Detonate URL - WildFire-v2 Deprecated

Deprecated. Use Detonate URL - WildFire v2.2 instead.

WildFire by Palo Alto Networks · 10 tasks · 4 inputs · 30 outputs

Details

IDDetonate URL - WildFire-v2
From Version5.0.0
Tasks10

README

Detonates a webpage or a remote file using the WildFire integration. This playbook returns relevant reports to the War Room and file reputations to the context data.

The detonation supports the following file types:
APK, JAR, DOC, DOCX, RTF, OOXLS, XLSX, PPT, PPTX, XML, PE32, PDF, DMG, PKG, RAR, 7Z.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

  • WildFire-v2

Scripts

This playbook does not use any scripts.

Commands

  • wildfire-report
  • wildfire-upload-file-url
  • wildfire-upload-url

Playbook Inputs

Name Description Default Value Source Required
URL The URL of the webpage or the file URL to detonate. The URL is taken from the context. Data URL Optional
Interval The duration for executing the pooling (in minutes). 1 - Optional
Timeout The duration after which to stop pooling and to resume the playbook (in minutes). 15 - Optional
ReportFileType The resource type to download. The default is pdf. XML is also possible. - - Optional

Playbook Outputs

Path Description Type
DBotScore The DBotScore object. unknown
DBotScore.Score The actual score. number
File.Size The file size. number
File.MD5 The MD5 hash of the file. string
File.SHA1 The SHA1 hash of the file. string
File.Type The file type. For example, “PE”. string
File.SHA256 Thas SHA256 hash of the file. string
File.EntryID The entry ID of the sample. string
File.Malicious.Vendor The vendor that made the decision that the file is malicious. string
File.Name The filename string
File.Malicious.Description The reason for the vendor to make the decision that the file is malicious. string
DBotScore.Indicator The indicator that was tested. string
DBotScore.Type The type of the indicator. string
DBotScore.Vendor The vendor used to calculate the score. string
IP.Address The IP addresses’s relevant to the sample. string
File The file object. unknown
InfoFile The report file object. unknown
InfoFile.EntryID The EntryID of the report file. string
InfoFile.Extension The extension of the report file. string
InfoFile.Name The name of the report file. string
InfoFile.Info The info of the report file. string
InfoFile.Size The size of the report file. number
InfoFile.Type The type of the report file. string
File.Malicious The malicious object. unknown
WildFire.Report The submission object. unknown
WildFire.Report.MD5 The MD5 hash of the submission. string
WildFire.Report.SHA256 The SHA256 hash of the submission. string
WildFire.Report.FileType The type of the submission. string
WildFire.Report.Status The status of the submission. string
WildFire.Report.Size The size of the submission. number
WildFire.Report.detection_reasons The detection reasons object. unknown
WildFire.Report.detection_reasons.description Reason for the detection verdict. string
WildFire.Report.detection_reasons.name Name of the detection. string
WildFire.Report.detection_reasons.type Type of the detection. string
WildFire.Report.detection_reasons.verdict Verdict of the detection. string
WildFire.Report.detection_reasons.artifacts Artifacts for the detection. string
WildFire.Report.iocs Associated IOCs. string

Playbook Image

Detonate_URL_WildFire-v2

Inputs

  • URL — URL of the webpage or file url to detonate. The URL is taken from the context.
  • Interval — Duration for executing the pooling (in minutes)
  • Timeout — The duration after which to stop pooling and to resume the playbook (in minutes)
  • ReportFileType — The resource type to download. Default is pdf. xml is also possible.

Outputs

  • DBotScore — The DBotScore object.
  • DBotScore.Score — The actual score.
  • File.Size — File size.
  • File.MD5 — MD5 hash of the file.
  • File.SHA1 — SHA1 hash of the file.
  • File.Type — File type e.g. "PE".
  • File.SHA256 — SHA256 hash of the file.
  • File.EntryID — The Entry ID of the sample.
  • File.Malicious.Vendor — For malicious files, the vendor that made the decision.
  • File.Name — Filename.
  • File.Malicious.Description — For malicious files, the reason for the vendor to make the decision.
  • DBotScore.Indicator — The indicator we tested.
  • DBotScore.Type — The type of the indicator.
  • DBotScore.Vendor — Vendor used to calculate the score.
  • IP.Address — IP's relevant to the sample.
  • File — The File object.
  • InfoFile — The report file object.
  • InfoFile.EntryID — The EntryID of the report file.
  • InfoFile.Extension — The extension of the report file.
  • InfoFile.Name — The name of the report file.
  • InfoFile.Info — The info of the report file.
  • InfoFile.Size — The size of the report file.
  • InfoFile.Type — The type of the report file.
  • File.Malicious — The malicious object.
  • WildFire.Report — The submission object.
  • WildFire.Report.MD5 — MD5 of the submission.
  • WildFire.Report.SHA256 — SHA256 of the submission.
  • WildFire.Report.FileType — The type of the submission.
  • WildFire.Report.Status — The status of the submission.
  • WildFire.Report.Size — The size of the submission.

Commands used

wildfire-report wildfire-upload-file-url wildfire-upload-url

Flowchart

yes yes yes yes Start Start WildFire Upload File URL - wildfire-upload-file-url WildFire Upload File URL wildfire-upload-file-url GenericPolling - GenericPolling GenericPolling GenericPolling Done Done Is there a URL to detonate? Is there a URL to detonate? Is WildFire-v2 enabled? Is WildFire-v2 enabled? WildFire Get Report - wildfire-report WildFire Get Report wildfire-report WildFire Upload URL - wildfire-upload-url WildFire Upload URL wildfire-upload-url Was file url submission successful? Was file url submission s... Was upload finished successfully? Was upload finished succe...

Source

playbook-Detonate_URL_-_WildFire-v2.yml playbook-Detonate_URL_-_WildFire-v2.1.yml playbook-Detonate_URL_-_WildFire-v2.1_README.md
Download History Raw 
Detonate a webpage or remote file using the WildFire integration. This playbook returns relevant reports to the War Room and file reputations to the context data.
The detonation supports the following file types:
APK, JAR, DOC, DOCX, RTF, OOXLS, XLSX, PPT, PPTX, XML, PE32, PDF, DMG, PKG, RAR, 7Z, JS.

This playbook is deprecated. please use the Detonate URL - WildFire v2.2 instead.

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

GenericPolling

### Integrations

Palo_Alto_Networks_WildFire_v2

### Scripts

This playbook does not use any scripts.

### Commands

* wildfire-upload-file-url
* wildfire-report
* wildfire-upload-url

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| URL | URL of the webpage or file URL to detonate. The URL is taken from the context. | URL.Data | Optional |
| Interval | Duration for executing the polling \(in minutes\). | 1 | Optional |
| Timeout | The duration after which to stop polling and to resume the playbook \(in minutes\). | 60 | Optional |
| ReportFileType | The resource type to download. Default is PDF. XML is also possible. |  | Optional |

## Playbook Outputs

---

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| DBotScore | The DBotScore object. | unknown |
| DBotScore.Score | The actual score. | number |
| File.Size | File size. | number |
| File.MD5 | MD5 hash. | string |
| File.SHA1 | SHA1 hash. | string |
| File.Type | File type, e.g., "PE". | string |
| File.SHA256 | SHA256 hash. | string |
| File.EntryID | The entry ID of the sample. | string |
| File.Malicious.Vendor | For malicious files, the vendor that determined that the file is malicious. | string |
| File.Name | File.name. | string |
| File.Malicious.Description | For malicious files, the reason the vendor determined that the file is malicious. | string |
| DBotScore.Indicator | The indicator we tested. | string |
| DBotScore.Type | The type of indicator. | string |
| DBotScore.Vendor | Vendor used to calculate the score. | string |
| IP.Address | IPs relevant to the sample. | string |
| File | The file object. | unknown |
| InfoFile | The report file object. | unknown |
| InfoFile.EntryID | The EntryID of the report file. | string |
| InfoFile.Extension | The extension of the report file. | string |
| InfoFile.Name | The name of the report file. | string |
| InfoFile.Info | The info of the report file. | string |
| InfoFile.Size | The size of the report file. | number |
| InfoFile.Type | The type of the report file. | string |
| File.Malicious | The malicious object. | unknown |
| WildFire.Report | The submission object. | unknown |
| WildFire.Report.MD5 | MD5 of the submission. | string |
| WildFire.Report.SHA256 | SHA256 of the submission. | string |
| WildFire.Report.FileType | The type of the submission. | string |
| WildFire.Report.Status | The status of the submission. | string |
| WildFire.Report.Size | The size of the submission. | number |
| WildFire.Report.URL | URL of the submission. | string |
| WildFire.Report.detection_reasons | The detection reasons object. | unknown |
| WildFire.Report.detection_reasons.description | Reason for the detection verdict. | string |
| WildFire.Report.detection_reasons.name | Name of the detection. | string |
| WildFire.Report.detection_reasons.type | Type of the detection. | string |
| WildFire.Report.detection_reasons.verdict | Verdict of the detection. | string |
| WildFire.Report.detection_reasons.artifacts | Artifacts for the detection reasons. | string |
| WildFire.Report.iocs | Associated IOCs. | string |

## Playbook Image
---
![Detonate_URL_WildFire-v2](https://raw.githubusercontent.com/demisto/content/1bdd5229392bd86f0cc58265a24df23ee3f7e662/docs/images/playbooks/Detonate_URL_WildFire-v2.png)