File Reputation

This playbook checks the file reputation and sets the verdict as a new context key. The verdict is composed by 3 main components: * VirusTotal detection rate * Digital certificate signers * NSRL DB Note: a user can provide a list of trusted signers of his own using the playbook inputs

Common Playbooks · 24 tasks · 3 inputs · 6 outputs

Inputs

DetectionThreshold — The minimum number of positive engines needed to mark file as malicious.
TrustedPublishers — A list of trusted publishers
FileSHA256 — The file SHA256.

Outputs

VTFileVerdict — VirusTotal file verdict.
NSRLFileVerdict — NSRL file verdict.
VTFileSigners — VirusTotal file signers.
XDRFileSigners — XDR file signers.
WildFire.Report — WildFire report details.
WildFire.Verdicts — WildFire verdict.

Commands used

file wildfire-get-verdict wildfire-report

Flowchart