Detonate URL - Lastline

Detonates a URL using the Lastline sandbox integration.

Lastline · 9 tasks · 3 inputs · 36 outputs

Details

IDDetonate URL - Lastline
From Version5.0.0
Tasks9

README

Detonates a URL using the Lastline Sandbox integration.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

  • lastline-get-report
  • lastline-upload-url
  • lastline-check-status

Playbook Inputs

Name Description Default Value Source Required
URL The URL to detonate. Data URL Optional
Interval The polling frequency. How often the polling command should run (in minutes). 1 - Optional
Timeout How much time to wait before a timeout occurs (in minutes). 15 - Optional

Playbook Outputs

Path Description Type
File.Size The file size (only in case of report type=json). number
DBotScore.Indicator The indicator that was tested (only in case of report type=json). string
DBotScore.Vendor The vendor used to calculate the score (only in case of report type=json). string
DBotScore.Score The actual score (only in case of report type=json). number
IP.Address The IP addresses relevant to the sample. string
DBotScore.Type The type of the indicator (only in case of report type=json). string
File.Name The filename (only in case of report type=json). string
File.Type The file type. For example, “PE” (only in case of report type=json). string
File.MD5 The MD5 hash of the file (only in case of report type=json). string
File.SHA1 The SHA1 hash of the file (only in case of report type=json). string
File.SHA256 The SHA256 hash of the file (only in case of report type=json). string
File.EntryID The entry ID of the sample. string
File.Malicious.Vendor The vendor that made the decision that the file is malicious. string
File.Malicious.Description The reason for the vendor to make the decision that the file is malicious. string
URL.Data The list of malicious URLs identified by Lastline analysis. string
URL.Malicious.Vendor The vendor that made the decision that the URL is malicious. string
URL.Malicious.Description The reason for the vendor to make the decision that the URL is malicious. string
URL.Malicious.Score The score from the vendor for the malicious URL. number
File.Malicious.Score The score from the vendor for the malicious file. number
Lastline.Submission.Status The status of the submission. string
Lastline.Submission.DNSqueries The list of DNS queries done by the analysis subject. string
Lastline.Submission.NetworkConnections The list of network connections done by the analysis subject. string
Lastline.Submission.DownloadedFiles The list of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element. string
Lastline.Submission.UUID The ID of the submission. string
Lastline.Submission.YaraSignatures.name The Yara signatures name. string
Lastline.Submission.YaraSignatures.score The score according to the Yara signatures. The value must be between 0 to 100. number
Lastline.Submission.Process.arguments The argument of the process. string
Lastline.Submission.YaraSignatures.internal Whether the signature is only for internal usage. True if yes. boolean
Lastline.Submission.Process.process_id The process ID. string
Lastline.Submission.Process.executable.abs_path The absolute path of the executable of the process. string
Lastline.Submission.Process.executable.filename The filename of the executable. string
Lastline.Submission.Process.executable.yara_signature_hits The Yara signature of the executable of the process. string
URL The URL object. unknown
URL.Malicious The URL malicious object. unknown
DBotScore The DBot score object. unknown
Lastline.Submission The Lastline submission object. unknown

Playbook Image

Detonate_URL_Lastline

Inputs

  • URL — URL to detonate.
  • Interval — Polling frequency - how often the polling command should run (minutes)
  • Timeout — How much time to wait before a timeout occurs (minutes)

Outputs

  • File.Size — File size (only in case of report type=json)
  • DBotScore.Indicator — The indicator we tested (only in case of report type=json)
  • DBotScore.Vendor — Vendor used to calculate the score (only in case of report type=json)
  • DBotScore.Score — The actual score (only in case of report type=json)
  • IP.Address — IP's relevant to the sample
  • DBotScore.Type — The type of the indicator (only in case of report type=json)
  • File.Name — Filename (only in case of report type=json)
  • File.Type — File type e.g. "PE" (only in case of report type=json)
  • File.MD5 — MD5 hash of the file (only in case of report type=json)
  • File.SHA1 — SHA1 hash of the file (only in case of report type=json)
  • File.SHA256 — SHA256 hash of the file (only in case of report type=json)
  • File.EntryID — The Entry ID of the sample
  • File.Malicious.Vendor — For malicious files, the vendor that made the decision
  • File.Malicious.Description — For malicious files, the reason for the vendor to make the decision
  • URL.Data — List of malicious URLs identified by Lastline analysis
  • URL.Malicious.Vendor — For malicious URLs, the vendor that made the decision
  • URL.Malicious.Description — For malicious URLs, the reason for the vendor to make the decision
  • URL.Malicious.Score — For malicious URLs, the score from the vendor
  • File.Malicious.Score — For malicious files, the score from the vendor
  • Lastline.Submission.Status — Status of the submission
  • Lastline.Submission.DNSqueries — List of DNS queries done by the analysis subject
  • Lastline.Submission.NetworkConnections — ist of network connections done by the analysis subject
  • Lastline.Submission.DownloadedFiles — List of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
  • Lastline.Submission.UUID — ID of the submission
  • Lastline.Submission.YaraSignatures.name — Yara signatures name
  • Lastline.Submission.YaraSignatures.score — The score according to the yara signatures. from 0 to 100.
  • Lastline.Submission.Process.arguments — Argument of the process
  • Lastline.Submission.YaraSignatures.internal — True if the signature is only for internal usage
  • Lastline.Submission.Process.process_id — The process ID
  • Lastline.Submission.Process.executable.abs_path — Absolute path of the executable of the process
  • Lastline.Submission.Process.executable.filename — Filename of the executable
  • Lastline.Submission.Process.executable.yara_signature_hits — Yara signature of the executable of the process
  • URL — URL object
  • URL.Malicious — URL Malicious object
  • DBotScore — DBot score object
  • Lastline.Submission — Lastline submission object

Commands used

lastline-check-status lastline-get-report lastline-upload-url

Flowchart

yes yes yes Start Start Lastline Upload URL - lastline-upload-url Lastline Upload URL lastline-upload-url GenericPolling - GenericPolling GenericPolling GenericPolling Lastline Get Report - lastline-get-report Lastline Get Report lastline-get-report Is there a URL to detonate? Is there a URL to detonate? Done Done Is Lastline sandbox enabled? Is Lastline sandbox enabled? Filter UUIDs Filter UUIDs Lastline Check Status - lastline-check-status Lastline Check Status lastline-check-status

Source

playbook-Detonate_URL_-_Lastline.yml playbook-Detonate_URL_-_Lastline_v2.yml playbook-Detonate_URL_-_Lastline_v2_README.md
Download History Raw 
id: Detonate URL - Lastline v2
version: -1
name: Detonate URL - Lastline v2
description: Detonates a URL using the Lastline sandbox integration.
fromversion: 5.0.0
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 703b80c2-e281-498a-8d00-2bbf1e6f2df0
    type: start
    task:
      id: 703b80c2-e281-498a-8d00-2bbf1e6f2df0
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 2e2c891a-2cbf-4ebd-8164-4791a89c3310
    type: regular
    task:
      id: 2e2c891a-2cbf-4ebd-8164-4791a89c3310
      version: -1
      name: Lastline v2 Upload URL
      description: Submit URL for analysis.
      script: '|||lastline-upload-url'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      threshold: {}
      url:
        complex:
          root: inputs.URL
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: 44d072d8-9786-4dd9-8bcb-630c89e2b8ee
    type: playbook
    task:
      id: 44d072d8-9786-4dd9-8bcb-630c89e2b8ee
      version: -1
      name: GenericPolling
      description: |-
        'Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.'
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      Ids:
        complex:
          root: Lastline
          accessor: Submission.UUID
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: uuid
      PollingCommandName:
        simple: lastline-check-status
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: Lastline.Submission(val.Status != 'Completed').UUID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 7685f1a2-b64e-41a7-81f8-f3830168f714
    type: regular
    task:
      id: 7685f1a2-b64e-41a7-81f8-f3830168f714
      version: -1
      name: Lastline Get Report
      description: Get analysis report
      script: '|||lastline-get-report'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      threshold: {}
      uuid:
        complex:
          root: Lastline
          accessor: Submission.UUID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 9cf17ba9-0559-471e-8012-1abbd588a590
    type: condition
    task:
      id: 9cf17ba9-0559-471e-8012-1abbd588a590
      version: -1
      name: Is there a URL to detonate?
      description: Checks if there is a URL in the playbook’s input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: 686f6312-301b-461a-877c-6e4ec794393f
    type: title
    task:
      id: 686f6312-301b-461a-877c-6e4ec794393f
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 5305d933-86c0-46b2-8889-9c675f21f978
    type: condition
    task:
      id: 5305d933-86c0-46b2-8889-9c675f21f978
      version: -1
      name: Is Lastline sandbox enabled?
      description: |
        Verify that there is a valid instance of Lastline enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Lastline
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: b5e9fe45-6986-4e58-8ba4-229eafdcf817
    type: condition
    task:
      id: b5e9fe45-6986-4e58-8ba4-229eafdcf817
      version: -1
      name: Filter UUIDs
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: Lastline
                filters:
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: Lastline.Submission.Status
                      iscontext: true
                    right:
                      value:
                        simple: Completed
                accessor: Submission.Status
            iscontext: true
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: 0fd4e66e-bf5d-4df8-8522-762d9f2e2e38
    type: regular
    task:
      id: 0fd4e66e-bf5d-4df8-8522-762d9f2e2e38
      version: -1
      name: Lastline Check Status
      description: Check submissions status
      script: '|||lastline-check-status'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      uuid:
        complex:
          root: Lastline
          accessor: Submission.UUID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1435,
        "width": 605,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: false
  description: URL to detonate.
- key: Interval
  value:
    simple: "1"
  required: false
  description: Polling frequency - how often the polling command should run (minutes)
- key: Timeout
  value:
    simple: "15"
  required: false
  description: How much time to wait before a timeout occurs (minutes)
outputs:
- contextPath: File.Size
  description: File size (only in case of report type=json)
  type: number
- contextPath: DBotScore.Indicator
  description: The indicator we tested (only in case of report type=json)
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score (only in case of report type=json)
  type: string
- contextPath: DBotScore.Score
  description: The actual score (only in case of report type=json)
  type: number
- contextPath: IP.Address
  description: IP's relevant to the sample
  type: string
- contextPath: DBotScore.Type
  description: The type of the indicator (only in case of report type=json)
  type: string
- contextPath: File.Name
  description: Filename (only in case of report type=json)
  type: string
- contextPath: File.Type
  description: File type e.g. "PE" (only in case of report type=json)
  type: string
- contextPath: File.MD5
  description: MD5 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.SHA256
  description: SHA256 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.EntryID
  description: The Entry ID of the sample
  type: string
- contextPath: File.Malicious.Vendor
  description: The vendor that determined that a file is malicious.
  type: string
- contextPath: File.Malicious.Description
  description: The reason that the vendor determined that the file is malicious.
  type: string
- contextPath: URL.Data
  description: List of malicious URLs identified by Lastline analysis
  type: string
- contextPath: URL.Malicious.Vendor
  description: The vendor that determined that a URL is malicious.
  type: string
- contextPath: URL.Malicious.Description
  description: The reason that the vendor determined that the URL is malicious.
  type: string
- contextPath: URL.Malicious.Score
  description: The score that the malicious URL received from the vendor.
  type: number
- contextPath: File.Malicious.Score
  description: The score that the malicious file received from the vendor.
  type: number
- contextPath: Lastline.Submission.Status
  description: Status of the submission
  type: string
- contextPath: Lastline.Submission.DNSqueries
  description: List of DNS queries done by the analysis subject
  type: string
- contextPath: Lastline.Submission.NetworkConnections
  description: List of network connections done by the analysis subject
  type: string
- contextPath: Lastline.Submission.DownloadedFiles
  description: List of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
  type: string
- contextPath: Lastline.Submission.UUID
  description: ID of the submission
  type: string
- contextPath: Lastline.Submission.YaraSignatures.name
  description: Yara signatures name
  type: string
- contextPath: Lastline.Submission.YaraSignatures.score
  description: The score according to the yara signatures. from 0 to 100.
  type: number
- contextPath: Lastline.Submission.Process.arguments
  description: Argument of the process.
  type: string
- contextPath: Lastline.Submission.YaraSignatures.internal
  description: True if the signature is only for internal use.
  type: boolean
- contextPath: Lastline.Submission.Process.process_id
  description: The process ID.
  type: string
- contextPath: Lastline.Submission.Process.executable.abs_path
  description: Absolute path of the executable of the process.
  type: string
- contextPath: Lastline.Submission.Process.executable.filename
  description: Filename of the executable.
  type: string
- contextPath: Lastline.Submission.Process.executable.yara_signature_hits
  description: Yara signature of the executable of the process.
  type: string
- contextPath: URL
  description: URL object
  type: unknown
- contextPath: URL.Malicious
  description: URL Malicious object
  type: unknown
- contextPath: DBotScore
  description: DBot score object
  type: unknown
- contextPath: Lastline.Submission
  description: Lastline submission object
  type: unknown
tests:
- Detonate URL - Generic Test