Extract Indicators From File - Generic v2

id: Extract Indicators From File - Generic v2
version: -1
name: Extract Indicators From File - Generic v2
description: |-
  This playbook extracts indicators from a file.
  Supported file types:
  - CSV
  - PDF
  - TXT
  - HTM, HTML
  - DOC, DOCX
  - PPT
  - PPTX
  - RTF
  - XLS
  - XLSX
  - XML
  - XLSM
  - DOCM
  - PPTM
  - DOTM
  - XLSB
  - DOT
  - PPSM
  - PNG
  - JPG/JPEG
  - GIF (when Image OCR is enabled).
  In addition, the playbook supports QR codes.
  The playbook does not support encrypted / password-protected files such as XLSB. Such files will be skipped.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 19112ab0-6176-49fc-83c5-b0d3b14eafe7
    type: start
    task:
      id: 19112ab0-6176-49fc-83c5-b0d3b14eafe7
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 915,
          "y": -10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 27e3a138-4521-475e-ab6e-d2fa5278a561
    type: condition
    task:
      id: 27e3a138-4521-475e-ab6e-d2fa5278a561
      version: -1
      name: Is there a file?
      description: |
        Checks if there is a file in the playbook input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.File
                accessor: EntryID
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 915,
          "y": 120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 463760b9-550a-4dea-8a06-42354107dc49
    type: title
    task:
      id: 463760b9-550a-4dea-8a06-42354107dc49
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 915,
          "y": 1826
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 832f6312-844f-43ce-8c6b-ce6e3feb0ada
    type: title
    task:
      id: 832f6312-844f-43ce-8c6b-ce6e3feb0ada
      version: -1
      name: Extract Indicators From Files
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
      - "7"
      - "9"
      - "15"
      - "20"
      - "21"
      - "23"
      - "26"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 915,
          "y": 295
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 615974ba-0088-4aed-92bf-80613b251d49
    type: condition
    task:
      id: 615974ba-0088-4aed-92bf-80613b251d49
      version: -1
      name: Is there a text-based file?
      description: Checks if there is a text-based file in context. Skips MSG and EML files.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.File
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: ASCII text
                    ignorecase: true
                  - operator: containsString
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: Rich Text Format
                  - operator: containsString
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: UTF-8 Unicode text
                  - operator: containsString
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: JSON data
                    ignorecase: true
                  - operator: containsString
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: CSV text
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: csv
                    ignorecase: true
                - - operator: notContainsString
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: news or mail
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: eml
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: msg
                - - operator: notContainsString
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: Composite Document File V2 Document, No summary info
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: text/rtf
                    ignorecase: true
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: rtf
                    ignorecase: true
                - - operator: notContainsGeneral
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: xml
                    ignorecase: true
                - - operator: notContainsGeneral
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: text/rtf
                    ignorecase: true
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: message/rfc822
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: p7m
                accessor: EntryID
                transformers:
                - operator: uniq
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 112.5,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: f2241e90-214f-4661-a5ea-0cc6769773bc
    type: regular
    task:
      id: f2241e90-214f-4661-a5ea-0cc6769773bc
      version: -1
      name: Extract indicators from text-based file
      description: Extracts indicators from text-based files.
      scriptName: ExtractIndicatorsFromTextFile
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      entryID:
        complex:
          root: inputs.File
          filters:
          - - operator: containsString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: ASCII text
              ignorecase: true
            - operator: containsString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: Rich Text Format
            - operator: containsString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: UTF-8 Unicode
            - operator: containsString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: JSON data
              ignorecase: true
            - operator: containsString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: CSV text
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: csv
              ignorecase: true
          - - operator: notContainsString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: news
            - operator: notContainsString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: mail
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: eml
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: msg
          - - operator: notContainsString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: Composite Document File V2 Document, No summary info
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: text/rtf
              ignorecase: true
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: rtf
              ignorecase: true
          - - operator: notContainsGeneral
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: xml
              ignorecase: true
          - - operator: notContainsGeneral
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: text/rtf
              ignorecase: true
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: message/rfc822
          accessor: EntryID
          transformers:
          - operator: uniq
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 112.5,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: fe9aa9e7-8981-4594-b9a4-b7a4225a12fa
    type: condition
    task:
      id: fe9aa9e7-8981-4594-b9a4-b7a4225a12fa
      version: -1
      name: Is there a PDF file?
      description: Checks if there is a PDF file in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "29"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.File
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: pdf
                    ignorecase: true
                - - operator: containsString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: pdf
                    ignorecase: true
                accessor: EntryID
                transformers:
                - operator: uniq
            iscontext: true
          right:
            value: {}
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1320,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: b61b2d2d-526f-4d64-8bcc-46a45a3da866
    type: condition
    task:
      id: b61b2d2d-526f-4d64-8bcc-46a45a3da866
      version: -1
      name: Is there a Word file?
      description: Checks if there is a Word file (DOC, DOCX) in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.File
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: Composite Document File V2 Document
                  - operator: containsString
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: Microsoft Word
                  - operator: isEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: docx
                    ignorecase: true
                  - operator: containsString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: CDFV2
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: msg
                    ignorecase: true
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: eml
                    ignorecase: true
                - - operator: isNotExists
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                  - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: xls
                    ignorecase: true
                - - operator: isNotExists
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                  - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: xlsx
                    ignorecase: true
                - - operator: isNotExists
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                  - operator: notContainsString
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: Excel
                    ignorecase: true
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: ppt
                    ignorecase: true
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: pptx
                    ignorecase: true
                - - operator: isNotExists
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                  - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: xlsb
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: xlsb
                - - operator: isNotExists
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                  - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: xlsm
                - - operator: isNotExists
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                  - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: docm
                - - operator: isNotExists
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                  - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: oft
                    ignorecase: true
                  - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: oft
                    ignorecase: true
                - - operator: notContainsString
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: Encrypted
                accessor: EntryID
                transformers:
                - operator: uniq
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 510,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 3e880c19-d946-4cca-8dd4-fabe023b5f27
    type: title
    task:
      id: 3e880c19-d946-4cca-8dd4-fabe023b5f27
      version: -1
      name: No File To Parse
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -975,
          "y": 735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: cce17910-c4c9-4c71-862c-9a55cbeca170
    type: regular
    task:
      id: cce17910-c4c9-4c71-862c-9a55cbeca170
      version: -1
      name: Extract indicators from Word file
      description: Extracts indicators from word files (DOC, DOCX).
      scriptName: ExtractIndicatorsFromWordFile
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      entryID:
        complex:
          root: inputs.File
          filters:
          - - operator: containsString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: Composite Document File V2 Document
            - operator: containsString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: Microsoft Word
            - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: docx
              ignorecase: true
            - operator: containsString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: CDFV2
              ignorecase: true
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: msg
              ignorecase: true
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: eml
              ignorecase: true
          - - operator: isNotExists
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
            - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: xls
              ignorecase: true
          - - operator: isNotExists
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
            - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: xlsx
              ignorecase: true
          - - operator: isNotExists
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
            - operator: notContainsString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: Excel
              ignorecase: true
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: ppt
              ignorecase: true
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: pptx
          - - operator: isNotExists
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
            - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: xlsm
          - - operator: isNotExists
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
            - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: oft
              ignorecase: true
            - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: oft
              ignorecase: true
          - - operator: notContainsString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: Encrypted
          - - operator: isNotExists
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
            - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: xlsb
          - - operator: isNotExists
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
            - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: docm
          accessor: EntryID
          transformers:
          - operator: uniq
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 510,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 13a4204e-43c3-4c7d-8331-5048057a0ab2
    type: condition
    task:
      id: 13a4204e-43c3-4c7d-8331-5048057a0ab2
      version: -1
      name: Is Image OCR enabled?
      description: Checks whether there is an active instance of the Image OCR integration. enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "19"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: brand
                      iscontext: true
                    right:
                      value:
                        simple: Image OCR
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2809,
          "y": 718
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 5fe1445f-0d84-48e8-84b5-265e777b594f
    type: regular
    task:
      id: 5fe1445f-0d84-48e8-84b5-265e777b594f
      version: -1
      name: Extract text from images
      description: Extracts text from PNG, JPEG, and GIF image files, and uses auto-extract to get reputation for indicators.
      script: '|||image-ocr-extract-text'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      entryid:
        complex:
          root: inputs.File
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: image/png
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: image/jpg
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: image/jpeg
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: image/gif
              ignorecase: true
          accessor: EntryID
          transformers:
          - operator: uniq
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2778,
          "y": 1099
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: a7ba5b59-d995-4fcd-8454-668c7047028c
    type: condition
    task:
      id: a7ba5b59-d995-4fcd-8454-668c7047028c
      version: -1
      name: Is there another supported document type?
      description: |-
        Checks if one of the following file types exists:
        - PPT
        - PPTX
        - RTF
        - XLS
        - XLSX
        - XML
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "16"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.File
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: ppt
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: pptx
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: rtf
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: xls
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: xlsx
                    ignorecase: true
                  - operator: containsGeneral
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: xml
                    ignorecase: true
                  - operator: containsGeneral
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: vnd.ms-powerpoint
                    ignorecase: true
                  - operator: containsGeneral
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: vnd.ms-excel
                    ignorecase: true
                  - operator: containsGeneral
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: text/rtf
                    ignorecase: true
                - - operator: isNotExists
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                  - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: xlsb
                    ignorecase: true
                - - operator: notContainsGeneral
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: CDFV2 Encrypted
                    ignorecase: true
                - - operator: isNotExists
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                  - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: docx
                - - operator: isNotExists
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                  - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: doc
                accessor: EntryID
                transformers:
                - operator: uniq
            iscontext: true
          ignorecase: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1740,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 80811529-61cb-4b0c-8000-e31cd312fdda
    type: regular
    task:
      id: 80811529-61cb-4b0c-8000-e31cd312fdda
      version: -1
      name: Convert a document to PDF
      description: |-
        Converts the following formats to PDF format:
        - PPT
        - PPTX
        - RTF
        - XLS
        - XLSX
        - XML
      scriptName: ConvertFile
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      all_files:
        simple: "yes"
      entry_id:
        complex:
          root: inputs.File
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: ppt
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: pptx
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: rtf
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: xls
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: xlsx
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: xml
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: vnd.ms-powerpoint
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: vnd.ms-excel
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: text/rtf
              ignorecase: true
          - - operator: isNotExists
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
            - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: xlsb
              ignorecase: true
          - - operator: isNotExists
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
            - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: docx
          - - operator: isNotExists
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
            - operator: isNotEqualString
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: doc
          - - operator: notContainsGeneral
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: CDFV2 Encrypted
              ignorecase: true
          accessor: EntryID
          transformers:
          - operator: uniq
      ignore-outputs:
        simple: "false"
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1740,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 7f90c4cc-3035-4244-8785-360f594ddc62
    type: regular
    task:
      id: 7f90c4cc-3035-4244-8785-360f594ddc62
      version: -1
      name: Set ExtractedURLsFromFiles
      description: |-
        Extracts URLs from files and stores them under the "ExtractedURLsFromFiles" key in the playbook output.
        Parent playbooks can use this key to indicate which URLs were extracted.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: ExtractedURLsFromFiles
      value:
        complex:
          root: URL
          accessor: Data
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 915,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 7ce286a8-d86f-42f4-8e36-426f4753740c
    type: playbook
    task:
      id: 7ce286a8-d86f-42f4-8e36-426f4753740c
      version: -1
      name: Microsoft Office File Enrichment - Oletools
      description: |-
        Oletools is a tool for analyzing Microsoft OLE2 files, such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics, and debugging.
        This playbook will run run the "oleid" command on the files which are passed to to it as playbook inputs. In case any macros or external relationships were found, it will also run "olevba" and "oleobj" commands as well on the relevant files.
        oleid - Analyze OLE files to detect specific characteristics usually found in malicious files.
        oleobj - Extract embedded objects from OLE files.
        olevba - Extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML).
      playbookName: Microsoft Office File Enrichment - Oletools
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      Decode:
        complex:
          root: inputs.Decode
      FileObject:
        complex:
          root: inputs.File
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.File.EntryID
                iscontext: true
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -730,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 6515f21b-9e06-4b53-8b76-4ade7d43e829
    type: condition
    task:
      id: 6515f21b-9e06-4b53-8b76-4ade7d43e829
      version: -1
      name: Is there an image file?
      description: |-
        Checks if the uploaded file is a valid image file.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "13"
      - "28"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.File
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: image/png
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: image/jpg
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: image/jpeg
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: inputs.File.Info
                      iscontext: true
                    right:
                      value:
                        simple: image/gif
                    ignorecase: true
                transformers:
                - operator: uniq
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2397,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 23e84751-1ddc-46b8-85dd-043b3252e940
    type: regular
    task:
      id: 23e84751-1ddc-46b8-85dd-043b3252e940
      version: -1
      name: Extract indicators from docx file
      description: Extracts indicators from word files (DOC, DOCX).
      scriptName: ExtractIndicatorsFromWordFile
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      entryID:
        complex:
          root: inputs.File
          filters:
          - - operator: containsString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: Zip archive data
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: Microsoft Excel 2007+
              ignorecase: true
          - - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: docx
              ignorecase: true
          accessor: EntryID
          transformers:
          - operator: uniq
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 915,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 07993c36-28e2-46b3-8816-e580ba1ae505
    type: condition
    task:
      id: 07993c36-28e2-46b3-8816-e580ba1ae505
      version: -1
      name: Is there a Word docx file?
      description: Checks if there is a Word file (DOC, DOCX) in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "22"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.File
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: Zip archive data
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: Microsoft Excel 2007+
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: docx
                    ignorecase: true
                accessor: EntryID
                transformers:
                - operator: uniq
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 915,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: e80f3f02-7c8b-4cde-8456-79145e049569
    type: regular
    task:
      id: e80f3f02-7c8b-4cde-8456-79145e049569
      version: -1
      name: Extract Text from QR Code
      description: Extracts the text from a QR code. The output of this script includes the output of the script "extractIndicators" run on the text extracted from the QR code.
      scriptName: ReadQRCode
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      entry_id:
        complex:
          root: inputs.File
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: image/png
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: image/jpeg
            - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: image/jpg
          accessor: EntryID
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: InfoFile.EntryID
                iscontext: true
          - operator: uniq
          - operator: RemoveEmpty
            args:
              empty_values: {}
              remove_keys:
                value:
                  simple: "true"
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1606,
          "y": 1540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 1c5f93e5-dd4c-46bf-8f76-ae594a83a90d
    type: regular
    task:
      id: 1c5f93e5-dd4c-46bf-8f76-ae594a83a90d
      version: -1
      name: Convert PDF to Image
      description: Converts a PDF file to an image file.
      script: '|||rasterize-pdf'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      EntryID:
        complex:
          root: ValidPDFEntryIDs
          transformers:
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: AdditionalPDFs
                iscontext: true
              raw: {}
          - operator: uniq
          - operator: RemoveEmpty
            args:
              empty_values: {}
              remove_keys:
                value:
                  simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1606,
          "y": 1404
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 53db3653-4ebd-46c3-84e2-2a029bb9561c
    type: condition
    task:
      id: 53db3653-4ebd-46c3-84e2-2a029bb9561c
      version: -1
      name: Is there a PPTX/XSLX file?
      description: Checks if there is a PowerPoint or Excel file (PPTX/XSLX) in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "27"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.File
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: xlsx
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: inputs.File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: pptx
                    ignorecase: true
                - - operator: containsGeneral
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: Zip archive data
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: Microsoft PowerPoint 2007+
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: inputs.File.Type
                      iscontext: true
                    right:
                      value:
                        simple: Microsoft Excel 2007+
                    ignorecase: true
                accessor: EntryID
                transformers:
                - operator: uniq
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -300,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 629dd9a1-1eb5-42f1-8846-faf65be915f9
    type: regular
    task:
      id: 629dd9a1-1eb5-42f1-8846-faf65be915f9
      version: -1
      name: Extract Hyper-Links from Office Files
      description: 'Extracts hyperlinks from Office files. Supported file types are: xlsx, docx, pptx.'
      scriptName: ExtractHyperlinksFromOfficeFiles
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      entry_id:
        complex:
          root: inputs.File
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: xlsx
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: pptx
              ignorecase: true
          - - operator: containsGeneral
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: Zip archive data
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: Microsoft PowerPoint 2007+
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: Microsoft Excel 2007+
              ignorecase: true
          accessor: EntryID
          transformers:
          - operator: uniq
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -300,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 8cae1b0c-df86-4070-83bc-2108b2fb3281
    type: condition
    task:
      id: 8cae1b0c-df86-4070-83bc-2108b2fb3281
      version: -1
      name: Does ReadQRCode support the image?
      description: Check if the image type is supported by the ReadQRCode script.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "19"
      "yes":
      - "24"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.File.Info
            iscontext: true
          right:
            value:
              simple: image/png
        - operator: isEqualString
          left:
            value:
              simple: inputs.File.Info
            iscontext: true
          right:
            value:
              simple: image/jpeg
        - operator: isEqualString
          left:
            value:
              simple: inputs.File.Info
            iscontext: true
          right:
            value:
              simple: image/jpg
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2398,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: f3ab8c1c-f06f-4e23-8fb8-92d02cbee65a
    type: regular
    task:
      id: f3ab8c1c-f06f-4e23-8fb8-92d02cbee65a
      version: -1
      name: Check validity of PDF files
      description: Returns wether a PDF is both valid and encrypted.
      scriptName: CheckPDFEncryptionAndValidity
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      EntryID:
        complex:
          root: inputs.File
          filters:
          - - operator: containsString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: pdf
              ignorecase: true
          - - operator: containsString
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: pdf
              ignorecase: true
          accessor: EntryID
          transformers:
          - operator: uniq
      extend-context:
        simple: CheckedPDFs=
      ignore-outputs:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1320,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 544e230f-6df0-46c2-8d9d-e4535594f5b4
    type: condition
    task:
      id: 544e230f-6df0-46c2-8d9d-e4535594f5b4
      version: -1
      name: Any readable PDF files?
      description: Checks if there are valid, non-encrypted PDFs.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "19"
      "yes":
      - "33"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: CheckedPDFs
                filters:
                - - operator: isTrue
                    left:
                      value:
                        simple: CheckedPDFs.IsValid
                      iscontext: true
                - - operator: isFalse
                    left:
                      value:
                        simple: CheckedPDFs.IsEncrypted
                      iscontext: true
                    ignorecase: true
                accessor: EntryID
                transformers:
                - operator: uniq
            iscontext: true
          right:
            value: {}
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1320,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 5ff6052a-4a53-49d0-8471-508a5e27af03
    type: regular
    task:
      id: 5ff6052a-4a53-49d0-8471-508a5e27af03
      version: -1
      name: Extract indicators from PDF files
      description: Load a PDF file's content and metadata into context.
      scriptName: ReadPDFFileV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      entryID:
        complex:
          root: ValidPDFEntryIDs
          transformers:
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: AdditionalPDFs
                iscontext: true
              raw: {}
          - operator: uniq
      maxImages:
        complex:
          root: inputs.MaxImagesFromPDF
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1606,
          "y": 1275
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 5b9ddd9d-143f-47fc-8cf8-0249889f1532
    type: regular
    task:
      id: 5b9ddd9d-143f-47fc-8cf8-0249889f1532
      version: -1
      name: Save converted PDFs separately
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      key:
        simple: AdditionalPDFs
      value:
        complex:
          root: File
          filters:
          - - operator: in
              left:
                value:
                  simple: File.SHA256
                iscontext: true
              right:
                value:
                  simple: ConvertedFile.FileSHA256
                iscontext: true
          accessor: EntryID
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1740,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 82c30ea3-4fbc-42dc-852b-0bda54ef1315
    type: regular
    task:
      id: 82c30ea3-4fbc-42dc-852b-0bda54ef1315
      version: -1
      name: Save valid PDFs separately
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      key:
        simple: ValidPDFEntryIDs
      value:
        complex:
          root: CheckedPDFs
          filters:
          - - operator: isTrue
              left:
                value:
                  simple: CheckedPDFs.IsValid
                iscontext: true
          - - operator: isFalse
              left:
                value:
                  simple: CheckedPDFs.IsEncrypted
                iscontext: true
          accessor: EntryID
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1320,
          "y": 1013
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 54c92f03-3cc6-4742-b121-8694a35255b2
    type: condition
    task:
      id: 54c92f03-3cc6-4742-b121-8694a35255b2
      version: -1
      name: Assert there are pdf files to extract from
      description: Checks whether there are any PDF files to process
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "19"
      "yes":
      - "31"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: ValidPDFEntryIDs
                transformers:
                - operator: AppendIfNotEmpty
                  args:
                    item:
                      value:
                        simple: AdditionalPDFs
                      iscontext: true
                    raw: {}
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1606,
          "y": 1149
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "13_19_#default#": 0.11,
      "15_10_#default#": 0.11,
      "15_16_yes": 0.38,
      "1_10_#default#": 0.17,
      "21_10_#default#": 0.1,
      "23_10_#default#": 0.14,
      "23_22_yes": 0.43,
      "28_24_yes": 0.88,
      "34_19_#default#": 0.42,
      "5_10_#default#": 0.33,
      "5_6_yes": 0.36,
      "7_10_#default#": 0.1,
      "9_10_#default#": 0.18,
      "9_11_yes": 0.35
    },
    "paper": {
      "dimensions": {
        "height": 1896,
        "width": 4165,
        "x": -975,
        "y": -10
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: The file to extract indicators from.
  playbookInputQuery:
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: ""
    queryEntity: indicators
    results:
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue:
        fromvalue:
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: true
- key: Decode
  value:
    simple: "False"
  required: false
  description: |-
    Available values: "True" or "False". Default is "False"
    When this is set to "True", in case a macro was found within the file (using oletools), it will output all the obfuscated strings with their decoded content (Hex, Base64, StrReverse, Dridex, VBA).
  playbookInputQuery:
- key: MaxImagesFromPDF
  value:
    simple: "10"
  required: false
  description: |-
    The maximum number of images that can be extracted from a PDF file.
    We recommend setting a low number if you don't need all images extracted from PDF files.
    If no value is specified, a default of 20 will be used.
  playbookInputQuery:
outputs:
- contextPath: Domain.Name
  description: The extracted domains.
  type: string
- contextPath: Account.Email.Address
  description: The extracted email addresses.
  type: string
- contextPath: File.MD5
  description: The extracted MD5 hash.
  type: string
- contextPath: File.SHA1
  description: The extracted SHA1 hash.
  type: string
- contextPath: File.SHA256
  description: The extracted SHA256 hash.
  type: string
- contextPath: IP.Address
  description: The extracted IP addresses.
  type: string
- contextPath: File.Text
  description: The text or images extracted from the PDF file.
  type: string
- contextPath: File.Producer
  description: The PDF file producer.
  type: string
- contextPath: File.Title
  description: The title of the PDF file.
  type: string
- contextPath: File.xap
  description: The XAP of the PDF file.
  type: string
- contextPath: File.Author
  description: The author of the file.
  type: string
- contextPath: File.dc
  description: The DC of the file.
  type: string
- contextPath: File.xapmm
  description: The XAPMM of the file.
  type: string
- contextPath: File.ModDate
  description: The mod date of the file.
  type: string
- contextPath: File.CreationDate
  description: The creation date of the file.
  type: string
- contextPath: File.Pages
  description: The number of pages in the file.
  type: string
- contextPath: URL.Data
  description: The list of URLs that were extracted from the file.
  type: string
- contextPath: ExtractedURLsFromFiles
  description: The list of URLs that were extracted from the file. This output is a duplicate of the URL.Data output and it enables parent playbooks to identify the URLs generated by this playbook.
  type: String
- contextPath: Oletools.Oleid.ole_command_result
  description: Indicator list from the oleid command.
  type: string
- contextPath: Oletools.Oleid.file_name
  description: File name.
  type: string
- contextPath: Oletools.Oleid.sha256
  description: SHA256 hash.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.File_format
  description: Indicator file format.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.Container_format
  description: Indicator container format.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.Encrypted
  description: Indicator encrypted.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.VBA_Macros
  description: Indicator VBA macros.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.XLM_Macros
  description: Indicator XLM macros.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.External_Relationships
  description: Indicator external relationships.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.ObjectPool
  description: Indicator object pool.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.Flash_objects
  description: Indicator flash objects.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.File_format.Value
  description: Indicator file format value.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.File_format.Ole_Risk
  description: Indicator file format OLE risk.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.File_format.Description
  description: Indicator file format description.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.Container_format.Value
  description: Indicator container format value.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.Container_format.Ole_Risk
  description: Indicator container format OLE risk.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.Container_format.Description
  description: Indicator container format description.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.Encrypted.Value
  description: Indicator encrypted value.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.Encrypted.Ole_Risk
  description: Indicator encrypted OLE risk.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.Encrypted.Description
  description: Indicator encrypted description.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.VBA_Macros.Value
  description: Indicator VBA macros value.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.VBA_Macros.Ole_Risk
  description: Indicator VBA macros OLE risk.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.VBA_Macros.Description
  description: Indicator VBA macros description.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.XLM_Macros.Value
  description: Indicator XLM macros value.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.XLM_Macros.Ole_Risk
  description: Indicator XLM macros OLE risk.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.XLM_Macros.Description
  description: Indicator XLM macros description.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.External_Relationships.Value
  description: Indicator XLM macros value.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.External_Relationships.Ole_Risk
  description: Indicator XLM macros OLE risk.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.External_Relationships.Description
  description: Indicator XLM macros description.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.ObjectPool.Value
  description: Indicator object pool value.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.ObjectPool.Ole_Risk
  description: Indicator object pool OLE risk.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.ObjectPool.Description
  description: Indicator object pool description.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.Flash_objects.Value
  description: Indicator Flash objects value.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.Flash_objects.Ole_Risk
  description: Indicator Flash objects OLE risk.
  type: string
- contextPath: Oletools.Oleid.ole_command_result.Flash_objects.Description
  description: Indicator Flash objects description.
  type: string
- contextPath: Oletools.Oleobj.ole_command_result.hyperlinks
  description: List of hyperlinks.
  type: string
- contextPath: Oletools.Oleobj.file_name
  description: File name.
  type: string
- contextPath: Oletools.Oleobj.sha256
  description: SHA256 hash.
  type: string
- contextPath: Oletools.Olevba.file_name
  description: File name.
  type: string
- contextPath: Oletools.Olevba.sha256
  description: SHA256 hash.
  type: string
- contextPath: Oletools.Olevba.ole_command_result.macro_analyze
  description: Macro analyze.
  type: string
- contextPath: Oletools.Olevba.ole_command_result.macro_src_code
  description: Macro source code.
  type: string
- contextPath: Oletools.Olevba.ole_command_result.macro_list
  description: Macro list.
  type: string
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
  type: string
- contextPath: DBotScore.Type
  description: The indicator type.
  type: string
- contextPath: DBotScore.Vendor
  description: The vendor used to calculate the score.
  type: string
- contextPath: DBotScore.Score
  description: The actual score.
  type: number
- contextPath: QRCodeReader
  description: The QR code reader primary key object.
  type: unknown
- contextPath: QRCodeReader.Text
  description: The raw text extracted from the QR code image.
  type: String
- contextPath: QRCodeReader.Domain
  description: The domains extracted from the QR code image if they are present.
  type: String
- contextPath: QRCodeReader.URL
  description: The URLs extracted from the QR code image if they are present.
  type: String
- contextPath: QRCodeReader.IP
  description: The IPs extracted from the QR code image if they are present.
  type: String
- contextPath: ExtractedHyperLink
  description: Extracted hyperlinks from supported Office documents (xlsx,docx,pptx).
  type: unknown
- contextPath: ExtractedHyperLink.URL
  description: The URL of the extracted hyperlink.
  type: String
- contextPath: ExtractedHyperLink.FileName
  description: The Office file from which the hyperlinks are extracted.
  type: String
tests:
- Extract Indicators From File - Generic v2 - Test
fromversion: 5.0.0
contentitemexportablefields:
  contentitemfields: {}
system: true