Detonate URL - ThreatGrid v2

Detonate one or more URLs using the ThreatGrid integration.

Cisco Secure Malware Analytics · 5 tasks · 3 inputs · 9 outputs

Details

ID	`Detonate URL - ThreatGrid v2`
From Version	5.0.0
Tasks	5

README

Detonate one or more URLs using the ThreatGrid integration.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

ThreatGridv2

Scripts

This playbook does not use any scripts.

Commands

threat-grid-sample-upload

Playbook Inputs

Name	Description	Default Value	Required
URL	URL of the sites to detonate.	URL.Data	Optional
timeout	Indicates the time in seconds until the polling sequence times out. Default is 60.	60	Optional
interval	Indicates the time in seconds to wait between command execution when ‘polling’ argument is true. Minimum value is 10 seconds. Default is 10.	10	Optional

Playbook Outputs

Path	Description	Type
ThreatGrid.Sample.id	The sample id	string
ThreatGrid.Sample.filename	The sample filename	string
ThreatGrid.Sample.state	The state of the sample, one of a stable set of strings “wait, prep, run, proc, succ, fail”	string
ThreatGrid.Sample.status	The sample status	string
ThreatGrid.Sample.md5	The sample md5	string
ThreatGrid.Sample.sha1	The sample sha1	string
ThreatGrid.Sample.sha256	The sample sha256	string
ThreatGrid.Sample.os	The sample os	string
ThreatGrid.Sample.submitted_at	The sample submission time	string

Playbook Image

Detonate URL - ThreatGrid v2

Inputs

URL — URL of the sites to detonate.
timeout — Indicates the time in seconds until the polling sequence times out. Default is 60.
interval — Indicates the time in seconds to wait between command execution when 'polling' argument is true. Minimum value is 10 seconds. Default is 10.

Outputs

ThreatGrid.Sample.id — The sample id
ThreatGrid.Sample.filename — The sample filename
ThreatGrid.Sample.state — The state of the sample, one of a stable set of strings "wait, prep, run, proc, succ, fail"
ThreatGrid.Sample.status — The sample status
ThreatGrid.Sample.md5 — The sample md5
ThreatGrid.Sample.sha1 — The sample sha1
ThreatGrid.Sample.sha256 — The sample sha256
ThreatGrid.Sample.os — The sample os
ThreatGrid.Sample.submitted_at — The sample submission time

Commands used

threat-grid-sample-upload

Flowchart

Source

playbook-Detonate_URL_-_ThreatGrid_v2.yml

Download History Raw

id: Detonate URL - ThreatGrid v2
version: -1
name: Detonate URL - ThreatGrid v2
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a40217c5-eb07-4e3b-885d-36424a2c5a85
    type: start
    task:
      id: a40217c5-eb07-4e3b-885d-36424a2c5a85
      description: start
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 180c1045-80de-4ba7-8b95-a6f038647bc0
    type: regular
    task:
      id: 180c1045-80de-4ba7-8b95-a6f038647bc0
      version: -1
      name: ThreatGrid Upload URL
      description: Submits a sample to threat grid for analysis. URL or file, not both.
      script: '|||threat-grid-sample-upload'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      interval_in_seconds:
        complex:
          root: inputs.interval
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.interval
                iscontext: true
      timeout_in_seconds:
        complex:
          root: inputs.timeout
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.timeout
                iscontext: true
      url:
        complex:
          root: inputs.URL
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 280,
          "y": 550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 1e5d0366-d6ce-4020-8870-277914fc2ca3
    type: condition
    task:
      id: 1e5d0366-d6ce-4020-8870-277914fc2ca3
      description: Verify that there is a valid ThreatGrid instance enabled.
      version: -1
      name: Is ThreatGrid enabled?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: ThreatGridv2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
          right:
            value: {}
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 805f6930-a82e-438d-88ef-c30ae9d8f3c8
    type: title
    task:
      id: 805f6930-a82e-438d-88ef-c30ae9d8f3c8
      description: title
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 67c20c58-de92-41a6-8418-8eac9bb52eb4
    type: condition
    task:
      id: 67c20c58-de92-41a6-8418-8eac9bb52eb4
      description: Verify that there is a URL to detonate.
      version: -1
      name: Is there a URL to detonate?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "4_3_#default#": 0.61
    },
    "paper": {
      "dimensions": {
        "height": 735,
        "width": 610,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: false
  description: URL of the sites to detonate.
  playbookInputQuery:
- key: timeout
  value:
    simple: "60"
  required: false
  description: Indicates the time in seconds until the polling sequence times out. Default is 60.
  playbookInputQuery:
- key: interval
  value:
    simple: "10"
  required: false
  description: Indicates the time in seconds to wait between command execution when 'polling' argument is true. Minimum value is 10 seconds. Default is 10.
  playbookInputQuery:
outputs:
- contextPath: ThreatGrid.Sample.id
  description: The sample id
  type: string
- contextPath: ThreatGrid.Sample.filename
  description: The sample filename
  type: string
- contextPath: ThreatGrid.Sample.state
  description: The state of the sample, one of a stable set of strings "wait, prep, run, proc, succ, fail"
  type: string
- contextPath: ThreatGrid.Sample.status
  description: The sample status
  type: string
- contextPath: ThreatGrid.Sample.md5
  description: The sample md5
  type: string
- contextPath: ThreatGrid.Sample.sha1
  description: The sample sha1
  type: string
- contextPath: ThreatGrid.Sample.sha256
  description: The sample sha256
  type: string
- contextPath: ThreatGrid.Sample.os
  description: The sample os
  type: string
- contextPath: ThreatGrid.Sample.submitted_at
  description: The sample submission time
  type: string
fromversion: 5.0.0
description: Detonate one or more URLs using the ThreatGrid integration.
tests:
- Detonate URL - Generic Test
contentitemexportablefields:
  contentitemfields:
    propagationLabels:
    - all