File Enrichment - Generic Deprecated Hidden

Deprecated. Use "File Enrichment - Generic v2" playbook instead. Enrich a file using one or more integrations. File enrichment includes: * File history * Threat information * File reputation

Deprecated Content (Deprecated) · 10 tasks · 3 inputs · 14 outputs

Details

IDFile Enrichment - Generic
From Version5.0.0
Tasks10

README

DEPRECATED. Use “File Enrichment - Generic v2” playbook instead. Enriches a file using one or more integrations.

File enrichment includes:

  • File history
  • Threat information
  • File reputation

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • File Enrichment - File reputation
  • File Enrichment - Virus Total private API

Integrations

  • Cylance Protect v2

Scripts

This playbook does not use any scripts.

Commands

  • cylance-protect-get-threat

Playbook Inputs

Name Description Default Value Source Required
MD5 The MD5 hash to enrich. MD5 File Optional
SHA256 The SHA256 hash to enrich. SHA256 File Optional
SHA1 The SHA1 hash to enrich. SHA1 File Optional

Playbook Outputs

Path Description Type
DBotScore.Indicator The tested indicator. string
DBotScore.Type The type of the indicator. string
File.SHA1 The SHA1 hash of the file. string
File.SHA256 The SHA256 hash of the file. string
File.Malicious.Vendor The vendor that made the decision that the file is malicious. string
File.MD5 The MD5 hash of the file. string
DBotScore The DBotScore’s object. unknown
File The file’s object. unknown
DBotScore.Vendor The vendor used to calculate the score. string
DBotScore.Score The actual score. number
File.VirusTotal.Scans The scan object. unknown
File.VirusTotal.Scans.Source The scan vendor for this hash. unknown
File.VirusTotal.Scans.Detected The scan detection for this hash. Can be, “True” or “False”. unknown
File.VirusTotal.Scans.Result The scan result for this hash. For example, signature, etc. unknown

Playbook Image

File_Enrichment_Generic

Inputs

  • MD5 — File MD5 hash to enrich.
  • SHA256 — File SHA-256 hash to enrich.
  • SHA1 — File SHA-1 hash to enrich.

Outputs

  • DBotScore.Indicator — The tested indicator
  • DBotScore.Type — The type of the indicator
  • File.SHA1 — SHA1 hash of the file
  • File.SHA256 — SHA256 hash of the file
  • File.Malicious.Vendor — For malicious files, the vendor that made the decision
  • File.MD5 — MD5 hash of the file
  • DBotScore — The DBotScore's object
  • File — The file's object
  • DBotScore.Vendor — Vendor used to calculate the score
  • DBotScore.Score — The actual score
  • File.VirusTotal.Scans — the scan object
  • File.VirusTotal.Scans.Source — Scan vendor for this hash
  • File.VirusTotal.Scans.Detected — Scan detection for this hash (True,False)
  • File.VirusTotal.Scans.Result — Scan result for this hash - signature, etc.

Commands used

cylance-protect-get-threat

Flowchart

yes yes Start Start Done Done Threat information Threat information Is there a SHA-256 hash? Is there a SHA-256 hash? Get threat info from Cylance Protect v2 Get threat info from Cyla... Is Cylance Protect v2 enabled? Is Cylance Protect v2 ena... Get threat information from Cylance Protect v2 - cylance-protect-get-threat Get threat information fr... cylance-protect-get-threat File Enrichment - Virus Total private API - File Enrichment - Virus Total Private API File Enrichment - Virus T... File Enrichment - Virus Total... File Enrichment - File reputation - File Enrichment - File reputation File Enrichment - File re... File Enrichment - File reputa... File reputation File reputation

Source

playbook-File_Enrichment_-_Generic.yml
Download History Raw 
id: File Enrichment - Generic
version: -1
name: File Enrichment - Generic
fromversion: 5.0.0
description: |-
  Deprecated. Use "File Enrichment - Generic v2" playbook instead. Enrich a file using one or more integrations.

  File enrichment includes:
  * File history
  * Threat information
  * File reputation
starttaskid: "0"
hidden: true
tasks:
  "0":
    id: "0"
    taskid: 6fa65b00-15dc-4cab-8b4e-7ab8e2720215
    type: start
    task:
      id: 6fa65b00-15dc-4cab-8b4e-7ab8e2720215
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
      - "31"
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 50
        }
      }
    note: false
    timertriggers: []
  "7":
    id: "7"
    taskid: d2deb7de-75cc-4f33-8ba3-6f83370096f8
    type: title
    task:
      id: d2deb7de-75cc-4f33-8ba3-6f83370096f8
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
  "24":
    id: "24"
    taskid: 9b849bc8-3a9b-46c5-802e-2fc25b7b1761
    type: title
    task:
      id: 9b849bc8-3a9b-46c5-802e-2fc25b7b1761
      version: -1
      name: Threat information
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
      - "29"
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    note: false
    timertriggers: []
  "25":
    id: "25"
    taskid: 803cab60-a177-4bca-8890-267658a8e037
    type: condition
    task:
      id: 803cab60-a177-4bca-8890-267658a8e037
      version: -1
      name: Is there a SHA-256 hash?
      description: Check if there is a SHA-256 hash in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "26"
    scriptarguments:
      value:
        simple: ${File.SHA256}
    reputationcalc: 0
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 340
        }
      }
    note: false
    timertriggers: []
  "26":
    id: "26"
    taskid: 977beaa5-2d82-4d11-815d-16c6b502b5af
    type: title
    task:
      id: 977beaa5-2d82-4d11-815d-16c6b502b5af
      version: -1
      name: Get threat info from Cylance Protect v2
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 515
        }
      }
    note: false
    timertriggers: []
  "27":
    id: "27"
    taskid: a385675b-4d5d-40c4-8ea3-f9658e14ef91
    type: condition
    task:
      id: a385675b-4d5d-40c4-8ea3-f9658e14ef91
      version: -1
      name: Is Cylance Protect v2 enabled?
      description: Checks if there is an active instance of Cylance Protect v2.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "28"
    reputationcalc: 0
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: string.isEqual
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cylance Protect v2
                    ignorecase: true
                - - operator: string.isEqual
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 660
        }
      }
    note: false
    timertriggers: []
  "28":
    id: "28"
    taskid: 5d1b9cb9-80ad-485a-80ba-e52f2bc9d2f0
    type: regular
    task:
      id: 5d1b9cb9-80ad-485a-80ba-e52f2bc9d2f0
      version: -1
      name: Get threat information from Cylance Protect v2
      description: Get threat information from the Cylance Protect v2 integration.
      script: Cylance Protect v2|||cylance-protect-get-threat
      type: regular
      iscommand: true
      brand: Cylance Protect v2
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      sha256:
        complex:
          root: inputs.SHA256
    reputationcalc: 0
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 835
        }
      }
    note: false
    timertriggers: []
  "29":
    id: "29"
    taskid: 0357cc1e-4fed-4d34-8672-c44dde656382
    type: playbook
    task:
      id: 0357cc1e-4fed-4d34-8672-c44dde656382
      version: -1
      name: File Enrichment - Virus Total private API
      description: Get file reputation using one or more integrations
      playbookName: File Enrichment - Virus Total Private API
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      MD5:
        complex:
          root: inputs.MD5
      SHA1:
        complex:
          root: inputs.SHA1
      SHA256:
        complex:
          root: inputs.SHA256
    reputationcalc: 0
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 705,
          "y": 835
        }
      }
    note: false
    timertriggers: []
  "30":
    id: "30"
    taskid: 52857fb4-234a-41b3-863e-acedeb1b02b3
    type: playbook
    task:
      id: 52857fb4-234a-41b3-863e-acedeb1b02b3
      version: -1
      name: File Enrichment - File reputation
      description: Get file reputation using one or more integrations
      playbookName: File Enrichment - File reputation
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      MD5:
        complex:
          root: inputs.MD5
      SHA1:
        complex:
          root: inputs.SHA1
      SHA256:
        complex:
          root: inputs.SHA256
    reputationcalc: 0
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 1135,
          "y": 835
        }
      }
    note: false
    timertriggers: []
  "31":
    id: "31"
    taskid: e14e2725-8611-4089-8947-4db090c13347
    type: title
    task:
      id: e14e2725-8611-4089-8947-4db090c13347
      version: -1
      name: File reputation
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1135,
          "y": 675
        }
      }
    note: false
    timertriggers: []
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1025,
        "width": 1465,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: File MD5 hash to enrich.
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
  required: false
  description: File SHA-256 hash to enrich.
- key: SHA1
  value:
    complex:
      root: File
      accessor: SHA1
  required: false
  description: File SHA-1 hash to enrich.
outputs:
- contextPath: DBotScore.Indicator
  description: The tested indicator
  type: string
- contextPath: DBotScore.Type
  description: The type of the indicator
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file
  type: string
- contextPath: File.SHA256
  description: SHA256 hash of the file
  type: string
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision
  type: string
- contextPath: File.MD5
  description: MD5 hash of the file
  type: string
- contextPath: DBotScore
  description: The DBotScore's object
  type: unknown
- contextPath: File
  description: The file's object
  type: unknown
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score
  type: string
- contextPath: DBotScore.Score
  description: The actual score
  type: number
- contextPath: File.VirusTotal.Scans
  description: the scan object
  type: unknown
- contextPath: File.VirusTotal.Scans.Source
  description: Scan vendor for this hash
- contextPath: File.VirusTotal.Scans.Detected
  description: Scan detection for this hash (True,False)
- contextPath: File.VirusTotal.Scans.Result
  description: Scan result for this hash - signature, etc.
tests:
- no test (new v2 playbook has an updated test)
deprecated: true