Detonate URL - Lastline

Details

ID	`Detonate URL - Lastline`
From Version	5.0.0
Tasks	9

README

Detonates a URL using the Lastline Sandbox integration.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

lastline-get-report
lastline-upload-url
lastline-check-status

Playbook Inputs

Name	Description	Default Value	Source	Required
URL	The URL to detonate.	Data	URL	Optional
Interval	The polling frequency. How often the polling command should run (in minutes).	1	-	Optional
Timeout	How much time to wait before a timeout occurs (in minutes).	15	-	Optional

Playbook Outputs

Path	Description	Type
File.Size	The file size (only in case of report type=json).	number
DBotScore.Indicator	The indicator that was tested (only in case of report type=json).	string
DBotScore.Vendor	The vendor used to calculate the score (only in case of report type=json).	string
DBotScore.Score	The actual score (only in case of report type=json).	number
IP.Address	The IP addresses relevant to the sample.	string
DBotScore.Type	The type of the indicator (only in case of report type=json).	string
File.Name	The filename (only in case of report type=json).	string
File.Type	The file type. For example, “PE” (only in case of report type=json).	string
File.MD5	The MD5 hash of the file (only in case of report type=json).	string
File.SHA1	The SHA1 hash of the file (only in case of report type=json).	string
File.SHA256	The SHA256 hash of the file (only in case of report type=json).	string
File.EntryID	The entry ID of the sample.	string
File.Malicious.Vendor	The vendor that made the decision that the file is malicious.	string
File.Malicious.Description	The reason for the vendor to make the decision that the file is malicious.	string
URL.Data	The list of malicious URLs identified by Lastline analysis.	string
URL.Malicious.Vendor	The vendor that made the decision that the URL is malicious.	string
URL.Malicious.Description	The reason for the vendor to make the decision that the URL is malicious.	string
URL.Malicious.Score	The score from the vendor for the malicious URL.	number
File.Malicious.Score	The score from the vendor for the malicious file.	number
Lastline.Submission.Status	The status of the submission.	string
Lastline.Submission.DNSqueries	The list of DNS queries done by the analysis subject.	string
Lastline.Submission.NetworkConnections	The list of network connections done by the analysis subject.	string
Lastline.Submission.DownloadedFiles	The list of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.	string
Lastline.Submission.UUID	The ID of the submission.	string
Lastline.Submission.YaraSignatures.name	The Yara signatures name.	string
Lastline.Submission.YaraSignatures.score	The score according to the Yara signatures. The value must be between 0 to 100.	number
Lastline.Submission.Process.arguments	The argument of the process.	string
Lastline.Submission.YaraSignatures.internal	Whether the signature is only for internal usage. True if yes.	boolean
Lastline.Submission.Process.process_id	The process ID.	string
Lastline.Submission.Process.executable.abs_path	The absolute path of the executable of the process.	string
Lastline.Submission.Process.executable.filename	The filename of the executable.	string
Lastline.Submission.Process.executable.yara_signature_hits	The Yara signature of the executable of the process.	string
URL	The URL object.	unknown
URL.Malicious	The URL malicious object.	unknown
DBotScore	The DBot score object.	unknown
Lastline.Submission	The Lastline submission object.	unknown

Playbook Image

Detonate_URL_Lastline

Inputs

URL — URL to detonate.
Interval — Polling frequency - how often the polling command should run (minutes)
Timeout — How much time to wait before a timeout occurs (minutes)

Outputs

File.Size — File size (only in case of report type=json)
DBotScore.Indicator — The indicator we tested (only in case of report type=json)
DBotScore.Vendor — Vendor used to calculate the score (only in case of report type=json)
DBotScore.Score — The actual score (only in case of report type=json)
IP.Address — IP's relevant to the sample
DBotScore.Type — The type of the indicator (only in case of report type=json)
File.Name — Filename (only in case of report type=json)
File.Type — File type e.g. "PE" (only in case of report type=json)
File.MD5 — MD5 hash of the file (only in case of report type=json)
File.SHA1 — SHA1 hash of the file (only in case of report type=json)
File.SHA256 — SHA256 hash of the file (only in case of report type=json)
File.EntryID — The Entry ID of the sample
File.Malicious.Vendor — For malicious files, the vendor that made the decision
File.Malicious.Description — For malicious files, the reason for the vendor to make the decision
URL.Data — List of malicious URLs identified by Lastline analysis
URL.Malicious.Vendor — For malicious URLs, the vendor that made the decision
URL.Malicious.Description — For malicious URLs, the reason for the vendor to make the decision
URL.Malicious.Score — For malicious URLs, the score from the vendor
File.Malicious.Score — For malicious files, the score from the vendor
Lastline.Submission.Status — Status of the submission
Lastline.Submission.DNSqueries — List of DNS queries done by the analysis subject
Lastline.Submission.NetworkConnections — ist of network connections done by the analysis subject
Lastline.Submission.DownloadedFiles — List of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
Lastline.Submission.UUID — ID of the submission
Lastline.Submission.YaraSignatures.name — Yara signatures name
Lastline.Submission.YaraSignatures.score — The score according to the yara signatures. from 0 to 100.
Lastline.Submission.Process.arguments — Argument of the process
Lastline.Submission.YaraSignatures.internal — True if the signature is only for internal usage
Lastline.Submission.Process.process_id — The process ID
Lastline.Submission.Process.executable.abs_path — Absolute path of the executable of the process
Lastline.Submission.Process.executable.filename — Filename of the executable
Lastline.Submission.Process.executable.yara_signature_hits — Yara signature of the executable of the process
URL — URL object
URL.Malicious — URL Malicious object
DBotScore — DBot score object
Lastline.Submission — Lastline submission object

Commands used

lastline-check-status lastline-get-report lastline-upload-url

Flowchart

Source

playbook-Detonate_URL_-_Lastline.yml playbook-Detonate_URL_-_Lastline_v2.yml playbook-Detonate_URL_-_Lastline_v2_README.md

Download History Raw

id: Detonate URL - Lastline
version: -1
name: Detonate URL - Lastline
description: Detonates a URL using the Lastline sandbox integration.
fromversion: 5.0.0
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 703b80c2-e281-498a-8d00-2bbf1e6f2df0
    type: start
    task:
      id: 703b80c2-e281-498a-8d00-2bbf1e6f2df0
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 2e2c891a-2cbf-4ebd-8164-4791a89c3310
    type: regular
    task:
      id: 2e2c891a-2cbf-4ebd-8164-4791a89c3310
      version: -1
      name: Lastline Upload URL
      description: Submit URL for analysis.
      script: '|||lastline-upload-url'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      threshold: {}
      url:
        complex:
          root: inputs.URL
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: 44d072d8-9786-4dd9-8bcb-630c89e2b8ee
    type: playbook
    task:
      id: 44d072d8-9786-4dd9-8bcb-630c89e2b8ee
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      Ids:
        complex:
          root: Lastline
          accessor: Submission.UUID
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: uuid
      PollingCommandName:
        simple: lastline-check-status
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: Lastline.Submission(val.Status != 'Completed').UUID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 7685f1a2-b64e-41a7-81f8-f3830168f714
    type: regular
    task:
      id: 7685f1a2-b64e-41a7-81f8-f3830168f714
      version: -1
      name: Lastline Get Report
      description: Get analysis report
      script: '|||lastline-get-report'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      threshold: {}
      uuid:
        complex:
          root: Lastline
          accessor: Submission.UUID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 9cf17ba9-0559-471e-8012-1abbd588a590
    type: condition
    task:
      id: 9cf17ba9-0559-471e-8012-1abbd588a590
      version: -1
      name: Is there a URL to detonate?
      description: Checks that there is a URL in the playbook’s input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: 686f6312-301b-461a-877c-6e4ec794393f
    type: title
    task:
      id: 686f6312-301b-461a-877c-6e4ec794393f
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 5305d933-86c0-46b2-8889-9c675f21f978
    type: condition
    task:
      id: 5305d933-86c0-46b2-8889-9c675f21f978
      version: -1
      name: Is Lastline sandbox enabled?
      description: |
        Verify that there is a valid instance of Lastline enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Lastline
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: b5e9fe45-6986-4e58-8ba4-229eafdcf817
    type: condition
    task:
      id: b5e9fe45-6986-4e58-8ba4-229eafdcf817
      version: -1
      name: Filter UUIDs
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: Lastline
                filters:
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: Lastline.Submission.Status
                      iscontext: true
                    right:
                      value:
                        simple: Completed
                accessor: Submission.Status
            iscontext: true
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: 0fd4e66e-bf5d-4df8-8522-762d9f2e2e38
    type: regular
    task:
      id: 0fd4e66e-bf5d-4df8-8522-762d9f2e2e38
      version: -1
      name: Lastline Check Status
      description: Check submissions status
      script: '|||lastline-check-status'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      uuid:
        complex:
          root: Lastline
          accessor: Submission.UUID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1435,
        "width": 605,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: false
  description: URL to detonate.
- key: Interval
  value:
    simple: "1"
  required: false
  description: Polling frequency - how often the polling command should run (minutes)
- key: Timeout
  value:
    simple: "15"
  required: false
  description: How much time to wait before a timeout occurs (minutes)
outputs:
- contextPath: File.Size
  description: File size (only in case of report type=json)
  type: number
- contextPath: DBotScore.Indicator
  description: The indicator we tested (only in case of report type=json)
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score (only in case of report type=json)
  type: string
- contextPath: DBotScore.Score
  description: The actual score (only in case of report type=json)
  type: number
- contextPath: IP.Address
  description: IP's relevant to the sample
  type: string
- contextPath: DBotScore.Type
  description: The type of the indicator (only in case of report type=json)
  type: string
- contextPath: File.Name
  description: Filename (only in case of report type=json)
  type: string
- contextPath: File.Type
  description: File type e.g. "PE" (only in case of report type=json)
  type: string
- contextPath: File.MD5
  description: MD5 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.SHA256
  description: SHA256 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.EntryID
  description: The Entry ID of the sample
  type: string
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision
  type: string
- contextPath: File.Malicious.Description
  description: For malicious files, the reason for the vendor to make the decision
  type: string
- contextPath: URL.Data
  description: List of malicious URLs identified by Lastline analysis
  type: string
- contextPath: URL.Malicious.Vendor
  description: For malicious URLs, the vendor that made the decision
  type: string
- contextPath: URL.Malicious.Description
  description: For malicious URLs, the reason for the vendor to make the decision
  type: string
- contextPath: URL.Malicious.Score
  description: For malicious URLs, the score from the vendor
  type: number
- contextPath: File.Malicious.Score
  description: For malicious files, the score from the vendor
  type: number
- contextPath: Lastline.Submission.Status
  description: Status of the submission
  type: string
- contextPath: Lastline.Submission.DNSqueries
  description: List of DNS queries done by the analysis subject
  type: string
- contextPath: Lastline.Submission.NetworkConnections
  description: ist of network connections done by the analysis subject
  type: string
- contextPath: Lastline.Submission.DownloadedFiles
  description: List of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
  type: string
- contextPath: Lastline.Submission.UUID
  description: ID of the submission
  type: string
- contextPath: Lastline.Submission.YaraSignatures.name
  description: Yara signatures name
  type: string
- contextPath: Lastline.Submission.YaraSignatures.score
  description: The score according to the yara signatures. from 0 to 100.
  type: number
- contextPath: Lastline.Submission.Process.arguments
  description: Argument of the process
  type: string
- contextPath: Lastline.Submission.YaraSignatures.internal
  description: True if the signature is only for internal usage
  type: boolean
- contextPath: Lastline.Submission.Process.process_id
  description: The process ID
  type: string
- contextPath: Lastline.Submission.Process.executable.abs_path
  description: Absolute path of the executable of the process
  type: string
- contextPath: Lastline.Submission.Process.executable.filename
  description: Filename of the executable
  type: string
- contextPath: Lastline.Submission.Process.executable.yara_signature_hits
  description: Yara signature of the executable of the process
  type: string
- contextPath: URL
  description: URL object
  type: unknown
- contextPath: URL.Malicious
  description: URL Malicious object
  type: unknown
- contextPath: DBotScore
  description: DBot score object
  type: unknown
- contextPath: Lastline.Submission
  description: Lastline submission object
  type: unknown
tests:
- Detonate URL - Generic Test