Detonate URL - Trend Micro Deep Discovery Analyzer Beta

Details

ID	`Detonate URL - Trend Micro Deep Discovery Analyzer Beta`
From Version	5.0.0
Tasks	8

README

Detonates a URL using the TrendAI™ Deep Discovery™ Analyzer sandbox.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

Trend Micro Deep Discovery Analyzer

Scripts

This playbook does not use any scripts.

Commands

trendmicro-dda-check-status
trendmicro-dda-get-report
trendmicro-dda-upload-url

Playbook Inputs

Name	Description	Default Value	Required
URL	URL to detonate.	URL.Data	Required
interval	Polling frequency - how often the polling command should run (minutes)	1	Optional
timeput	How much time to wait before a timeout occurs (minutes)	15	Optional

Playbook Outputs

Path	Description	Type
InfoFile.Type	Report file type e.g. “PE”	string
InfoFile.SHA256	SHA256 hash of the report file	string
TrendMicroDDA.Submissions.SHA1	The SHA1 of the submission	string
TrendMicroDDA.Submissions.RiskLevel	The Risk Level of the sample	number
DBotScore.Score	The actual score	number
TrendMicroDDA.Submissions.isCompleted	Stating if the detonation was complete or not	string
DBotScore.Indicator	The indicator we tested	string
TrendMicroDDA.Submissions.status	The status of the sample	string
DBotScore.Type	The type of the indicator	string
DBotScore.Vendor	Vendor used to calculate the score	string
InfoFile.MD5	MD5 hash of the report file	string
InfoFile.Name	Report file name	string
InfoFile.Size	Report file size	number
File.Malicious.Vendor	For malicious files, the vendor that made the decision	string
File.Malicious.Description	For malicious files, the reason for the vendor to make the decision	string
IP.Address	IPs relevant to the submission	string
Domain.Name	Domains relevant to the submission	string
URL.Data	URL data	string
File.MD5	MD5 hash of the file	string
File.SHA1	SHA1 hash of the file	string
File.SHA256	SHA256 hash of the file	string
File.Size	File size	number
File.Name	File name	string

Playbook Image

Detonate URL - Trend Micro Deep Discovery Analyzer Beta

Inputs

URL — URL to detonate.
interval — Polling frequency - how often the polling command should run (minutes)
timeput — How much time to wait before a timeout occurs (minutes)

Outputs

InfoFile.Type — Report file type e.g. "PE"
InfoFile.SHA256 — SHA256 hash of the report file
TrendMicroDDA.Submissions.SHA1 — The SHA1 of the submission
TrendMicroDDA.Submissions.RiskLevel — The Risk Level of the sample
DBotScore.Score — The actual score
TrendMicroDDA.Submissions.isCompleted — Stating if the detonation was complete or not
DBotScore.Indicator — The indicator we tested
TrendMicroDDA.Submissions.status — The status of the sample
DBotScore.Type — The type of the indicator
DBotScore.Vendor — Vendor used to calculate the score
InfoFile.MD5 — MD5 hash of the report file
InfoFile.Name — Report file name
InfoFile.Size — Report file size
File.Malicious.Vendor — For malicious files, the vendor that made the decision
File.Malicious.Description — For malicious files, the reason for the vendor to make the decision
IP.Address — IPs relevant to the submission
Domain.Name — Domains relevant to the submission
URL.Data — URL data
File.MD5 — MD5 hash of the file
File.SHA1 — SHA1 hash of the file
File.SHA256 — SHA256 hash of the file
File.Size — File size
File.Name — File name

Commands used

trendmicro-dda-check-status trendmicro-dda-get-report trendmicro-dda-upload-url

Flowchart

Source

playbook-TrendMicro_DDA_DetonateURL.yml

Download History Raw

id: Detonate URL - Trend Micro Deep Discovery Analyzer Beta
version: -1
name: Detonate URL - Trend Micro Deep Discovery Analyzer Beta
fromversion: 5.0.0
description: Detonates a URL using the TrendAI™ Deep Discovery™ Analyzer sandbox.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 3c10637b-c0a9-482b-8d11-9ff6cf5e1744
    type: start
    task:
      id: 3c10637b-c0a9-482b-8d11-9ff6cf5e1744
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
  "1":
    id: "1"
    taskid: 067fee81-9349-4ce8-8f0c-f67792bb9e1c
    type: title
    task:
      id: 067fee81-9349-4ce8-8f0c-f67792bb9e1c
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1245
        }
      }
    note: false
  "2":
    id: "2"
    taskid: 24b1a988-d269-4afb-85a3-16584d9c5439
    type: condition
    task:
      id: 24b1a988-d269-4afb-85a3-16584d9c5439
      version: -1
      name: Is TrendAI™ DDA sandbox enabled?
      description: |
        Verify that there is a valid instance of TrendAI™ DDA enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "1"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Trend Micro Deep Discovery Analyzer Beta
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
  "3":
    id: "3"
    taskid: c557351c-345a-473c-8794-272f09e4d8b1
    type: condition
    task:
      id: c557351c-345a-473c-8794-272f09e4d8b1
      version: -1
      name: Is there a URL to Detonate?
      description: Checks that there is a URL in the playbook’s input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "1"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
  "4":
    id: "4"
    taskid: 917498dc-d53f-491d-8716-02db8173615c
    type: regular
    task:
      id: 917498dc-d53f-491d-8716-02db8173615c
      version: -1
      name: TrendAI™ DDA Upload URL
      description: |
        Uploads the submission to TrendAI™ DDA.
      script: '|||trendmicro-dda-upload-url'
      type: regular
      iscommand: true
      brand: Trend Micro Deep Discovery Analyzer
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      extend-context: {}
      url:
        simple: ${inputs.URL}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
  "5":
    id: "5"
    taskid: ac91e98c-c048-4e83-8ecc-5136ef9ec6a8
    type: playbook
    task:
      id: ac91e98c-c048-4e83-8ecc-5136ef9ec6a8
      version: -1
      name: GenericPolling
      description: Generic Polling Playbook
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      Ids:
        simple: ${TrendMicroDDA.Submission.SHA1}
      Interval:
        simple: "1"
      PollingCommandArgName:
        simple: sha1
      PollingCommandName:
        simple: trendmicro-dda-check-status
      Timeout:
        simple: "10"
      dt:
        simple: TrendMicroDDA.Submission(val.Status != 'Completed').SHA1
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
  "6":
    id: "6"
    taskid: 6e9c7162-7dda-4c05-8df8-44215feb1674
    type: regular
    task:
      id: 6e9c7162-7dda-4c05-8df8-44215feb1674
      version: -1
      name: trendmicro-dda-check-status
      description: Updates the status of the submissions in the context.
      script: '|||trendmicro-dda-check-status'
      type: regular
      iscommand: true
      brand: Trend Micro Deep Discovery Analyzer
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      extend-context: {}
      sha1:
        simple: ${TrendMicroDDA.Submission.SHA1}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 895
        }
      }
    note: false
  "7":
    id: "7"
    taskid: db69eb80-00f4-41ed-8844-b434ca5a0e62
    type: regular
    task:
      id: db69eb80-00f4-41ed-8844-b434ca5a0e62
      version: -1
      name: TrendAI™ DDA Get Report
      description: Retrieve the reports from TrendAI™ DDA.
      script: '|||trendmicro-dda-get-report'
      type: regular
      iscommand: true
      brand: Trend Micro Deep Discovery Analyzer
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      sha1:
        simple: ${TrendMicroDDA.Submission(val.Status == 'Completed').SHA1}
      threshold: {}
      verbose: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1070
        }
      }
    note: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1260,
        "width": 605,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: true
  description: URL to detonate.
- key: interval
  value:
    simple: "1"
  required: false
  description: Polling frequency - how often the polling command should run (minutes)
- key: timeput
  value:
    simple: "15"
  required: false
  description: How much time to wait before a timeout occurs (minutes)
outputs:
- contextPath: InfoFile.Type
  description: Report file type e.g. "PE"
  type: string
- contextPath: InfoFile.SHA256
  description: SHA256 hash of the report  file
  type: string
- contextPath: TrendMicroDDA.Submissions.SHA1
  description: The SHA1 of the submission
  type: string
- contextPath: TrendMicroDDA.Submissions.RiskLevel
  description: The Risk Level of the sample
  type: number
- contextPath: DBotScore.Score
  description: The actual score
  type: number
- contextPath: TrendMicroDDA.Submissions.isCompleted
  description: Stating if the detonation was complete or not
  type: string
- contextPath: DBotScore.Indicator
  description: The indicator we tested
  type: string
- contextPath: TrendMicroDDA.Submissions.status
  description: The status of the sample
  type: string
- contextPath: DBotScore.Type
  description: The type of the indicator
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score
  type: string
- contextPath: InfoFile.MD5
  description: MD5 hash of the report file
  type: string
- contextPath: InfoFile.Name
  description: Report file name
  type: string
- contextPath: InfoFile.Size
  description: 'Report file size '
  type: number
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision
  type: string
- contextPath: File.Malicious.Description
  description: For malicious files, the reason for the vendor to make the decision
  type: string
- contextPath: IP.Address
  description: IPs relevant to the submission
  type: string
- contextPath: Domain.Name
  description: Domains relevant to the submission
  type: string
- contextPath: URL.Data
  description: URL data
  type: string
- contextPath: File.MD5
  description: MD5 hash of the file
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file
  type: string
- contextPath: File.SHA256
  description: SHA256 hash of the file
  type: string
- contextPath: File.Size
  description: File size
  type: number
- contextPath: File.Name
  description: File name
  type: string
beta: true
tests:
- No Test - run "Test Playbook TrendMicroDDA" manually