Detonate URL - VMRay

Detonates a URL using the VMRay sandbox integration.

VMRay Analyzer · 15 tasks · 3 inputs · 61 outputs

Details

IDDetonate URL - VMRay
From Version5.5.0
Tasks15

README

Detonates a URL using the VMRay sandbox integration.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

  • VMRay

Scripts

  • IsIntegrationAvailable

Commands

  • vmray-get-analysis-by-sample
  • vmray-get-iocs
  • vmray-get-sample
  • vmray-get-submission
  • vmray-get-threat-indicators
  • vmray-upload-url

Playbook Inputs

Name Description Default Value Required
URL The URL to detonate. URL.Data Optional
interval How often to poll for results (minutes). 1 Optional
timeout How long to wait before giving up waiting for results (minutes). 10 Optional

Playbook Outputs

Path Description Type
VMRay.Job.JobID The ID of a new job. number
VMRay.Job.SampleID The ID of sample. number
VMRay.Job.Created The timestamp of the created job. date
VMRay.Job.VMName The name of virtual machine. string
VMRay.Job.VMID The ID of virtual machine. number
VMRay.Sample.SampleID The sample ID of the task. number
VMRay.Sample.Created The timestamp of the created sample. date
VMRay.Submission.SubmissionID The submission ID. number
VMRay.Submission.HadErrors Whether there are any errors in the submission. boolean
VMRay.Submission.IsFinished The status of submission. Can be, “true” or “false”. boolean
VMRay.Submission.MD5 The MD5 hash of the sample in submission. string
VMRay.Submission.SHA1 The SHA1 hash of the sample in submission. string
VMRay.Submission.SHA256 The SHA256 hash of the sample in submission. string
VMRay.Submission.Verdict Verdict for the sample (Malicious, Suspicious, Clean, Not Available). String
VMRay.Submission.VerdictReason Description of the Verdict Reason. String
VMRay.Submission.Severity Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated. string
VMRay.Submission.SSDeep The SSDeep hash of the sample in submission. string
VMRay.Submission.SampleID The ID of the sample in submission. number
VMRay.Sample.FileName The file name of the sample. string
VMRay.Sample.MD5 The MD5 hash of the sample. string
VMRay.Sample.SHA1 The SHA1 hash of the sample. string
VMRay.Sample.SHA256 The SHA256 hash of the sample. string
VMRay.Sample.SSDeep The SSDeep of the sample. string
VMRay.Sample.Verdict Verdict for the sample (Malicious, Suspicious, Clean, Not Available). String
VMRay.Sample.VerdictReason Description of the Verdict Reason. String
VMRay.Sample.Severity Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated. string
VMRay.Sample.Type The file type. string
VMRay.Sample.Classifications The classifications of the sample. string
VMRay.Sample.IOC.URL.AnalysisID The IDs of the other analyses that contain the given URL. number
VMRay.Sample.IOC.URL.URL The URL. unknown
VMRay.Sample.IOC.URL.Operation The operation of the specified URL. unknown
VMRay.Sample.IOC.URL.ID The ID of the URL. unknown
VMRay.Sample.IOC.URL.Type The type of the URL. unknown
VMRay.Sample.IOC.Domain.AnalysisID The IDs of the other analyses that contain the given domain. unknown
VMRay.Sample.IOC.Domain.Domain The domain. unknown
VMRay.Sample.IOC.Domain.ID The ID of the domain. unknown
VMRay.Sample.IOC.Domain.Type The type of the domain. unknown
VMRay.Sample.IOC.IP.AnalysisID The IDs of the other analyses that contain the given IP address. unknown
VMRay.Sample.IOC.IP.IP The IP address. unknown
VMRay.Sample.IOC.IP.Operation The operation of the given IP address. unknown
VMRay.Sample.IOC.IP.ID The ID of the IP address. unknown
VMRay.Sample.IOC.IP.Type The type of the IP address. unknown
VMRay.Sample.IOC.Mutex.AnalysisID The IDs of other analyses that contain the given IP address. unknown
VMRay.Sample.IOC.Mutex.Name The name of the mutex. unknown
VMRay.Sample.IOC.Mutex.Operation The operation of the given mutex unknown
VMRay.Sample.IOC.Mutex.ID The ID of the mutex. unknown
VMRay.Sample.IOC.Mutex.Type The type of the mutex. unknown
VMRay.Sample.IOC.File.AnalysisID The IDs of other analyses that contain the given file. unknown
VMRay.Sample.IOC.File.Name The name of the file. unknown
VMRay.Sample.IOC.File.Operation The operation of the given file. unknown
VMRay.Sample.IOC.File.ID The ID of the file. unknown
VMRay.Sample.IOC.File.Type The type of the file. unknown
VMRay.Sample.IOC.File.Hashes.MD5 The MD5 hash of the given file. unknown
VMRay.Sample.IOC.File.Hashes.SSDeep The SSDeep hash of the given file. unknown
VMRay.Sample.IOC.File.Hashes.SHA256 The SHA256 hash of the given file. unknown
VMRay.Sample.IOC.File.Hashes.SHA1 The SHA1 hash of the given file. unknown
VMRay.ThreatIndicator.AnalysisID The list of connected analysis IDs. unknown
VMRay.ThreatIndicator.Category The category of threat indicators. unknown
VMRay.ThreatIndicator.Classification The classifications of threat indicators. unknown
VMRay.ThreatIndicator.ID The ID of the threat indicator. unknown
VMRay.ThreatIndicator.Operation The operation that caused the indicators. unknown

Playbook Image

Detonate URL - VMRay

Inputs

  • URL — The URL to detonate.
  • interval — How often to poll for results (minutes).
  • timeout — How long to wait before giving up waiting for results (minutes).

Outputs

  • VMRay.Job.JobID — The ID of a new job.
  • VMRay.Job.SampleID — The ID of sample.
  • VMRay.Job.Created — The timestamp of the created job.
  • VMRay.Job.VMName — The name of virtual machine.
  • VMRay.Job.VMID — The ID of virtual machine.
  • VMRay.Sample.SampleID — The sample ID of the task.
  • VMRay.Sample.Created — The timestamp of the created sample.
  • VMRay.Submission.SubmissionID — The submission ID.
  • VMRay.Submission.HadErrors — Whether there are any errors in the submission.
  • VMRay.Submission.IsFinished — The status of submission. Can be, "true" or "false".
  • VMRay.Submission.MD5 — The MD5 hash of the sample in submission.
  • VMRay.Submission.SHA1 — The SHA1 hash of the sample in submission.
  • VMRay.Submission.SHA256 — The SHA256 hash of the sample in submission.
  • VMRay.Submission.Verdict — Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
  • VMRay.Submission.VerdictReason — Description of the Verdict Reason.
  • VMRay.Submission.Severity — Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated.
  • VMRay.Submission.SSDeep — The SSDeep hash of the sample in submission.
  • VMRay.Submission.SampleID — The ID of the sample in submission.
  • VMRay.Sample.FileName — The file name of the sample.
  • VMRay.Sample.MD5 — The MD5 hash of the sample.
  • VMRay.Sample.SHA1 — The SHA1 hash of the sample.
  • VMRay.Sample.SHA256 — The SHA256 hash of the sample.
  • VMRay.Sample.SSDeep — The SSDeep of the sample.
  • VMRay.Sample.Verdict — Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
  • VMRay.Sample.VerdictReason — Description of the Verdict Reason.
  • VMRay.Sample.Severity — Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated.
  • VMRay.Sample.Type — The file type.
  • VMRay.Sample.Classifications — The classifications of the sample.
  • VMRay.Sample.IOC.URL.AnalysisID — The IDs of the other analyses that contain the given URL.
  • VMRay.Sample.IOC.URL.URL — The URL.
  • VMRay.Sample.IOC.URL.Operation — The operation of the specified URL.
  • VMRay.Sample.IOC.URL.ID — The ID of the URL.
  • VMRay.Sample.IOC.URL.Type — The type of the URL.
  • VMRay.Sample.IOC.Domain.AnalysisID — The IDs of the other analyses that contain the given domain.
  • VMRay.Sample.IOC.Domain.Domain — The domain.
  • VMRay.Sample.IOC.Domain.ID — The ID of the domain.
  • VMRay.Sample.IOC.Domain.Type — The type of the domain.
  • VMRay.Sample.IOC.IP.AnalysisID — The IDs of the other analyses that contain the given IP address.
  • VMRay.Sample.IOC.IP.IP — The IP address.
  • VMRay.Sample.IOC.IP.Operation — The operation of the given IP address.
  • VMRay.Sample.IOC.IP.ID — The ID of the IP address.
  • VMRay.Sample.IOC.IP.Type — The type of the IP address.
  • VMRay.Sample.IOC.Mutex.AnalysisID — The IDs of other analyses that contain the given IP address.
  • VMRay.Sample.IOC.Mutex.Name — The name of the mutex.
  • VMRay.Sample.IOC.Mutex.Operation — The operation of the given mutex
  • VMRay.Sample.IOC.Mutex.ID — The ID of the mutex.
  • VMRay.Sample.IOC.Mutex.Type — The type of the mutex.
  • VMRay.Sample.IOC.File.AnalysisID — The IDs of other analyses that contain the given file.
  • VMRay.Sample.IOC.File.Name — The name of the file.
  • VMRay.Sample.IOC.File.Operation — The operation of the given file.
  • VMRay.Sample.IOC.File.ID — The ID of the file.
  • VMRay.Sample.IOC.File.Type — The type of the file.
  • VMRay.Sample.IOC.File.Hashes.MD5 — The MD5 hash of the given file.
  • VMRay.Sample.IOC.File.Hashes.SSDeep — The SSDeep hash of the given file.
  • VMRay.Sample.IOC.File.Hashes.SHA256 — The SHA256 hash of the given file.
  • VMRay.Sample.IOC.File.Hashes.SHA1 — The SHA1 hash of the given file.
  • VMRay.ThreatIndicator.AnalysisID — The list of connected analysis IDs.
  • VMRay.ThreatIndicator.Category — The category of threat indicators.
  • VMRay.ThreatIndicator.Classification — The classifications of threat indicators.
  • VMRay.ThreatIndicator.ID — The ID of the threat indicator.
  • VMRay.ThreatIndicator.Operation — The operation that caused the indicators.

Commands used

vmray-get-analysis-by-sample vmray-get-iocs vmray-get-sample vmray-get-submission vmray-get-threat-indicators vmray-upload-url

Flowchart

yes yes yes yes Start Start GenericPolling - GenericPolling GenericPolling GenericPolling Is there a URL to detonate? Is there a URL to detonate? VMRay Upload URL - vmray-upload-url VMRay Upload URL vmray-upload-url Done Done Get sample - vmray-get-sample Get sample vmray-get-sample Get submission - vmray-get-submission Get submission vmray-get-submission Get analysis - vmray-get-analysis-by-sample Get analysis vmray-get-analysis-by-sample Is sample suspicious or malicious? Is sample suspicious or m... Get IOCs - vmray-get-iocs Get IOCs vmray-get-iocs Get Threat Indicators - vmray-get-threat-indicators Get Threat Indicators vmray-get-threat-indicators Is there an active VMRay instance? - IsIntegrationAvailable Is there an active VMRay ... IsIntegrationAvailable Get Child IOCs - vmray-get-iocs Get Child IOCs vmray-get-iocs Get Child VTIs - vmray-get-threat-indicators Get Child VTIs vmray-get-threat-indicators Is there a child submission? Is there a child submission?

Source

playbook-VMRay-Detonate-URL.yml
Download History Raw 
id: Detonate URL - VMRay
version: -1
name: Detonate URL - VMRay
description: Detonates a URL using the VMRay sandbox integration.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 60d14579-f27c-4014-b49a-4df09938a69e
    type: start
    task:
      id: 60d14579-f27c-4014-b49a-4df09938a69e
      version: -1
      name: ""
      description: start
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 628e8784-3064-4afb-8b31-3db10b925a01
    type: playbook
    task:
      id: 628e8784-3064-4afb-8b31-3db10b925a01
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Ids:
        complex:
          root: VMRay.Submission
          accessor: SubmissionID
      Interval:
        complex:
          root: inputs.interval
      PollingCommandArgName:
        simple: submission_id
      PollingCommandName:
        simple: vmray-get-submission
      Timeout:
        complex:
          root: inputs.timeout
      dt:
        simple: VMRay.Submission(val.IsFinished == false).SubmissionID
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 0d7a60e2-d686-4f14-b43b-0576d74bf00d
    type: condition
    task:
      id: 0d7a60e2-d686-4f14-b43b-0576d74bf00d
      version: -1
      name: Is there a URL to detonate?
      description: Checks if there is a URL in the playbook’s input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 936c15f7-7d0f-4c41-b6f3-cf05881f4969
    type: regular
    task:
      id: 936c15f7-7d0f-4c41-b6f3-cf05881f4969
      version: -1
      name: VMRay Upload URL
      description: Submit URL for analysis.
      script: '|||vmray-upload-url'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      url:
        complex:
          root: inputs.URL
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: dca7b75c-681b-4ed9-a9b8-94198974c0db
    type: title
    task:
      id: dca7b75c-681b-4ed9-a9b8-94198974c0db
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 2600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: e04293bd-c0a1-4f96-8abc-444ea5d42cee
    type: regular
    task:
      id: e04293bd-c0a1-4f96-8abc-444ea5d42cee
      version: -1
      name: Get sample
      description: get sample by sample id
      script: '|||vmray-get-sample'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      sample_id:
        complex:
          root: VMRay.Submission
          accessor: SampleID
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: a7dcb1e4-dbfc-4e16-a586-f5ba0c9fbb7d
    type: regular
    task:
      id: a7dcb1e4-dbfc-4e16-a586-f5ba0c9fbb7d
      version: -1
      name: Get submission
      description: Gets a submission result
      script: '|||vmray-get-submission'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      submission_id:
        complex:
          root: VMRay.Submission
          accessor: SubmissionID
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: c3457fa4-7b07-41cb-b9e5-f0b523141429
    type: regular
    task:
      id: c3457fa4-7b07-41cb-b9e5-f0b523141429
      version: -1
      name: Get analysis
      description: Retrieves all analysis details for a specified sample.
      script: '|||vmray-get-analysis-by-sample'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      sample_id:
        complex:
          root: VMRay
          accessor: Sample.SampleID
          transformers:
          - operator: uniq
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: ${VMRay.Sample.SampleID}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 74eb49b0-5fca-48a6-865a-3bd4ca6e727a
    type: condition
    task:
      id: 74eb49b0-5fca-48a6-865a-3bd4ca6e727a
      version: -1
      name: Is sample suspicious or malicious?
      description: check term
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: VMRay
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: VMRay.Sample.Verdict
                      iscontext: true
                    right:
                      value:
                        simple: Malicious
                accessor: Sample.Verdict
            iscontext: true
          right:
            value: {}
        - operator: isExists
          left:
            value:
              complex:
                root: VMRay
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: VMRay.Sample.Verdict
                      iscontext: true
                    right:
                      value:
                        simple: Suspicious
                accessor: Sample.Verdict
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 399942d7-ccfe-491e-87c0-dc9534f491ae
    type: regular
    task:
      id: 399942d7-ccfe-491e-87c0-dc9534f491ae
      version: -1
      name: Get IOCs
      description: Retrieves indicators of compromise for a specified sample.
      script: '|||vmray-get-iocs'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      sample_id:
        complex:
          root: VMRay
          accessor: Analysis.SampleID
          transformers:
          - operator: uniq
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: ${VMRay.Sample.SampleID}
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 600,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 4a576c94-a14a-4b4c-ad71-837742cfd371
    type: regular
    task:
      id: 4a576c94-a14a-4b4c-ad71-837742cfd371
      version: -1
      name: Get Threat Indicators
      description: Retrieves threat indicators (VTI).
      script: '|||vmray-get-threat-indicators'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      sample_id:
        complex:
          root: VMRay
          accessor: Analysis.SampleID
          transformers:
          - operator: uniq
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: ${VMRay.Sample.SampleID}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 600,
          "y": 1775
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: bbcdb264-06cf-43f6-88c4-c816ee1c29dd
    type: condition
    task:
      id: bbcdb264-06cf-43f6-88c4-c816ee1c29dd
      version: -1
      name: Is there an active VMRay instance?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "4"
    scriptarguments:
      brandname:
        simple: vmray
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: d3234463-264c-4371-8845-78f6f9196ef0
    type: regular
    task:
      id: d3234463-264c-4371-8845-78f6f9196ef0
      version: -1
      name: Get Child IOCs
      description: Retrieves Indicators of Compromise for a specified sample.
      script: '|||vmray-get-iocs'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      sample_id:
        simple: ${VMRay.Sample.ChildSampleIDs}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 840,
          "y": 2140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 98e20401-9c9c-4174-85dc-84a2692ffb04
    type: regular
    task:
      id: 98e20401-9c9c-4174-85dc-84a2692ffb04
      version: -1
      name: Get Child VTIs
      description: Retrieves threat indicators (VTI).
      script: '|||vmray-get-threat-indicators'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      sample_id:
        simple: ${VMRay.Sample.ChildSampleIDs}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 840,
          "y": 2300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: d5411c51-eb22-4011-8734-060194ab795f
    type: condition
    task:
      id: d5411c51-eb22-4011-8734-060194ab795f
      version: -1
      name: Is there a child submission?
      description: Returns "yes" if a child submission is available
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "16"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: VMRay.Sample.ChildSampleIDs
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 602.5,
          "y": 1930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "4_6_yes": 0.89
    },
    "paper": {
      "dimensions": {
        "height": 2615,
        "width": 1170,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: false
  description: The URL to detonate.
  playbookInputQuery:
- key: interval
  value:
    simple: "1"
  required: false
  description: How often to poll for results (minutes).
  playbookInputQuery:
- key: timeout
  value:
    simple: "10"
  required: false
  description: How long to wait before giving up waiting for results (minutes).
  playbookInputQuery:
outputs:
- contextPath: VMRay.Job.JobID
  description: The ID of a new job.
  type: number
- contextPath: VMRay.Job.SampleID
  description: The ID of sample.
  type: number
- contextPath: VMRay.Job.Created
  description: The timestamp of the created job.
  type: date
- contextPath: VMRay.Job.VMName
  description: The name of virtual machine.
  type: string
- contextPath: VMRay.Job.VMID
  description: The ID of virtual machine.
  type: number
- contextPath: VMRay.Sample.SampleID
  description: The sample ID of the task.
  type: number
- contextPath: VMRay.Sample.Created
  description: The timestamp of the created sample.
  type: date
- contextPath: VMRay.Submission.SubmissionID
  description: The submission ID.
  type: number
- contextPath: VMRay.Submission.HadErrors
  description: Whether there are any errors in the submission.
  type: boolean
- contextPath: VMRay.Submission.IsFinished
  description: The status of submission. Can be, "true" or "false".
  type: boolean
- contextPath: VMRay.Submission.MD5
  description: The MD5 hash of the sample in submission.
  type: string
- contextPath: VMRay.Submission.SHA1
  description: The SHA1 hash of the sample in submission.
  type: string
- contextPath: VMRay.Submission.SHA256
  description: The SHA256 hash of the sample in submission.
  type: string
- contextPath: VMRay.Submission.Verdict
  description: Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
  type: String
- contextPath: VMRay.Submission.VerdictReason
  description: Description of the Verdict Reason.
  type: String
- contextPath: VMRay.Submission.Severity
  description: Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated.
  type: string
- contextPath: VMRay.Submission.SSDeep
  description: The SSDeep hash of the sample in submission.
  type: string
- contextPath: VMRay.Submission.SampleID
  description: The ID of the sample in submission.
  type: number
- contextPath: VMRay.Sample.FileName
  description: The file name of the sample.
  type: string
- contextPath: VMRay.Sample.MD5
  description: The MD5 hash of the sample.
  type: string
- contextPath: VMRay.Sample.SHA1
  description: The SHA1 hash of the sample.
  type: string
- contextPath: VMRay.Sample.SHA256
  description: The SHA256 hash of the sample.
  type: string
- contextPath: VMRay.Sample.SSDeep
  description: The SSDeep of the sample.
  type: string
- contextPath: VMRay.Sample.Verdict
  description: Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
  type: String
- contextPath: VMRay.Sample.VerdictReason
  description: Description of the Verdict Reason.
  type: String
- contextPath: VMRay.Sample.Severity
  description: Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated.
  type: string
- contextPath: VMRay.Sample.Type
  description: The file type.
  type: string
- contextPath: VMRay.Sample.Classifications
  description: The classifications of the sample.
  type: string
- contextPath: VMRay.Sample.IOC.URL.AnalysisID
  description: The IDs of the other analyses that contain the given URL.
  type: number
- contextPath: VMRay.Sample.IOC.URL.URL
  description: The URL.
- contextPath: VMRay.Sample.IOC.URL.Operation
  description: The operation of the specified URL.
- contextPath: VMRay.Sample.IOC.URL.ID
  description: The ID of the URL.
- contextPath: VMRay.Sample.IOC.URL.Type
  description: The type of the URL.
- contextPath: VMRay.Sample.IOC.Domain.AnalysisID
  description: The IDs of the other analyses that contain the given domain.
- contextPath: VMRay.Sample.IOC.Domain.Domain
  description: The domain.
- contextPath: VMRay.Sample.IOC.Domain.ID
  description: The ID of the domain.
- contextPath: VMRay.Sample.IOC.Domain.Type
  description: The type of the domain.
- contextPath: VMRay.Sample.IOC.IP.AnalysisID
  description: The IDs of the other analyses that contain the given IP address.
- contextPath: VMRay.Sample.IOC.IP.IP
  description: The IP address.
- contextPath: VMRay.Sample.IOC.IP.Operation
  description: The operation of the given IP address.
- contextPath: VMRay.Sample.IOC.IP.ID
  description: The ID of the IP address.
- contextPath: VMRay.Sample.IOC.IP.Type
  description: The type of the IP address.
- contextPath: VMRay.Sample.IOC.Mutex.AnalysisID
  description: The IDs of other analyses that contain the given IP address.
- contextPath: VMRay.Sample.IOC.Mutex.Name
  description: The name of the mutex.
- contextPath: VMRay.Sample.IOC.Mutex.Operation
  description: The operation of the given mutex
- contextPath: VMRay.Sample.IOC.Mutex.ID
  description: The ID of the mutex.
- contextPath: VMRay.Sample.IOC.Mutex.Type
  description: The type of the mutex.
- contextPath: VMRay.Sample.IOC.File.AnalysisID
  description: The IDs of other analyses that contain the given file.
- contextPath: VMRay.Sample.IOC.File.Name
  description: The name of the file.
- contextPath: VMRay.Sample.IOC.File.Operation
  description: The operation of the given file.
- contextPath: VMRay.Sample.IOC.File.ID
  description: The ID of the file.
- contextPath: VMRay.Sample.IOC.File.Type
  description: The type of the file.
- contextPath: VMRay.Sample.IOC.File.Hashes.MD5
  description: The MD5 hash of the given file.
- contextPath: VMRay.Sample.IOC.File.Hashes.SSDeep
  description: The SSDeep hash of the given file.
- contextPath: VMRay.Sample.IOC.File.Hashes.SHA256
  description: The SHA256 hash of the given file.
- contextPath: VMRay.Sample.IOC.File.Hashes.SHA1
  description: The SHA1 hash of the given file.
- contextPath: VMRay.ThreatIndicator.AnalysisID
  description: The list of connected analysis IDs.
- contextPath: VMRay.ThreatIndicator.Category
  description: The category of threat indicators.
- contextPath: VMRay.ThreatIndicator.Classification
  description: The classifications of threat indicators.
- contextPath: VMRay.ThreatIndicator.ID
  description: The ID of the threat indicator.
- contextPath: VMRay.ThreatIndicator.Operation
  description: The operation that caused the indicators.
fromversion: 5.5.0
tests:
- VMRay-Test-URL