
  description: The SHA256 hash of the file
  type: string
- contextPath: File.Type
  description: File type
  type: string
- contextPath: File.Malicious.Vendor
  description: The vendor that reported the file as malicious
  type: string
- contextPath: File.Malicious.Description
  description: A description explaining why the file was determined to be malicious
  type: string
- contextPath: DBotScore.Indicator
  description: The indicator that was tested
  type: string
- contextPath: DBotScore.Type
  description: The indicator type
  type: string
- contextPath: DBotScore.Vendor
  description: The vendor used to calculate the score
  type: string
- contextPath: DBotScore.Score
  description: The actual score
  type: number
- contextPath: IP.Address
  description: IP address
  type: string
- contextPath: Domain.Name
  description: The Domain name
  type: string
- contextPath: Domain.DNS
  description: A list of IP objects resolved by DNS.
  type: string
- contextPath: URL.Data
  description: The URL
  type: string
- contextPath: RegistryKey.Path
  description: The path to the registry key
  type: string
- contextPath: RegistryKey.Value
  description: The value at the given RegistryKey.
  type: string
- contextPath: Process.Name
  description: Process name
  type: string
- contextPath: Process.PID
  description: Process PID
  type: number
- contextPath: Process.CommandLine
  description: Process Command Line
  type: string
- contextPath: Process.Path
  description: Process path
  type: string
- contextPath: Process.StartTime
  description: Process start time
  type: date
- contextPath: Process.EndTime
  description: Process end time
  type: date
- contextPath: Polygon.Analysis.ID
  description: Analysis ID in THF
  type: number
- contextPath: Polygon.Analysis.Name
  description: File Name
  type: string
- contextPath: Polygon.Analysis.Size
  description: File Size
  type: number
- contextPath: Polygon.Analysis.Started
  description: Analysis start timestamp
  type: date
- contextPath: Polygon.Analysis.Analyzed
  description: Analysis finish timestamp
  type: date
- contextPath: Polygon.Analysis.MD5
  description: Analyzed file MD5 hash
  type: string
- contextPath: Polygon.Analysis.SHA1
  description: Analyzed file SHA1 hash
  type: string
- contextPath: Polygon.Analysis.SHA256
  description: Analyzed file SHA256
  type: string
- contextPath: Polygon.Analysis.Result
  description: Analysis verdict
  type: string
- contextPath: Polygon.Analysis.Status
  description: The analysis status
  type: string
- contextPath: Polygon.Analysis.Verdict
  description: Analysis verdict
  type: boolean
- contextPath: Polygon.Analysis.Probability
  description: Verdict probability
  type: string
- contextPath: Polygon.Analysis.Families
  description: Malware families
  type: string
- contextPath: Polygon.Analysis.Score
  description: Polygon score
  type: number
- contextPath: Polygon.Analysis.Internet-connection
  description: Internet availability
  type: string
- contextPath: Polygon.Analysis.Type
  description: File type
  type: string
- contextPath: Polygon.Analysis.DumpExists
  description: Network activity dump exists
  type: boolean
- contextPath: Polygon.Analysis.File
  description: The information about files in analysis
  type: unknown
- contextPath: Polygon.Analysis.URL
  description: The information about URL indicators
- contextPath: Polygon.Analysis.IP
  description: The information about IP indicators
- contextPath: Polygon.Analysis.Domain
  description: The information about Domain indicators
- contextPath: Polygon.Analysis.RegistryKey
  description: The information about registry keys which were modified during the analysis
- contextPath: Polygon.Analysis.Process
  description: The information about processes started during the analysis
fromversion: 5.0.0
tests:
- No tests