Detonate URL - ThreatStream

Detonates one or more URLs using the Anomali ThreatStream sandbox integration. Returns relevant reports to the War Room and URL reputations to the context data.

Anomali ThreatStream · 7 tasks · 7 inputs · 26 outputs

Inputs

  • URL — URL to detonate.
  • Interval — How often to execute polling (in minutes).
  • Timeout — The duration after which to stop polling and to resume the playbook (in minutes).
  • VM — The VM to use (string)
  • SubmissionClassification — Classification of the sandbox submission.
  • PremiumSandbox — Specifies if the premium sandbox should be used for detonation.
  • Tags — A CSV list of tags applied to this sample.

Outputs

  • ThreatStream.Analysis.ReportID — The report ID submitted to the sandbox.
  • ThreatStream.Analysis.Status — The analysis status.
  • ThreatStream.Analysis.Platform — The platform of the submission submitted to the sandbox.
  • ThreatStream.Analysis.Category — The report category.
  • ThreatStream.Analysis.Started — The detonation start time.
  • ThreatStream.Analysis.Completed — The detonation completion time.
  • ThreatStream.Analysis.Duration — The duration of the detonation (in seconds).
  • ThreatStream.Analysis.VmName — The VM name.
  • ThreatStream.Analysis.VmID — The VM ID.
  • ThreatStream.Analysis.Verdict — The verdict of the sandbox detonation.
  • ThreatStream.Analysis.Network.UdpSource — The UDP source.
  • ThreatStream.Analysis.Network.UdpDestination — The UDP destination.
  • ThreatStream.Analysis.Network.UdpPort — The UDP port.
  • ThreatStream.Analysis.Network.IcmpSource — The ICMP source.
  • ThreatStream.Analysis.Network.IcmpDestination — The ICMP destination.
  • ThreatStream.Analysis.Network.IcmpPort — The ICMP port.
  • ThreatStream.Analysis.Network.TcpSource — The TCP source.
  • ThreatStream.Analysis.Network.TcpDestination — The TCP destination.
  • ThreatStream.Analysis.Network.TcpPort — The TCP port.
  • ThreatStream.Analysis.Network.HttpSource — The source of the HTTP address.
  • ThreatStream.Analysis.Network.HttpDestinaton — The destination of the HTTP address.
  • ThreatStream.Analysis.Network.HttpPort — The port of the HTTP address.
  • ThreatStream.Analysis.Network.HttpsSource — The source of the HTTPS address.
  • ThreatStream.Analysis.Network.HttpsDestinaton — The destination of the HTTPS address.
  • ThreatStream.Analysis.Network.HttpsPort — The port of the HTTPS address.
  • ThreatStream.Analysis.Network.Hosts — The network analysis hosts.

Commands used

threatstream-analysis-report threatstream-submit-to-sandbox

Flowchart

yes yes Start Start ThreatStream Submit URL for Analysis - threatstream-submit-to-sandbox ThreatStream Submit URL f... threatstream-submit-to-sandbox GenericPolling - GenericPolling GenericPolling GenericPolling Done Done Is there a URL to detonate? Is there a URL to detonate? Is Anomali ThreatStream v2 or v3 enabled? Is Anomali ThreatStream v... ThreatStream Get Report - threatstream-analysis-report ThreatStream Get Report threatstream-analysis-report