File Enrichment - Generic v2

Details

ID	`File Enrichment - Generic v2`
From Version	5.0.0
Tasks	12

README

Enrich a file using one or more integrations.

Provide threat information
Determine file reputation using the !file command

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

File Enrichment - Virus Total (API v3)

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

file
cylance-protect-get-threat

Playbook Inputs

Name	Description	Default Value	Required
MD5	File MD5 hash to enrich.	File.MD5	Optional
SHA256	The file SHA256 hash to enrich.	File.SHA256	Optional
SHA1	The file SHA1 hash to enrich.	File.SHA1	Optional
UseReputationCommand	Define if you would like to use the !file command. Note: This input should be used whenever there is no auto-extract enabled in the investigation flow. Possible values: True / False.	False	Required

Playbook Outputs

Path	Description	Type
DBotScore.Indicator	The indicator that was tested.	string
DBotScore.Type	The indicator type.	string
File.SHA1	SHA1 hash of the file.	string
File.SHA256	SHA256 hash of the file.	string
File.Malicious.Vendor	For malicious files, the vendor that made the decision.	string
File.MD5	MD5 hash of the file.	string
DBotScore	The DBotScore object.	unknown
File	The file object	unknown
DBotScore.Vendor	Vendor used to calculate the score.	string
DBotScore.Score	The actual score.	number
File.Malicious.Description	The reason the vendor decided the file was malicious.	string
File.Name	The name of the threat.	string
File.MalwareFamily	The file family classification.	string
File.AutoRun	Indicates if the file is set to automatically run on system startup.	string
File.AvIndustry	The score provided by the Anti-Virus industry.	string
File.CertIssuer	The ID for the certificate issuer.	string
File.CertPublisher	The ID for the certificate publisher.	string
File.CertTimestamp	The date and time (in UTC) when the file was signed using the certificate.	string
File.Classification	The threat classification for the threat.	string
File.CylanceScore	The Cylance Score assigned to the threat.	string
File.DetectedBy	The name of the Cylance module that detected the threat.	string
File.FileSize	The size of the file.	string
File.GlobalQuarantine	Identifies if the threat is on the Global Quarantine list.	string
File.Running	Identifies if the threat is executing, or another executable loaded or called it.	string
File.Safelisted	Identifies if the threat is on the Safe List.	string
File.Signed	Identifies the file as signed or not signed.	string
File.SubClassification	The threat sub-classification for the threat.	string
File.UniqueToCylance	Whether the threat was identified by Cylance, and not by other anti-virus sources.	string
File.Relationships.EntityA	The source of the relationship.	String
File.Relationships.EntityB	The destination of the relationship.	String
File.Relationships.Relationship	The name of the relationship.	String
File.Relationships.EntityAtype	The type of the source of the relationship.	String
File.Relationships.EntityBtype	The type of the destination of the relationship.	String
File.Malicious.TotalEngines	For malicious files, the total number of engines that checked the file hash.	Unknown
DBotScore.Reliability	Reliability of the source providing the intelligence data.	String
VirusTotal.File.attributes.type_description	description of the type of the file.	String
VirusTotal.File.attributes.tlsh	The locality-sensitive hashing.	String
VirusTotal.File.attributes.names	Names of the file.	String
VirusTotal.File.attributes.last_modification_date	The last modification date in epoch format.	Number
VirusTotal.File.attributes.type_tag	Tag of the type.	String
VirusTotal.File.attributes.size	Size of the file.	Number
VirusTotal.File.attributes.times_submitted	Number of times the file was submitted.	Number
VirusTotal.File.attributes.last_submission_date	Last submission date in epoch format.	Number
VirusTotal.File.attributes.downloadable	Whether the file is downloadable.	Boolean
VirusTotal.File.attributes.sha256	SHA-256 hash of the file.	String
VirusTotal.File.attributes.type_extension	Extension of the type.	String
VirusTotal.File.attributes.tags	File tags.	String
VirusTotal.File.attributes.last_analysis_date	Last analysis date in epoch format.	Number
VirusTotal.File.attributes.unique_sources	Unique sources.	Number
VirusTotal.File.attributes.first_submission_date	First submission date in epoch format.	Number
VirusTotal.File.attributes.ssdeep	SSDeep hash of the file.	String
VirusTotal.File.attributes.md5	MD5 hash of the file.	String
VirusTotal.File.attributes.sha1	SHA-1 hash of the file.	String
VirusTotal.File.attributes.magic	Identification of file by the magic number.	String
VirusTotal.File.attributes.meaningful_name	Meaningful name of the file.	String
VirusTotal.File.attributes.reputation	The reputation of the file.	Number
VirusTotal.File.attributes.exiftool.MIMEtype	MIME type of the file.	String
VirusTotal.File.attributes.exiftool.Filetype	The file type.	String
VirusTotal.File.attributes.exiftool.WordCount	Total number of words in the file.	String
VirusTotal.File.attributes.exiftool.LineCount	Total number of lines in file.	String
VirusTotal.File.attributes.exiftool.MIMEEncoding	The MIME encoding.	String
VirusTotal.File.attributes.exiftool.FiletypeExtension	The file type extension.	String
VirusTotal.File.attributes.exiftool.Newlines	Number of newlines signs.	String
VirusTotal.File.attributes.javascript_info.tags	Tags of the JavaScript.	String
VirusTotal.File.attributes.crowdsourced_ids_stats.info	Number of IDS that marked the file as “info”.	Number
VirusTotal.File.attributes.crowdsourced_ids_stats.high	Number of IDS that marked the file as “high”.	Number
VirusTotal.File.attributes.crowdsourced_ids_stats.medium	Number of IDS that marked the file as “medium”.	Number
VirusTotal.File.attributes.crowdsourced_ids_stats.low	Number of IDS that marked the file as “low”.	Number
VirusTotal.File.attributes.sigma_analysis_stats.critical	Number of Sigma analysis that marked the file as “critical”.	Number
VirusTotal.File.attributes.sigma_analysis_stats.high	Number of Sigma analysis that marked the file as “high”.	Number
VirusTotal.File.attributes.sigma_analysis_stats.medium	Number of Sigma analysis that marked the file as “medium”.	Number
VirusTotal.File.attributes.sigma_analysis_stats.low	Number of Sigma analysis that marked the file as “low”.	Number
VirusTotal.File.attributes.trid.file_type	The TrID file type.	String
VirusTotal.File.attributes.trid.probability	The TrID probability.	Number
VirusTotal.File.attributes.crowdsourced_yara_results.description	description of the YARA rule.	String
VirusTotal.File.attributes.crowdsourced_yara_results.source	Source of the YARA rule.	String
VirusTotal.File.attributes.crowdsourced_yara_results.author	Author of the YARA rule.	String
VirusTotal.File.attributes.crowdsourced_yara_results.ruleset_name	Rule set name of the YARA rule.	String
VirusTotal.File.attributes.crowdsourced_yara_results.rule_name	Name of the YARA rule.	String
VirusTotal.File.attributes.crowdsourced_yara_results.ruleset_id	ID of the YARA rule.	String
VirusTotal.File.attributes.total_votes.harmless	Total number of harmless votes.	Number
VirusTotal.File.attributes.total_votes.malicious	Total number of malicious votes.	Number
VirusTotal.File.attributes.popular_threat_classification.suggested_threat_label	Suggested thread label.	String
VirusTotal.File.attributes.popular_threat_classification.popular_threat_name	The popular thread name.	Number
VirusTotal.File.attributes.last_analysis_stats.harmless	The number of engines that found the indicator to be harmless.	Number
VirusTotal.File.attributes.last_analysis_stats.type-unsupported	The number of engines that found the indicator to be of type unsupported.	Number
VirusTotal.File.attributes.last_analysis_stats.suspicious	The number of engines that found the indicator to be suspicious.	Number
VirusTotal.File.attributes.last_analysis_stats.confirmed-timeout	The number of engines that confirmed the timeout of the indicator.	Number
VirusTotal.File.attributes.last_analysis_stats.timeout	The number of engines that timed out for the indicator.	Number
VirusTotal.File.attributes.last_analysis_stats.failure	The number of failed analysis engines.	Number
VirusTotal.File.attributes.last_analysis_stats.malicious	The number of engines that found the indicator to be malicious.	Number
VirusTotal.File.attributes.last_analysis_stats.undetected	The number of engines that could not detect the indicator.	Number
VirusTotal.File.type	type of the indicator (file).	String
VirusTotal.File.id	type ID of the indicator.	String
VirusTotal.File.links.self	Link to the response.	Unknown

Playbook Image

File Enrichment - Generic v2

Inputs

MD5 — File MD5 hash to enrich.
SHA256 — The file SHA256 hash to enrich.
SHA1 — The file SHA1 hash to enrich.
UseReputationCommand — Define if you would like to use the !file command. Note: This input should be used whenever there is no auto-extract enabled in the investigation flow. Possible values: True / False.

Outputs

DBotScore.Indicator — The indicator that was tested.
DBotScore.Type — The indicator type.
File.SHA1 — SHA1 hash of the file.
File.SHA256 — SHA256 hash of the file.
File.Malicious.Vendor — For malicious files, the vendor that made the decision.
File.MD5 — MD5 hash of the file.
DBotScore — The DBotScore object.
File — The file object
DBotScore.Vendor — Vendor used to calculate the score.
DBotScore.Score — The actual score.
File.Malicious.Description — The reason the vendor decided the file was malicious.
File.Name — The name of the threat.
File.MalwareFamily — The file family classification.
File.AutoRun — Indicates if the file is set to automatically run on system startup.
File.AvIndustry — The score provided by the Anti-Virus industry.
File.CertIssuer — The ID for the certificate issuer.
File.CertPublisher — The ID for the certificate publisher.
File.CertTimestamp — The date and time (in UTC) when the file was signed using the certificate.
File.Classification — The threat classification for the threat.
File.CylanceScore — The Cylance Score assigned to the threat.
File.DetectedBy — The name of the Cylance module that detected the threat.
File.FileSize — The size of the file.
File.GlobalQuarantine — Identifies if the threat is on the Global Quarantine list.
File.Running — Identifies if the threat is executing, or another executable loaded or called it.
File.Safelisted — Identifies if the threat is on the Safe List.
File.Signed — Identifies the file as signed or not signed.
File.SubClassification — The threat sub-classification for the threat.
File.UniqueToCylance — Whether the threat was identified by Cylance, and not by other anti-virus sources.
File.Relationships.EntityA — The source of the relationship.
File.Relationships.EntityB — The destination of the relationship.
File.Relationships.Relationship — The name of the relationship.
File.Relationships.EntityAtype — The type of the source of the relationship.
File.Relationships.EntityBtype — The type of the destination of the relationship.
File.Malicious.TotalEngines — For malicious files, the total number of engines that checked the file hash.
DBotScore.Reliability — Reliability of the source providing the intelligence data.
VirusTotal.File.attributes.type_description — description of the type of the file.
VirusTotal.File.attributes.tlsh — The locality-sensitive hashing.
VirusTotal.File.attributes.names — Names of the file.
VirusTotal.File.attributes.last_modification_date — The last modification date in epoch format.
VirusTotal.File.attributes.type_tag — Tag of the type.
VirusTotal.File.attributes.size — Size of the file.
VirusTotal.File.attributes.times_submitted — Number of times the file was submitted.
VirusTotal.File.attributes.last_submission_date — Last submission date in epoch format.
VirusTotal.File.attributes.downloadable — Whether the file is downloadable.
VirusTotal.File.attributes.sha256 — SHA-256 hash of the file.
VirusTotal.File.attributes.type_extension — Extension of the type.
VirusTotal.File.attributes.tags — File tags.
VirusTotal.File.attributes.last_analysis_date — Last analysis date in epoch format.
VirusTotal.File.attributes.unique_sources — Unique sources.
VirusTotal.File.attributes.first_submission_date — First submission date in epoch format.
VirusTotal.File.attributes.ssdeep — SSDeep hash of the file.
VirusTotal.File.attributes.md5 — MD5 hash of the file.
VirusTotal.File.attributes.sha1 — SHA-1 hash of the file.
VirusTotal.File.attributes.magic — Identification of file by the magic number.
VirusTotal.File.attributes.meaningful_name — Meaningful name of the file.
VirusTotal.File.attributes.reputation — The reputation of the file.
VirusTotal.File.attributes.exiftool.MIMEtype — MIME type of the file.
VirusTotal.File.attributes.exiftool.Filetype — The file type.
VirusTotal.File.attributes.exiftool.WordCount — Total number of words in the file.
VirusTotal.File.attributes.exiftool.LineCount — Total number of lines in file.
VirusTotal.File.attributes.exiftool.MIMEEncoding — The MIME encoding.
VirusTotal.File.attributes.exiftool.FiletypeExtension — The file type extension.
VirusTotal.File.attributes.exiftool.Newlines — Number of newlines signs.
VirusTotal.File.attributes.javascript_info.tags — Tags of the JavaScript.
VirusTotal.File.attributes.crowdsourced_ids_stats.info — Number of IDS that marked the file as "info".
VirusTotal.File.attributes.crowdsourced_ids_stats.high — Number of IDS that marked the file as "high".
VirusTotal.File.attributes.crowdsourced_ids_stats.medium — Number of IDS that marked the file as "medium".
VirusTotal.File.attributes.crowdsourced_ids_stats.low — Number of IDS that marked the file as "low".
VirusTotal.File.attributes.sigma_analysis_stats.critical — Number of Sigma analysis that marked the file as "critical".
VirusTotal.File.attributes.sigma_analysis_stats.high — Number of Sigma analysis that marked the file as "high".
VirusTotal.File.attributes.sigma_analysis_stats.medium — Number of Sigma analysis that marked the file as "medium".
VirusTotal.File.attributes.sigma_analysis_stats.low — Number of Sigma analysis that marked the file as "low".
VirusTotal.File.attributes.trid.file_type — The TrID file type.
VirusTotal.File.attributes.trid.probability — The TrID probability.
VirusTotal.File.attributes.crowdsourced_yara_results.description — description of the YARA rule.
VirusTotal.File.attributes.crowdsourced_yara_results.source — Source of the YARA rule.
VirusTotal.File.attributes.crowdsourced_yara_results.author — Author of the YARA rule.
VirusTotal.File.attributes.crowdsourced_yara_results.ruleset_name — Rule set name of the YARA rule.
VirusTotal.File.attributes.crowdsourced_yara_results.rule_name — Name of the YARA rule.
VirusTotal.File.attributes.crowdsourced_yara_results.ruleset_id — ID of the YARA rule.
VirusTotal.File.attributes.total_votes.harmless — Total number of harmless votes.
VirusTotal.File.attributes.total_votes.malicious — Total number of malicious votes.
VirusTotal.File.attributes.popular_threat_classification.suggested_threat_label — Suggested thread label.
VirusTotal.File.attributes.popular_threat_classification.popular_threat_name — The popular thread name.
VirusTotal.File.attributes.last_analysis_stats.harmless — The number of engines that found the indicator to be harmless.
VirusTotal.File.attributes.last_analysis_stats.type-unsupported — The number of engines that found the indicator to be of type unsupported.
VirusTotal.File.attributes.last_analysis_stats.suspicious — The number of engines that found the indicator to be suspicious.
VirusTotal.File.attributes.last_analysis_stats.confirmed-timeout — The number of engines that confirmed the timeout of the indicator.
VirusTotal.File.attributes.last_analysis_stats.timeout — The number of engines that timed out for the indicator.
VirusTotal.File.attributes.last_analysis_stats.failure — The number of failed analysis engines.
VirusTotal.File.attributes.last_analysis_stats.malicious — The number of engines that found the indicator to be malicious.
VirusTotal.File.attributes.last_analysis_stats.undetected — The number of engines that could not detect the indicator.
VirusTotal.File.type — type of the indicator (file).
VirusTotal.File.id — type ID of the indicator.
VirusTotal.File.links.self — Link to the response.

Commands used

cylance-protect-get-threat file

Flowchart

Source

playbook-File_Enrichment_-_Generic_v2.yml

Download History Raw

id: File Enrichment - Generic v2
version: -1
name: File Enrichment - Generic v2
description: |-
  Enrich a file using one or more integrations.

  - Provide threat information
  - Determine file reputation using the !file command
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 90f7ce25-c27c-4ca9-8fe6-2168349b0702
    type: start
    task:
      id: 90f7ce25-c27c-4ca9-8fe6-2168349b0702
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      "#none#":
      - "31"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 470,
          "y": -150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "7":
    id: "7"
    taskid: be10b4ea-fb5e-478c-8614-ae684debb82f
    type: title
    task:
      id: be10b4ea-fb5e-478c-8614-ae684debb82f
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 470,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "25":
    id: "25"
    taskid: 049989d4-fe3f-4a96-8f17-ad155ed74362
    type: condition
    task:
      id: 049989d4-fe3f-4a96-8f17-ad155ed74362
      version: -1
      name: Is there a SHA256 hash?
      description: Verify whether there is a SHA256 hash to enrich.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "#default#":
      - "7"
      yes:
      - "27"
    scriptarguments:
      value:
        simple: ${File.SHA256}
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.SHA256
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 720,
          "y": 300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "27":
    id: "27"
    taskid: 27539369-ccb3-441c-89d9-001a4fc03093
    type: condition
    task:
      id: 27539369-ccb3-441c-89d9-001a4fc03093
      version: -1
      name: Is Cylance Protect v2 enabled?
      description: Checks if there is an active instance of the Cylance Protect v2 integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "#default#":
      - "7"
      yes:
      - "28"
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cylance Protect v2
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 720,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "28":
    id: "28"
    taskid: 6721f439-f2ce-4dec-8bff-5eedf90921c9
    type: regular
    task:
      id: 6721f439-f2ce-4dec-8bff-5eedf90921c9
      version: -1
      name: Get threat information from Cylance Protect v2
      description: Requests threat details for a specific threat.
      script: '|||cylance-protect-get-threat'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      "#none#":
      - "7"
    scriptarguments:
      sha256:
        complex:
          root: inputs.SHA256
          transformers:
          - operator: uniq
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 720,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "30":
    id: "30"
    taskid: f5488926-c247-4181-8824-1c81eac47049
    type: playbook
    task:
      id: f5488926-c247-4181-8824-1c81eac47049
      version: -1
      name: File Enrichment - Virus Total (API v3)
      description: Get file information using the Virus Total API integration.
      type: playbook
      iscommand: false
      brand: ""
      playbookName: File Enrichment - Virus Total (API v3)
    nexttasks:
      "#none#":
      - "7"
    scriptarguments:
      FileHash:
        complex:
          root: inputs.SHA256
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: inputs.SHA1
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: inputs.MD5
                iscontext: true
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -200,
          "y": 300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "31":
    id: "31"
    taskid: de42fb75-e635-43b3-8696-a867fe55e70b
    type: condition
    task:
      id: de42fb75-e635-43b3-8696-a867fe55e70b
      version: -1
      name: Is there a file hash?
      description: Ensure that there are file hashes to enrich.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "#default#":
      - "7"
      yes:
      - "36"
      - "32"
      - "35"
    scriptarguments:
      value:
        simple: ${File.SHA256}
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.SHA256
            iscontext: true
          right:
            value: {}
        - operator: isExists
          left:
            value:
              complex:
                root: inputs.SHA1
            iscontext: true
        - operator: isExists
          left:
            value:
              complex:
                root: inputs.MD5
            iscontext: true
    view: |-
      {
        "position": {
          "x": 470,
          "y": -20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "32":
    continueonerrortype: ""
    id: "32"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "33"
      - "7"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: aa3b5462-64fd-4033-8812-9d952347a79d
      iscommand: false
      name: Check Reputation Using All Available Integrations
      type: title
      version: -1
      description: ''
    taskid: aa3b5462-64fd-4033-8812-9d952347a79d
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 220,
          "y": 150
        }
      }
  "33":
    conditions:
    - condition:
      - - ignorecase: true
          left:
            iscontext: true
            value:
              complex:
                root: inputs.UseReputationCommand
          operator: isEqualString
          right:
            value:
              simple: "True"
      label: "yes"
    continueonerrortype: ""
    id: "33"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "34"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 331e3147-e6bc-4db8-8fe9-5a1d56cd4e3a
      iscommand: false
      name: Should use !file command?
      description: Check whether the file reputation command should be run.
      type: condition
      version: -1
    taskid: 331e3147-e6bc-4db8-8fe9-5a1d56cd4e3a
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 220,
          "y": 300
        }
      }
  "34":
    continueonerrortype: ""
    id: "34"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    scriptarguments:
      file:
        complex:
          root: inputs.SHA256
          transformers:
          - args:
              item:
                iscontext: true
                value:
                  simple: inputs.MD5
            operator: append
          - args:
              item:
                iscontext: true
                value:
                  simple: inputs.SHA1
            operator: append
          - operator: uniq
    separatecontext: false
    skipunavailable: true
    task:
      brand: ""
      description: Checks the file reputation of the specified hash.
      id: 0e956788-b597-4a77-8ffd-01b39d718d17
      iscommand: true
      name: Check Reputation
      script: '|||file'
      type: regular
      version: -1
    taskid: 0e956788-b597-4a77-8ffd-01b39d718d17
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 220,
          "y": 510
        }
      }
  "35":
    continueonerrortype: ""
    id: "35"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "30"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 4d022016-e7a4-454b-85d5-fad65548649c
      iscommand: false
      name: Virus Total enrichment
      type: title
      version: -1
      description: ''
    taskid: 4d022016-e7a4-454b-85d5-fad65548649c
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": -200,
          "y": 150
        }
      }
  "36":
    continueonerrortype: ""
    id: "36"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "25"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 601042e3-6757-4e60-8293-6c026caba2d1
      iscommand: false
      name: Cylance Protect enrichment
      type: title
      version: -1
      description: ''
    taskid: 601042e3-6757-4e60-8293-6c026caba2d1
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 720,
          "y": 150
        }
      }
view: |-
  {
    "linkLabelsPosition": {
      "25_27_yes": 0.59,
      "25_7_#default#": 0.25,
      "27_28_yes": 0.57,
      "27_7_#default#": 0.36,
      "31_7_#default#": 0.13,
      "33_7_#default#": 0.25
    },
    "paper": {
      "dimensions": {
        "height": 1115,
        "width": 1300,
        "x": -200,
        "y": -150
      }
    }
  }
inputs:
- key: MD5
  value:
    complex:
      root: File
      transformers:
      - operator: uniq
      accessor: MD5
  required: false
  description: File MD5 hash to enrich.
  playbookInputQuery:
- key: SHA256
  value:
    complex:
      root: File
      transformers:
      - operator: uniq
      accessor: SHA256
  required: false
  description: The file SHA256 hash to enrich.
  playbookInputQuery:
- key: SHA1
  value:
    complex:
      root: File
      transformers:
      - operator: uniq
      accessor: SHA1
  required: false
  description: The file SHA1 hash to enrich.
  playbookInputQuery:
- description: |-
    Define if you would like to use the !file command.
    Note: This input should be used whenever there is no auto-extract enabled in the investigation flow.
    Possible values: True / False.
  key: UseReputationCommand
  playbookInputQuery:
  required: true
  value:
    simple: "False"
outputs:
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
  type: string
- contextPath: DBotScore.Type
  description: The indicator type.
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file.
  type: string
- contextPath: File.SHA256
  description: SHA256 hash of the file.
  type: string
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision.
  type: string
- contextPath: File.MD5
  description: MD5 hash of the file.
  type: string
- contextPath: DBotScore
  description: The DBotScore object.
  type: unknown
- contextPath: File
  description: The file object
  type: unknown
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score.
  type: string
- contextPath: DBotScore.Score
  description: The actual score.
  type: number
- contextPath: File.Malicious.Description
  description: The reason the vendor decided the file was malicious.
  type: string
- contextPath: File.Name
  description: The name of the threat.
  type: string
- contextPath: File.MalwareFamily
  description: The file family classification.
  type: string
- contextPath: File.AutoRun
  description: Indicates if the file is set to automatically run on system startup.
  type: string
- contextPath: File.AvIndustry
  description: The score provided by the Anti-Virus industry.
  type: string
- contextPath: File.CertIssuer
  description: The ID for the certificate issuer.
  type: string
- contextPath: File.CertPublisher
  description: The ID for the certificate publisher.
  type: string
- contextPath: File.CertTimestamp
  description: The date and time (in UTC) when the file was signed using the certificate.
  type: string
- contextPath: File.Classification
  description: The threat classification for the threat.
  type: string
- contextPath: File.CylanceScore
  description: The Cylance Score assigned to the threat.
  type: string
- contextPath: File.DetectedBy
  description: The name of the Cylance module that detected the threat.
  type: string
- contextPath: File.FileSize
  description: The size of the file.
  type: string
- contextPath: File.GlobalQuarantine
  description: Identifies if the threat is on the Global Quarantine list.
  type: string
- contextPath: File.Running
  description: Identifies if the threat is executing, or another executable loaded or called it.
  type: string
- contextPath: File.Safelisted
  description: Identifies if the threat is on the Safe List.
  type: string
- contextPath: File.Signed
  description: Identifies the file as signed or not signed.
  type: string
- contextPath: File.SubClassification
  description: The threat sub-classification for the threat.
  type: string
- contextPath: File.UniqueToCylance
  description: Whether the threat was identified by Cylance, and not by other anti-virus sources.
  type: string
- contextPath: File.Relationships.EntityA
  description: The source of the relationship.
  type: String
- contextPath: File.Relationships.EntityB
  description: The destination of the relationship.
  type: String
- contextPath: File.Relationships.Relationship
  description: The name of the relationship.
  type: String
- contextPath: File.Relationships.EntityAtype
  description: The type of the source of the relationship.
  type: String
- contextPath: File.Relationships.EntityBtype
  description: The type of the destination of the relationship.
  type: String
- contextPath: File.Malicious.TotalEngines
  description: For malicious files, the total number of engines that checked the file hash.
  type: Unknown
- contextPath: DBotScore.Reliability
  description: Reliability of the source providing the intelligence data.
  type: String
- contextPath: VirusTotal.File.attributes.type_description
  description: description of the type of the file.
  type: String
- contextPath: VirusTotal.File.attributes.tlsh
  description: The locality-sensitive hashing.
  type: String
- contextPath: VirusTotal.File.attributes.names
  description: Names of the file.
  type: String
- contextPath: VirusTotal.File.attributes.last_modification_date
  description: The last modification date in epoch format.
  type: Number
- contextPath: VirusTotal.File.attributes.type_tag
  description: Tag of the type.
  type: String
- contextPath: VirusTotal.File.attributes.size
  description: Size of the file.
  type: Number
- contextPath: VirusTotal.File.attributes.times_submitted
  description: Number of times the file was submitted.
  type: Number
- contextPath: VirusTotal.File.attributes.last_submission_date
  description: Last submission date in epoch format.
  type: Number
- contextPath: VirusTotal.File.attributes.downloadable
  description: Whether the file is downloadable.
  type: Boolean
- contextPath: VirusTotal.File.attributes.sha256
  description: SHA-256 hash of the file.
  type: String
- contextPath: VirusTotal.File.attributes.type_extension
  description: Extension of the type.
  type: String
- contextPath: VirusTotal.File.attributes.tags
  description: File tags.
  type: String
- contextPath: VirusTotal.File.attributes.last_analysis_date
  description: Last analysis date in epoch format.
  type: Number
- contextPath: VirusTotal.File.attributes.unique_sources
  description: Unique sources.
  type: Number
- contextPath: VirusTotal.File.attributes.first_submission_date
  description: First submission date in epoch format.
  type: Number
- contextPath: VirusTotal.File.attributes.ssdeep
  description: SSDeep hash of the file.
  type: String
- contextPath: VirusTotal.File.attributes.md5
  description: MD5 hash of the file.
  type: String
- contextPath: VirusTotal.File.attributes.sha1
  description: SHA-1 hash of the file.
  type: String
- contextPath: VirusTotal.File.attributes.magic
  description: Identification of file by the magic number.
  type: String
- contextPath: VirusTotal.File.attributes.meaningful_name
  description: Meaningful name of the file.
  type: String
- contextPath: VirusTotal.File.attributes.reputation
  description: The reputation of the file.
  type: Number
- contextPath: VirusTotal.File.attributes.exiftool.MIMEtype
  description: MIME type of the file.
  type: String
- contextPath: VirusTotal.File.attributes.exiftool.Filetype
  description: The file type.
  type: String
- contextPath: VirusTotal.File.attributes.exiftool.WordCount
  description: Total number of words in the file.
  type: String
- contextPath: VirusTotal.File.attributes.exiftool.LineCount
  description: Total number of lines in file.
  type: String
- contextPath: VirusTotal.File.attributes.exiftool.MIMEEncoding
  description: The MIME encoding.
  type: String
- contextPath: VirusTotal.File.attributes.exiftool.FiletypeExtension
  description: The file type extension.
  type: String
- contextPath: VirusTotal.File.attributes.exiftool.Newlines
  description: Number of newlines signs.
  type: String
- contextPath: VirusTotal.File.attributes.javascript_info.tags
  description: Tags of the JavaScript.
  type: String
- contextPath: VirusTotal.File.attributes.crowdsourced_ids_stats.info
  description: Number of IDS that marked the file as "info".
  type: Number
- contextPath: VirusTotal.File.attributes.crowdsourced_ids_stats.high
  description: Number of IDS that marked the file as "high".
  type: Number
- contextPath: VirusTotal.File.attributes.crowdsourced_ids_stats.medium
  description: Number of IDS that marked the file as "medium".
  type: Number
- contextPath: VirusTotal.File.attributes.crowdsourced_ids_stats.low
  description: Number of IDS that marked the file as "low".
  type: Number
- contextPath: VirusTotal.File.attributes.sigma_analysis_stats.critical
  description: Number of Sigma analysis that marked the file as "critical".
  type: Number
- contextPath: VirusTotal.File.attributes.sigma_analysis_stats.high
  description: Number of Sigma analysis that marked the file as "high".
  type: Number
- contextPath: VirusTotal.File.attributes.sigma_analysis_stats.medium
  description: Number of Sigma analysis that marked the file as "medium".
  type: Number
- contextPath: VirusTotal.File.attributes.sigma_analysis_stats.low
  description: Number of Sigma analysis that marked the file as "low".
  type: Number
- contextPath: VirusTotal.File.attributes.trid.file_type
  description: The TrID file type.
  type: String
- contextPath: VirusTotal.File.attributes.trid.probability
  description: The TrID probability.
  type: Number
- contextPath: VirusTotal.File.attributes.crowdsourced_yara_results.description
  description: description of the YARA rule.
  type: String
- contextPath: VirusTotal.File.attributes.crowdsourced_yara_results.source
  description: Source of the YARA rule.
  type: String
- contextPath: VirusTotal.File.attributes.crowdsourced_yara_results.author
  description: Author of the YARA rule.
  type: String
- contextPath: VirusTotal.File.attributes.crowdsourced_yara_results.ruleset_name
  description: Rule set name of the YARA rule.
  type: String
- contextPath: VirusTotal.File.attributes.crowdsourced_yara_results.rule_name
  description: Name of the YARA rule.
  type: String
- contextPath: VirusTotal.File.attributes.crowdsourced_yara_results.ruleset_id
  description: ID of the YARA rule.
  type: String
- contextPath: VirusTotal.File.attributes.total_votes.harmless
  description: Total number of harmless votes.
  type: Number
- contextPath: VirusTotal.File.attributes.total_votes.malicious
  description: Total number of malicious votes.
  type: Number
- contextPath: VirusTotal.File.attributes.popular_threat_classification.suggested_threat_label
  description: Suggested thread label.
  type: String
- contextPath: VirusTotal.File.attributes.popular_threat_classification.popular_threat_name
  description: The popular thread name.
  type: Number
- contextPath: VirusTotal.File.attributes.last_analysis_stats.harmless
  description: The number of engines that found the indicator to be harmless.
  type: Number
- contextPath: VirusTotal.File.attributes.last_analysis_stats.type-unsupported
  description: The number of engines that found the indicator to be of type unsupported.
  type: Number
- contextPath: VirusTotal.File.attributes.last_analysis_stats.suspicious
  description: The number of engines that found the indicator to be suspicious.
  type: Number
- contextPath: VirusTotal.File.attributes.last_analysis_stats.confirmed-timeout
  description: The number of engines that confirmed the timeout of the indicator.
  type: Number
- contextPath: VirusTotal.File.attributes.last_analysis_stats.timeout
  description: The number of engines that timed out for the indicator.
  type: Number
- contextPath: VirusTotal.File.attributes.last_analysis_stats.failure
  description: The number of failed analysis engines.
  type: Number
- contextPath: VirusTotal.File.attributes.last_analysis_stats.malicious
  description: The number of engines that found the indicator to be malicious.
  type: Number
- contextPath: VirusTotal.File.attributes.last_analysis_stats.undetected
  description: The number of engines that could not detect the indicator.
  type: Number
- contextPath: VirusTotal.File.type
  description: type of the indicator (file).
  type: String
- contextPath: VirusTotal.File.id
  description: type ID of the indicator.
  type: String
- contextPath: VirusTotal.File.links.self
  description: Link to the response.
  type: Unknown
fromversion: 5.0.0
tests:
- File Enrichment - Generic v2 - Test
contentitemexportablefields:
  contentitemfields: {}
system: true
marketplaces:
- xsoar
- marketplacev2
- platform