Detonate file - CrowdStrike Falcon Sandbox v2

Detonates a File using CrowdStrike Falcon sandbox.

CrowdStrike Falcon Sandbox · 8 tasks · 2 inputs · 14 outputs

Details

IDDetonate file - CrowdStrike Falcon Sandbox v2
From Version6.9.0
Tasks8

README

Detonates a File using CrowdStrike Falcon sandbox.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • CrowdStrikeFalconSandboxV2

Scripts

  • Set

Commands

  • cs-falcon-sandbox-scan
  • cs-falcon-sandbox-submit-sample

Playbook Inputs

Name Description Default Value Required
File The file object of the file to detonate. File Optional
EnvironmentID The environment ID where the file should be submitted. To retrieve all available IDs, please execute the crowdstrike-get-environments command. 100 Optional

Playbook Outputs

Path Description Type
File.SHA256 The SHA256 hash of the file. string
File.Malicious The file malicious description. unknown
File.Type The file type, for example “PE”. string
File.Size The file size. number
File.MD5 The MD5 hash of the file. string
File.Name The file name. string
File.SHA1 The SHA1 hash of the file. string
File The file object. unknown
File.Malicious.Vendor The vendor that decided the file was malicious. string
DBotScore The DBotScore object. unknown
DBotScore.Indicator The tested indicator. string
DBotScore.Type The indicator type. string
DBotScore.Vendor The vendor used to calculate the score. string
DBotScore.Score The actual score. number

Playbook Image

Detonate file - CrowdStrike Falcon Sandbox v2

Inputs

  • File — The file object of the file to detonate.
  • EnvironmentID — The environment ID where the file should be submitted. To retrieve all available IDs, please execute the crowdstrike-get-environments command.

Outputs

  • File.SHA256 — The SHA256 hash of the file.
  • File.Malicious — The file malicious description.
  • File.Type — The file type, for example "PE".
  • File.Size — The file size.
  • File.MD5 — The MD5 hash of the file.
  • File.Name — The file name.
  • File.SHA1 — The SHA1 hash of the file.
  • File — The file object.
  • File.Malicious.Vendor — The vendor that decided the file was malicious.
  • DBotScore — The DBotScore object.
  • DBotScore.Indicator — The tested indicator.
  • DBotScore.Type — The indicator type.
  • DBotScore.Vendor — The vendor used to calculate the score.
  • DBotScore.Score — The actual score.

Commands used

cs-falcon-sandbox-scan cs-falcon-sandbox-submit-sample

Flowchart

yes yes yes Start Start Is CrowdStrike Falcon Sandbox V2 enabled? Is CrowdStrike Falcon San... Done Done Initiate sandbox scan - cs-falcon-sandbox-scan Initiate sandbox scan cs-falcon-sandbox-scan Set file to context - Set Set file to context Set Upload the sample to Falcon - cs-falcon-sandbox-submit-sample Upload the sample to Falcon cs-falcon-sandbox-submit-sample Is there a file to detonate? Is there a file to detonate? Is the file type supported? Is the file type supported?

Source

playbook-Detonate_file_-_CrowdStrike_Falcon_Sandbox_v2.yml
Download History Raw 
id: Detonate file - CrowdStrike Falcon Sandbox v2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Detonate file - CrowdStrike Falcon Sandbox v2
description: Detonates a File using CrowdStrike Falcon sandbox.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 29dcbc1e-0bb0-45f1-82ed-eb65b6ce039d
    type: start
    task:
      id: 29dcbc1e-0bb0-45f1-82ed-eb65b6ce039d
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 553ea426-6542-4c8f-8799-341b1784d528
    type: condition
    task:
      id: 553ea426-6542-4c8f-8799-341b1784d528
      version: -1
      name: Is CrowdStrike Falcon Sandbox V2 enabled?
      description: |
        Verify that there is a valid instance of CrowdStrike enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: CrowdStrike Falcon Sandbox V2
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: e6a670a6-eff4-4b16-883b-f08e7d7e7bd3
    type: title
    task:
      id: e6a670a6-eff4-4b16-883b-f08e7d7e7bd3
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 97fec2dc-7fc7-49c6-80e4-e8a96e9adc4a
    type: regular
    task:
      id: 97fec2dc-7fc7-49c6-80e4-e8a96e9adc4a
      version: -1
      name: Initiate sandbox scan
      description: Retrieve summary information for an MD5, SHA1, or SHA256 and view all reports generated for any environment ID.
      script: '|||cs-falcon-sandbox-scan'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      JobID:
        complex:
          root: CrowdStrike.Submit
          accessor: job_id
      file:
        complex:
          root: File.SHA256
      polling:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": 1065
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 8377ba6f-c57d-4cd1-8a1f-5989f89978ac
    type: regular
    task:
      id: 8377ba6f-c57d-4cd1-8a1f-5989f89978ac
      version: -1
      name: Set file to context
      description: Sets the file object into context.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      key:
        simple: File
      value:
        complex:
          root: inputs.File
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 290,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 772fa274-bfa4-4feb-8d0f-41591b65fb01
    type: regular
    task:
      id: 772fa274-bfa4-4feb-8d0f-41591b65fb01
      version: -1
      name: Upload the sample to Falcon
      description: Submits a file from the investigation to the analysis server.
      script: '|||cs-falcon-sandbox-submit-sample'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      entryId:
        complex:
          root: File.EntryID
      environmentID:
        complex:
          root: inputs.EnvironmentID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: a15cdef0-f6bd-48e3-8198-3f7c20e668fe
    type: condition
    task:
      id: a15cdef0-f6bd-48e3-8198-3f7c20e668fe
      version: -1
      name: Is there a file to detonate?
      description: Asserts there's a file to detonate.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.File
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 290,
          "y": 380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: a0565f2c-c720-4196-84d2-21e057c23637
    type: condition
    task:
      id: a0565f2c-c720-4196-84d2-21e057c23637
      version: -1
      name: Is the file type supported?
      description: Asserts the file type is supported.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                filters:
                - - operator: match
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:PE32|EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b
                    ignorecase: true
                  - operator: match
                    left:
                      value:
                        simple: File.Info
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:PE32|EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b
                    ignorecase: true
                  - operator: match
                    left:
                      value:
                        simple: File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:PE32|EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b
                    ignorecase: true
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 290,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "14_6_#default#": 0.13,
      "15_6_#default#": 0.25,
      "5_6_#default#": 0.12
    },
    "paper": {
      "dimensions": {
        "height": 1245,
        "width": 820,
        "x": 50,
        "y": 60
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: The file object of the file to detonate.
  playbookInputQuery:
- key: EnvironmentID
  value:
    simple: "100"
  required: false
  description: The environment ID where the file should be submitted. To retrieve all available IDs, please execute the crowdstrike-get-environments command.
  playbookInputQuery:
outputs:
- contextPath: File.SHA256
  description: The SHA256 hash of the file.
  type: string
- contextPath: File.Malicious
  description: The file malicious description.
  type: unknown
- contextPath: File.Type
  description: The file type, for example "PE".
  type: string
- contextPath: File.Size
  description: The file size.
  type: number
- contextPath: File.MD5
  description: The MD5 hash of the file.
  type: string
- contextPath: File.Name
  description: The file name.
  type: string
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
  type: string
- contextPath: File
  description: The file object.
  type: unknown
- contextPath: File.Malicious.Vendor
  description: The vendor that decided the file was malicious.
  type: string
- contextPath: DBotScore
  description: The DBotScore object.
  type: unknown
- contextPath: DBotScore.Indicator
  description: The tested indicator.
  type: string
- contextPath: DBotScore.Type
  description: The indicator type.
  type: string
- contextPath: DBotScore.Vendor
  description: The vendor used to calculate the score.
  type: string
- contextPath: DBotScore.Score
  description: The actual score.
  type: number
tests:
- No tests (auto formatted)
fromversion: 6.9.0