Detonate URL - Hatching Triage

id: Detonate URL - Hatching Triage
version: -1
name: Detonate URL - Hatching Triage
description: Detonating URL with Hatching Triage.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: bc1fedf4-af24-48ac-89b1-1748107d1329
    type: start
    task:
      id: bc1fedf4-af24-48ac-89b1-1748107d1329
      version: -1
      name: ""
      description: starting test
      iscommand: false
      brand: ""
    nexttasks:
      "#none#":
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ''
  "1":
    id: "1"
    taskid: 15fb19a6-b9ad-4925-84fc-e6eff859e02a
    type: condition
    task:
      id: 15fb19a6-b9ad-4925-84fc-e6eff859e02a
      version: -1
      name: Is there any active Hatching Triage instance?
      description: Check for active instance
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "#default#":
      - "6"
      yes:
      - "2"
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Hatching Triage
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ''
  "2":
    id: "2"
    taskid: e08b576d-2e34-4f21-88dd-dfe541fd7692
    type: condition
    task:
      id: e08b576d-2e34-4f21-88dd-dfe541fd7692
      version: -1
      name: Is there a URL?
      description: Check for URL
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "#default#":
      - "6"
      yes:
      - "3"
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ''
  "3":
    id: "3"
    taskid: 96d46dcd-29e5-4e9c-8541-b7f16a505703
    type: regular
    task:
      id: 96d46dcd-29e5-4e9c-8541-b7f16a505703
      version: -1
      name: Send URL to Hatching Triage
      description: Submits a file or URL for analysis
      script: Hatching Triage|||triage-submit-sample
      type: regular
      iscommand: true
      brand: Hatching Triage
    nexttasks:
      "#none#":
      - "8"
    scriptarguments:
      data:
        simple: ${inputs.URL}
      kind:
        simple: url
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ''
  "4":
    id: "4"
    taskid: 9f8a0368-98b5-4afe-8bfe-b1e5bd25bbb0
    type: playbook
    task:
      id: 9f8a0368-98b5-4afe-8bfe-b1e5bd25bbb0
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      type: playbook
      iscommand: false
      brand: ""
      playbookId: GenericPolling
    nexttasks:
      "#none#":
      - "7"
    scriptarguments:
      Ids:
        simple: ${Triage.submissions.id}
      Interval:
        simple: ${inputs.interval}
      PollingCommandArgName:
        simple: sample_id
      PollingCommandName:
        simple: triage-get-sample-summary
      Timeout:
        simple: ${inputs.timeout}
      dt:
        simple: Triage.sample-summaries(val.status!=='reported').sample
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ''
  "6":
    id: "6"
    taskid: 229f4061-9b02-4089-84e4-734e00a35d1a
    type: title
    task:
      id: 229f4061-9b02-4089-84e4-734e00a35d1a
      version: -1
      name: Done
      description: "-"
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ''
  "7":
    id: "7"
    taskid: b2935177-bc59-4bb4-8274-e5f47f15bd95
    type: regular
    task:
      id: b2935177-bc59-4bb4-8274-e5f47f15bd95
      version: -1
      name: Get task report
      description: Gets a summary report of the sample ID provided
      script: Hatching Triage|||triage-get-sample-summary
      type: regular
      iscommand: true
      brand: Hatching Triage
    nexttasks:
      "#none#":
      - "6"
    scriptarguments:
      sample_id:
        simple: ${Triage.submissions.id}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ''
  "8":
    id: "8"
    taskid: 765a4bc4-7d3e-4eb7-8453-14c41eb82728
    type: regular
    task:
      id: 765a4bc4-7d3e-4eb7-8453-14c41eb82728
      version: -1
      name: Sleep (let the sandbox create the task)
      description: sleep
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      "#none#":
      - "9"
    scriptarguments:
      seconds:
        simple: "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: true
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ''
  "9":
    id: "9"
    taskid: 55574304-9525-46b5-84e7-06c51df3d9e6
    type: regular
    task:
      id: 55574304-9525-46b5-84e7-06c51df3d9e6
      version: -1
      name: View task
      description: Gets a summary report of the sample ID provided
      script: Hatching Triage|||triage-get-sample-summary
      type: regular
      iscommand: true
      brand: Hatching Triage
    nexttasks:
      "#none#":
      - "4"
    scriptarguments:
      sample_id:
        simple: ${Triage.submissions.id}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ''
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1435,
        "width": 605,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: false
  description: URL to detonate.
  playbookInputQuery:
- key: interval
  value:
    simple: "1"
  required: false
  description: How often to poll for results.
  playbookInputQuery:
- key: timeout
  value:
    simple: "10"
  required: false
  description: How long to wait before giving up waiting for results.
  playbookInputQuery:
outputs:
- contextPath: Triage.sample-summaries.completed
  description: Date the sample analysis was completed.
- contextPath: Triage.sample-summaries.created
  description: Date the analysis report was created.
- contextPath: Triage.sample-summaries.custom
  description: Custom sample analysis.
- contextPath: Triage.sample-summaries.owner
  description: Owner of the sample analysis.
  type: unknown
- contextPath: Triage.sample-summaries.sample
  description: Unique identifier of the sample,
  type: unknown
- contextPath: Triage.sample-summaries.score
  description: Score of the sample on a scale of 0 to 10.
  type: unknown
- contextPath: Triage.sample-summaries.sha256
  description: SHA256 hash of the sample.
  type: unknown
- contextPath: Triage.sample-summaries.status
  description: Status of the analysis.
  type: unknown
- contextPath: Triage.sample-summaries.target
  description: Target for the analysis.
  type: unknown
- contextPath: Triage.sample-summaries.tasks
  description: Tasks performed in the analysis.
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.2.0
contentitemexportablefields:
  contentitemfields:
    propagationLabels:
    - all