Detonate URL - WildFire-v2

Details

ID	`Detonate URL - WildFire-v2`
From Version	5.0.0
Tasks	10

README

Detonates a webpage or a remote file using the WildFire integration. This playbook returns relevant reports to the War Room and file reputations to the context data.

The detonation supports the following file types:
APK, JAR, DOC, DOCX, RTF, OOXLS, XLSX, PPT, PPTX, XML, PE32, PDF, DMG, PKG, RAR, 7Z.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

WildFire-v2

Scripts

This playbook does not use any scripts.

Commands

wildfire-report
wildfire-upload-file-url
wildfire-upload-url

Playbook Inputs

Name	Description	Default Value	Source	Required
URL	The URL of the webpage or the file URL to detonate. The URL is taken from the context.	Data	URL	Optional
Interval	The duration for executing the pooling (in minutes).	1	-	Optional
Timeout	The duration after which to stop pooling and to resume the playbook (in minutes).	15	-	Optional
ReportFileType	The resource type to download. The default is pdf. XML is also possible.	-	-	Optional

Playbook Outputs

Path	Description	Type
DBotScore	The DBotScore object.	unknown
DBotScore.Score	The actual score.	number
File.Size	The file size.	number
File.MD5	The MD5 hash of the file.	string
File.SHA1	The SHA1 hash of the file.	string
File.Type	The file type. For example, “PE”.	string
File.SHA256	Thas SHA256 hash of the file.	string
File.EntryID	The entry ID of the sample.	string
File.Malicious.Vendor	The vendor that made the decision that the file is malicious.	string
File.Name	The filename	string
File.Malicious.Description	The reason for the vendor to make the decision that the file is malicious.	string
DBotScore.Indicator	The indicator that was tested.	string
DBotScore.Type	The type of the indicator.	string
DBotScore.Vendor	The vendor used to calculate the score.	string
IP.Address	The IP addresses’s relevant to the sample.	string
File	The file object.	unknown
InfoFile	The report file object.	unknown
InfoFile.EntryID	The EntryID of the report file.	string
InfoFile.Extension	The extension of the report file.	string
InfoFile.Name	The name of the report file.	string
InfoFile.Info	The info of the report file.	string
InfoFile.Size	The size of the report file.	number
InfoFile.Type	The type of the report file.	string
File.Malicious	The malicious object.	unknown
WildFire.Report	The submission object.	unknown
WildFire.Report.MD5	The MD5 hash of the submission.	string
WildFire.Report.SHA256	The SHA256 hash of the submission.	string
WildFire.Report.FileType	The type of the submission.	string
WildFire.Report.Status	The status of the submission.	string
WildFire.Report.Size	The size of the submission.	number
WildFire.Report.detection_reasons	The detection reasons object.	unknown
WildFire.Report.detection_reasons.description	Reason for the detection verdict.	string
WildFire.Report.detection_reasons.name	Name of the detection.	string
WildFire.Report.detection_reasons.type	Type of the detection.	string
WildFire.Report.detection_reasons.verdict	Verdict of the detection.	string
WildFire.Report.detection_reasons.artifacts	Artifacts for the detection.	string
WildFire.Report.iocs	Associated IOCs.	string

Playbook Image

Detonate_URL_WildFire-v2

Inputs

URL — URL of the webpage or file url to detonate. The URL is taken from the context.
Interval — Duration for executing the pooling (in minutes)
Timeout — The duration after which to stop pooling and to resume the playbook (in minutes)
ReportFileType — The resource type to download. Default is pdf. xml is also possible.

Outputs

DBotScore — The DBotScore object.
DBotScore.Score — The actual score.
File.Size — File size.
File.MD5 — MD5 hash of the file.
File.SHA1 — SHA1 hash of the file.
File.Type — File type e.g. "PE".
File.SHA256 — SHA256 hash of the file.
File.EntryID — The Entry ID of the sample.
File.Malicious.Vendor — For malicious files, the vendor that made the decision.
File.Name — Filename.
File.Malicious.Description — For malicious files, the reason for the vendor to make the decision.
DBotScore.Indicator — The indicator we tested.
DBotScore.Type — The type of the indicator.
DBotScore.Vendor — Vendor used to calculate the score.
IP.Address — IP's relevant to the sample.
File — The File object.
InfoFile — The report file object.
InfoFile.EntryID — The EntryID of the report file.
InfoFile.Extension — The extension of the report file.
InfoFile.Name — The name of the report file.
InfoFile.Info — The info of the report file.
InfoFile.Size — The size of the report file.
InfoFile.Type — The type of the report file.
File.Malicious — The malicious object.
WildFire.Report — The submission object.
WildFire.Report.MD5 — MD5 of the submission.
WildFire.Report.SHA256 — SHA256 of the submission.
WildFire.Report.FileType — The type of the submission.
WildFire.Report.Status — The status of the submission.
WildFire.Report.Size — The size of the submission.

Commands used

wildfire-report wildfire-upload-file-url wildfire-upload-url

Flowchart

Source

playbook-Detonate_URL_-_WildFire-v2.yml playbook-Detonate_URL_-_WildFire-v2.1.yml playbook-Detonate_URL_-_WildFire-v2.1_README.md

Download History Raw

id: Detonate URL - WildFire-v2
version: -1
name: Detonate URL - WildFire-v2
fromversion: 5.0.0
description: |-
  Deprecated. Use Detonate URL - WildFire v2.2 instead.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 971d5a83-6e4e-4e07-88cd-5eb07b1c1a79
    type: start
    task:
      id: 971d5a83-6e4e-4e07-88cd-5eb07b1c1a79
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 06bec756-9cbc-4e58-8b49-cc82a8ffffe5
    type: regular
    task:
      id: 06bec756-9cbc-4e58-8b49-cc82a8ffffe5
      version: -1
      name: WildFire Upload File URL
      description: Uploads the URL of a remote file to WildFire for analysis.
      script: WildFire-v2|||wildfire-upload-file-url
      type: regular
      iscommand: true
      brand: WildFire-v2
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      upload:
        complex:
          root: inputs.URL
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: 93934895-c2b1-4d90-85c8-e63de67192fa
    type: playbook
    task:
      id: 93934895-c2b1-4d90-85c8-e63de67192fa
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      AdditionalPollingCommandArgNames: {}
      AdditionalPollingCommandArgValues: {}
      Ids:
        complex:
          root: WildFire
          accessor: Report.SHA256
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: sha256
      PollingCommandName:
        simple: wildfire-report
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: WildFire.Report(val.Status != 'Success').SHA256
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 5362d80a-dc8b-414e-8fc7-2988e917d2e0
    type: title
    task:
      id: 5362d80a-dc8b-414e-8fc7-2988e917d2e0
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: cd801c53-6ba4-4bea-830a-0788255ebd82
    type: condition
    task:
      id: cd801c53-6ba4-4bea-830a-0788255ebd82
      version: -1
      name: Is there a URL to detonate?
      description: Look for file URLs to detonate
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: b105e8d8-c34c-4bfe-8fc5-0f1a54ceb4cd
    type: condition
    task:
      id: b105e8d8-c34c-4bfe-8fc5-0f1a54ceb4cd
      version: -1
      name: Is WildFire-v2 enabled?
      description: Check if integration instance is enabled
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: WildFire-v2
                transformers:
                - operator: getField
                  args:
                    field:
                      value:
                        simple: state
            iscontext: true
          right:
            value:
              simple: active
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: 72d8fa60-0340-416d-86f7-cb24751b9a42
    type: regular
    task:
      id: 72d8fa60-0340-416d-86f7-cb24751b9a42
      version: -1
      name: WildFire Get Report
      description: Retrieves results for a file hash using WildFire.
      script: WildFire-v2|||wildfire-report
      type: regular
      iscommand: true
      brand: WildFire-v2
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      format:
        complex:
          root: inputs.ReportFileType
      hash:
        complex:
          root: WildFire
          accessor: Report.SHA256
      md5: {}
      sha256: {}
      verbose: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 876f9d98-9d32-42fe-87c0-4adbb1011c6b
    type: regular
    task:
      id: 876f9d98-9d32-42fe-87c0-4adbb1011c6b
      version: -1
      name: WildFire Upload URL
      description: Uploads a URL of a webpage to WildFire for analysis.
      script: WildFire-v2|||wildfire-upload-url
      type: regular
      iscommand: true
      brand: WildFire-v2
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      upload:
        complex:
          root: inputs.URL
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 725,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: 69021f37-e6c9-4ae6-8de2-f230e96c2c2b
    type: condition
    task:
      id: 69021f37-e6c9-4ae6-8de2-f230e96c2c2b
      version: -1
      name: Was file url submission successful?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: WildFire
                accessor: Report.Size
            iscontext: true
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: 743caaf9-1f2d-44aa-88ff-9a0b43e49175
    type: condition
    task:
      id: 743caaf9-1f2d-44aa-88ff-9a0b43e49175
      version: -1
      name: Was upload finished successfully?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: WildFire
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: WildFire.Report.Status
                      iscontext: true
                    right:
                      value:
                        simple: Pending
                accessor: Report.URL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 725,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1610,
        "width": 1055,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: false
  description: URL of the webpage or file url to detonate. The URL is taken from the context.
- key: Interval
  value:
    simple: "1"
  required: false
  description: Duration for executing the pooling (in minutes)
- key: Timeout
  value:
    simple: "15"
  required: false
  description: The duration after which to stop pooling and to resume the playbook (in minutes)
- key: ReportFileType
  value: {}
  required: false
  description: The resource type to download. Default is pdf. xml is also possible.
outputs:
- contextPath: DBotScore
  description: The DBotScore object.
  type: unknown
- contextPath: DBotScore.Score
  description: The actual score.
  type: number
- contextPath: File.Size
  description: File size.
  type: number
- contextPath: File.MD5
  description: MD5 hash of the file.
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file.
  type: string
- contextPath: File.Type
  description: File type e.g. "PE".
  type: string
- contextPath: File.SHA256
  description: SHA256 hash of the file.
  type: string
- contextPath: File.EntryID
  description: The Entry ID of the sample.
  type: string
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision.
  type: string
- contextPath: File.Name
  description: Filename.
  type: string
- contextPath: File.Malicious.Description
  description: For malicious files, the reason for the vendor to make the decision.
  type: string
- contextPath: DBotScore.Indicator
  description: The indicator we tested.
  type: string
- contextPath: DBotScore.Type
  description: The type of the indicator.
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score.
  type: string
- contextPath: IP.Address
  description: IP's relevant to the sample.
  type: string
- contextPath: File
  description: The File object.
  type: unknown
- contextPath: InfoFile
  description: The report file object.
  type: unknown
- contextPath: InfoFile.EntryID
  description: The EntryID of the report file.
  type: string
- contextPath: InfoFile.Extension
  description: The extension of the report file.
  type: string
- contextPath: InfoFile.Name
  description: The name of the report file.
  type: string
- contextPath: InfoFile.Info
  description: The info of the report file.
  type: string
- contextPath: InfoFile.Size
  description: The size of the report file.
  type: number
- contextPath: InfoFile.Type
  description: The type of the report file.
  type: string
- contextPath: File.Malicious
  description: The malicious object.
  type: unknown
- contextPath: WildFire.Report
  description: The submission object.
  type: unknown
- contextPath: WildFire.Report.MD5
  description: MD5 of the submission.
  type: string
- contextPath: WildFire.Report.SHA256
  description: SHA256 of the submission.
  type: string
- contextPath: WildFire.Report.FileType
  description: The type of the submission.
  type: string
- contextPath: WildFire.Report.Status
  description: The status of the submission.
  type: string
- contextPath: WildFire.Report.Size
  description: The size of the submission.
  type: number
tests:
- No tests (deprecated)
deprecated: true
supportedModules:
- agentix
- xsiam

Detonate URL - WildFire-v2 Deprecated