Detonate URL - Lastline

Detonates a URL using the Lastline sandbox integration.

Lastline · 9 tasks · 3 inputs · 36 outputs

Details

IDDetonate URL - Lastline
From Version5.0.0
Tasks9

README

Detonates a URL using the Lastline Sandbox integration.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

  • lastline-get-report
  • lastline-upload-url
  • lastline-check-status

Playbook Inputs

Name Description Default Value Source Required
URL The URL to detonate. Data URL Optional
Interval The polling frequency. How often the polling command should run (in minutes). 1 - Optional
Timeout How much time to wait before a timeout occurs (in minutes). 15 - Optional

Playbook Outputs

Path Description Type
File.Size The file size (only in case of report type=json). number
DBotScore.Indicator The indicator that was tested (only in case of report type=json). string
DBotScore.Vendor The vendor used to calculate the score (only in case of report type=json). string
DBotScore.Score The actual score (only in case of report type=json). number
IP.Address The IP addresses relevant to the sample. string
DBotScore.Type The type of the indicator (only in case of report type=json). string
File.Name The filename (only in case of report type=json). string
File.Type The file type. For example, “PE” (only in case of report type=json). string
File.MD5 The MD5 hash of the file (only in case of report type=json). string
File.SHA1 The SHA1 hash of the file (only in case of report type=json). string
File.SHA256 The SHA256 hash of the file (only in case of report type=json). string
File.EntryID The entry ID of the sample. string
File.Malicious.Vendor The vendor that made the decision that the file is malicious. string
File.Malicious.Description The reason for the vendor to make the decision that the file is malicious. string
URL.Data The list of malicious URLs identified by Lastline analysis. string
URL.Malicious.Vendor The vendor that made the decision that the URL is malicious. string
URL.Malicious.Description The reason for the vendor to make the decision that the URL is malicious. string
URL.Malicious.Score The score from the vendor for the malicious URL. number
File.Malicious.Score The score from the vendor for the malicious file. number
Lastline.Submission.Status The status of the submission. string
Lastline.Submission.DNSqueries The list of DNS queries done by the analysis subject. string
Lastline.Submission.NetworkConnections The list of network connections done by the analysis subject. string
Lastline.Submission.DownloadedFiles The list of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element. string
Lastline.Submission.UUID The ID of the submission. string
Lastline.Submission.YaraSignatures.name The Yara signatures name. string
Lastline.Submission.YaraSignatures.score The score according to the Yara signatures. The value must be between 0 to 100. number
Lastline.Submission.Process.arguments The argument of the process. string
Lastline.Submission.YaraSignatures.internal Whether the signature is only for internal usage. True if yes. boolean
Lastline.Submission.Process.process_id The process ID. string
Lastline.Submission.Process.executable.abs_path The absolute path of the executable of the process. string
Lastline.Submission.Process.executable.filename The filename of the executable. string
Lastline.Submission.Process.executable.yara_signature_hits The Yara signature of the executable of the process. string
URL The URL object. unknown
URL.Malicious The URL malicious object. unknown
DBotScore The DBot score object. unknown
Lastline.Submission The Lastline submission object. unknown

Playbook Image

Detonate_URL_Lastline

Inputs

  • URL — URL to detonate.
  • Interval — Polling frequency - how often the polling command should run (minutes)
  • Timeout — How much time to wait before a timeout occurs (minutes)

Outputs

  • File.Size — File size (only in case of report type=json)
  • DBotScore.Indicator — The indicator we tested (only in case of report type=json)
  • DBotScore.Vendor — Vendor used to calculate the score (only in case of report type=json)
  • DBotScore.Score — The actual score (only in case of report type=json)
  • IP.Address — IP's relevant to the sample
  • DBotScore.Type — The type of the indicator (only in case of report type=json)
  • File.Name — Filename (only in case of report type=json)
  • File.Type — File type e.g. "PE" (only in case of report type=json)
  • File.MD5 — MD5 hash of the file (only in case of report type=json)
  • File.SHA1 — SHA1 hash of the file (only in case of report type=json)
  • File.SHA256 — SHA256 hash of the file (only in case of report type=json)
  • File.EntryID — The Entry ID of the sample
  • File.Malicious.Vendor — For malicious files, the vendor that made the decision
  • File.Malicious.Description — For malicious files, the reason for the vendor to make the decision
  • URL.Data — List of malicious URLs identified by Lastline analysis
  • URL.Malicious.Vendor — For malicious URLs, the vendor that made the decision
  • URL.Malicious.Description — For malicious URLs, the reason for the vendor to make the decision
  • URL.Malicious.Score — For malicious URLs, the score from the vendor
  • File.Malicious.Score — For malicious files, the score from the vendor
  • Lastline.Submission.Status — Status of the submission
  • Lastline.Submission.DNSqueries — List of DNS queries done by the analysis subject
  • Lastline.Submission.NetworkConnections — ist of network connections done by the analysis subject
  • Lastline.Submission.DownloadedFiles — List of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
  • Lastline.Submission.UUID — ID of the submission
  • Lastline.Submission.YaraSignatures.name — Yara signatures name
  • Lastline.Submission.YaraSignatures.score — The score according to the yara signatures. from 0 to 100.
  • Lastline.Submission.Process.arguments — Argument of the process
  • Lastline.Submission.YaraSignatures.internal — True if the signature is only for internal usage
  • Lastline.Submission.Process.process_id — The process ID
  • Lastline.Submission.Process.executable.abs_path — Absolute path of the executable of the process
  • Lastline.Submission.Process.executable.filename — Filename of the executable
  • Lastline.Submission.Process.executable.yara_signature_hits — Yara signature of the executable of the process
  • URL — URL object
  • URL.Malicious — URL Malicious object
  • DBotScore — DBot score object
  • Lastline.Submission — Lastline submission object

Commands used

lastline-check-status lastline-get-report lastline-upload-url

Flowchart

yes yes yes Start Start Lastline Upload URL - lastline-upload-url Lastline Upload URL lastline-upload-url GenericPolling - GenericPolling GenericPolling GenericPolling Lastline Get Report - lastline-get-report Lastline Get Report lastline-get-report Is there a URL to detonate? Is there a URL to detonate? Done Done Is Lastline sandbox enabled? Is Lastline sandbox enabled? Filter UUIDs Filter UUIDs Lastline Check Status - lastline-check-status Lastline Check Status lastline-check-status

Source

playbook-Detonate_URL_-_Lastline.yml playbook-Detonate_URL_-_Lastline_v2.yml playbook-Detonate_URL_-_Lastline_v2_README.md
Download History Raw 
Detonates a URL using the Lastline Sandbox integration.

## Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks
* GenericPolling

### Integrations
This playbook does not use any integrations.

### Scripts
This playbook does not use any scripts.

### Commands
* lastline-upload-url
* lastline-check-status
* lastline-get-report

## Playbook Inputs
---

| **Name** | **Description** | **Default Value** | **Source** | **Required** |
| --- | --- | --- | --- | --- |
| URL | The URL to detonate. | Data | URL | Optional |
| Interval | The polling frequency. How often the polling command should run (in minutes). | 1 | - | Optional |
| Timeout | The amount of time to wait before a timeout occurs (in minutes). | 15 | - | Optional |

## Playbook Outputs
---

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| File.Size | The file size (only in case of report type=json). | number |
| DBotScore.Indicator | The indicator that was tested (only in case of report type=json). | string |
| DBotScore.Vendor | The vendor used to calculate the score (only in case of report type=json). | string |
| DBotScore.Score | The actual score (only in case of report type=json). | number |
| IP.Address | The IP addresses's relevant to the sample. | string |
| DBotScore.Type | The type of the indicator (only in case of report type=json). | string |
| File.Name | The filename (only in case of report type=json). | string |
| File.Type | The file type. For example, "PE" (only in case of report type=json). | string |
| File.MD5 | The MD5 hash of the file (only in case of report type=json). | string |
| File.SHA1 | The SHA1 hash of the file (only in case of report type=json). | string |
| File.SHA256 | The SHA256 hash of the file (only in case of report type=json). | string |
| File.EntryID | The Entry ID of the sample. | string |
| File.Malicious.Vendor | The vendor that determined that a file is malicious. | string |
| File.Malicious.Description | The reason that the vendor determined that the file is malicious. | string |
| URL.Data | The list of malicious URLs identified by Lastline analysis. | string |
| URL.Malicious.Vendor | The vendor that determined that the URL is malicious. | string |
| URL.Malicious.Description | The reason that the vendor determined that the URL is malicious. | string |
| URL.Malicious.Score | The score that the malicious URL received from the vendor. | number |
| File.Malicious.Score | The score that the malicious file received from the vendor. | number |
| Lastline.Submission.Status | The status of the submission. | string |
| Lastline.Submission.DNSqueries | The list of DNS queries done by the analysis subject. | string |
| Lastline.Submission.NetworkConnections | The list of network connections done by the analysis subject. | string |
| Lastline.Submission.DownloadedFiles | The list of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element. | string |
| Lastline.Submission.UUID | The ID of the submission. | string |
| Lastline.Submission.YaraSignatures.name | The Yara signatures name. | string |
| Lastline.Submission.YaraSignatures.score | The score according to the yara signatures. Must be from 0 to 100. | number |
| Lastline.Submission.Process.arguments | The argument of the process. | string |
| Lastline.Submission.YaraSignatures.internal | Whether the signature is only for internal use. | boolean |
| Lastline.Submission.Process.process_id | The process ID. | string |
| Lastline.Submission.Process.executable.abs_path | The absolute path of the executable of the process. | string |
| Lastline.Submission.Process.executable.filename | The filename of the executable. | string |
| Lastline.Submission.Process.executable.yara_signature_hits | The Yara signature of the executable of the process. | string |
| URL | The URL object. | unknown |
| URL.Malicious | The URL Malicious object. | unknown |
| DBotScore | The DBot score object. | unknown |
| Lastline.Submission | The Lastline submission object. | unknown |

## Playbook Image
---
![Detonate_URL_Lastline_v2](../doc_files/Detonate_URL_-_Lastline_v2.png)