File Reputation

This playbook checks the file reputation and sets the verdict as a new context key. The verdict is composed by 3 main components: * VirusTotal detection rate * Digital certificate signers * NSRL DB Note: a user can provide a list of trusted signers of his own using the playbook inputs
Common Playbooks · 24 tasks · 3 inputs · 6 outputs
Details

ID	`File Reputation`
From Version	6.6.0
Tasks	24
README

This playbook checks the file reputation and sets the verdict as a new context key.
The verdict is composed by 3 main components:
VirusTotal detection rate
Digital certificate signers
NSRL DB
Note: a user can provide a list of trusted signers of his own using the playbook inputs
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

This playbook does not use any sub-playbooks.
Integrations

This playbook does not use any integrations.
Scripts

Set
http
ParseJSON
Commands

wildfire-report
wildfire-get-verdict
file
Playbook Inputs

Name	Description	Default Value	Required
DetectionThreshold	The minimum number of positive engines needed to mark file as malicious.	5	Optional
TrustedPublishers	A list of trusted publishers	Microsoft Root Authority,Microsoft Timestamping Service, Microsoft Code Signing PCA, Microsoft Corporation	Optional
FileSHA256	The file SHA256.		Optional
Playbook Outputs

Path	Description	Type
VTFileVerdict	VirusTotal file verdict.	unknown
NSRLFileVerdict	NSRL file verdict.	unknown
VTFileSigners	VirusTotal file signers.	unknown
XDRFileSigners	XDR file signers.	unknown
WildFire.Report	WildFire report details.	unknown
WildFire.Verdicts	WildFire verdict.	unknown
Playbook Image

File Reputation
Inputs

DetectionThreshold — The minimum number of positive engines needed to mark file as malicious.
TrustedPublishers — A list of trusted publishers
FileSHA256 — The file SHA256.
Outputs

VTFileVerdict — VirusTotal file verdict.
NSRLFileVerdict — NSRL file verdict.
VTFileSigners — VirusTotal file signers.
XDRFileSigners — XDR file signers.
WildFire.Report — WildFire report details.
WildFire.Verdicts — WildFire verdict.
Commands used

file wildfire-get-verdict wildfire-report
Flowchart

Source

playbook-File_Reputation.yml
Download History Raw
id: File Reputation
version: -1
name: File Reputation
description: "This playbook checks the file reputation and sets the verdict as a new\
  \ context key.\n\nThe verdict is composed by 3 main components:\n\n* VirusTotal\
  \ detection rate\n* Digital certificate signers\n* NSRL DB\n\nNote: a user can provide\
  \ a list of trusted signers of his own using the playbook inputs\n "
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 0036bf78-bb71-4cc0-8147-c1dcb446f610
    type: start
    task:
      id: 0036bf78-bb71-4cc0-8147-c1dcb446f610
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
      - "4"
      - "18"
      - "25"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -700,
          "y": -600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 9a0d46f3-35a0-4022-833b-6e33cda9114b
    type: title
    task:
      id: 9a0d46f3-35a0-4022-833b-6e33cda9114b
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -700,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: d188fc98-26aa-4ad3-8c92-d603b765f6ec
    type: title
    task:
      id: d188fc98-26aa-4ad3-8c92-d603b765f6ec
      version: -1
      name: VirusTotal Reputation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -700,
          "y": -440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 20ddd027-f0d2-4ee8-864e-c90c9f8697bb
    type: regular
    task:
      id: 20ddd027-f0d2-4ee8-864e-c90c9f8697bb
      version: -1
      name: File enrichment
      description: Retrieve results for a file hash using WildFire.
      script: '|||file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      file:
        complex:
          root: inputs.FileSHA256
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -700,
          "y": -300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 728d695a-84e4-41a4-8de6-2e8b792c24ee
    type: title
    task:
      id: 728d695a-84e4-41a4-8de6-2e8b792c24ee
      version: -1
      name: NSRL
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 670,
          "y": -440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 58df7ac3-e6e9-4da5-88ec-3a6b8268872b
    type: condition
    task:
      id: 58df7ac3-e6e9-4da5-88ec-3a6b8268872b
      version: -1
      name: Check file detections
      description: "Check file detections."
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "17"
      Benign:
      - "14"
    separatecontext: false
    conditions:
    - label: Benign
      condition:
      - - operator: lessThan
          left:
            value:
              complex:
                root: VirusTotal.File.attributes.last_analysis_stats
                accessor: malicious
            iscontext: true
          right:
            value:
              complex:
                root: inputs.DetectionThreshold
            iscontext: true
    view: |-
      {
        "position": {
          "x": -250,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 657cdfbc-0d99-4fc1-8130-541ac61a46de
    type: regular
    task:
      id: 657cdfbc-0d99-4fc1-8130-541ac61a46de
      version: -1
      name: Check the file hash against NSRL DB
      description: Sends http request. Returns the response as json.
      scriptName: http
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      ignore-outputs:
        simple: "false"
      method:
        simple: GET
      saveAsFile:
        simple: test.txt
      url:
        simple: https://hashlookup.circl.lu/lookup/sha256/${inputs.FileSHA256}
    separatecontext: false
    continueonerror: true
    view: |-
      {
        "position": {
          "x": 670,
          "y": -300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 83169b11-c3c4-452c-8a9b-e8cbb65740ce
    type: regular
    task:
      id: 83169b11-c3c4-452c-8a9b-e8cbb65740ce
      version: -1
      name: Parse HTTP response body
      description: 'Parse a given JSON string "value" to a representative object.
        Example: ''{"a": "value"}'' => {"a": "value"}.'
      scriptName: ParseJSON
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      extend-context:
        simple: NSRLCheckResults=
      ignore-outputs:
        simple: "true"
      value:
        complex:
          root: HttpRequest.Response
          accessor: Body
          transformers:
          - operator: Stringify
    separatecontext: false
    continueonerror: true
    view: |-
      {
        "position": {
          "x": 670,
          "y": -120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 0daec705-f44f-4630-872a-ecfa3227ddab
    type: condition
    task:
      id: 0daec705-f44f-4630-872a-ecfa3227ddab
      version: -1
      name: Check NSRL search results
      description: "Check NSRL search results."
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "21"
      Found Results:
      - "13"
    separatecontext: false
    conditions:
    - label: Found Results
      condition:
      - - operator: isNotEqualString
          left:
            value:
              complex:
                root: NSRLCheckResults
                accessor: message
            iscontext: true
          right:
            value:
              simple: Non existing SHA-256
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: NSRLCheckResults
            iscontext: true
    view: |-
      {
        "position": {
          "x": 670,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: afa05da2-350f-4d09-85f1-7d9ddb31477c
    type: regular
    task:
      id: afa05da2-350f-4d09-85f1-7d9ddb31477c
      version: -1
      name: Set file verdict - IsNSRL
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: NSRLFileVerdict
      value:
        simple: IsNSRL
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 52efc87e-ca13-4c85-855d-83a4f04374b9
    type: regular
    task:
      id: 52efc87e-ca13-4c85-855d-83a4f04374b9
      version: -1
      name: Set file verdict - VT-Benign
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: VTFileVerdict
      value:
        simple: Benign
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -40,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: df8ccfaa-c452-4c35-837c-4e80a383b1d1
    type: condition
    task:
      id: df8ccfaa-c452-4c35-837c-4e80a383b1d1
      version: -1
      name: Check file signature
      description: "Check file signature."
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "22"
      Trusted Signers:
      - "16"
    separatecontext: false
    conditions:
    - label: Trusted Signers
      condition:
      - - operator: inList
          left:
            value:
              complex:
                root: VirusTotal.SearchResults.attributes.trusted_verdict
                accessor: organization
            iscontext: true
          right:
            value:
              complex:
                root: inputs.TrustedPublishers
            iscontext: true
          ignorecase: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: VirusTotal.SearchResults.attributes.trusted_verdict
                accessor: verdict
            iscontext: true
          right:
            value:
              simple: goodware
          ignorecase: true
    view: |-
      {
        "position": {
          "x": -1170,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: bc1bdba5-711c-417d-8e1b-beb3c358ea82
    type: regular
    task:
      id: bc1bdba5-711c-417d-8e1b-beb3c358ea82
      version: -1
      name: Set file verdict - VT-TrustedSigners
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: VTFileSigners
      value:
        simple: Trusted
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -960,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 7088e81b-b654-427a-83be-8f89bf00a1e2
    type: regular
    task:
      id: 7088e81b-b654-427a-83be-8f89bf00a1e2
      version: -1
      name: Set file verdict - VT-Malicious
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: VTFileVerdict
      value:
        simple: Malicious
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -460,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: d51edea1-e13a-4342-83a1-804f7e2df09e
    type: title
    task:
      id: d51edea1-e13a-4342-83a1-804f7e2df09e
      version: -1
      name: Cortex XDR
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2070,
          "y": -440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 96728cac-a5cf-41e5-8cde-43882c9dd70f
    type: condition
    task:
      id: 96728cac-a5cf-41e5-8cde-43882c9dd70f
      version: -1
      name: Check file signature
      description: "Check file signature."
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "23"
      Trusted Signers:
      - "20"
    separatecontext: false
    conditions:
    - label: Trusted Signers
      condition:
      - - operator: inList
          left:
            value:
              complex:
                root: PaloAltoNetworksXDR.Incident.alerts
                accessor: action_process_signature_vendor
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: ${PaloAltoNetworksXDR.Incident.alerts.os_actor_process_signature_vendor}
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: ${PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_vendor}
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: ${PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_vendor}
                      iscontext: true
            iscontext: true
          right:
            value:
              complex:
                root: inputs.TrustedPublishers
            iscontext: true
          ignorecase: true
        - operator: inList
          left:
            value:
              complex:
                root: alert
                accessor: processexecutionsigner
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: alert.osparentsigner
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: alert.initiatorsigner
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: alert.cgosigner
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: inputs.TrustedPublishers
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": -2070,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 7d95a4cb-4bf2-4ab5-8c7f-f3c97d5ea43f
    type: regular
    task:
      id: 7d95a4cb-4bf2-4ab5-8c7f-f3c97d5ea43f
      version: -1
      name: Set file verdict - XDR-TrustedSigners
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: XDRFileSigners
      value:
        simple: Trusted
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1860,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: bb096e6a-72b8-43f3-81a3-14633d6a58d3
    type: regular
    task:
      id: bb096e6a-72b8-43f3-81a3-14633d6a58d3
      version: -1
      name: Set file verdict - IsNotNSRL
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: NSRLFileVerdict
      value:
        simple: IsNotNSRL
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 880,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 02ee8e00-beda-4648-8360-5cfd3d0317db
    type: regular
    task:
      id: 02ee8e00-beda-4648-8360-5cfd3d0317db
      version: -1
      name: Set file verdict - VT-TrustedSigners
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: VTFileSigners
      value:
        simple: UnTrusted
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1380,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 9bc117b9-97ee-4aa4-81b5-e2ca1e5c9549
    type: regular
    task:
      id: 9bc117b9-97ee-4aa4-81b5-e2ca1e5c9549
      version: -1
      name: Set file verdict - XDR-UnTrustedSigners
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: XDRFileSigners
      value:
        simple: UnTrusted
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2280,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 5205d32a-2c3a-42ca-8586-04680de9bc5b
    type: condition
    task:
      id: 5205d32a-2c3a-42ca-8586-04680de9bc5b
      version: -1
      name: Check for VT results
      description: Checks whether there are results from VirusTotal.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "15"
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: VirusTotal
            iscontext: true
    view: |-
      {
        "position": {
          "x": -700,
          "y": -120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 825810e7-b8fb-4347-894b-51dae87fcb7f
    type: title
    task:
      id: 825810e7-b8fb-4347-894b-51dae87fcb7f
      version: -1
      name: WildFire
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
      - "28"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2950,
          "y": -440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 7bcc68bb-ba26-4690-8535-395ec5fbb28f
    type: regular
    task:
      id: 7bcc68bb-ba26-4690-8535-395ec5fbb28f
      version: -1
      name: Get WildFire report
      description: Retrieves results for a file hash using WildFire.
      script: '|||wildfire-report'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      sha256:
        complex:
          root: inputs.FileSHA256
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2730,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: e91fa96b-14ce-40a2-8ba6-2607ee95ea47
    type: regular
    task:
      id: e91fa96b-14ce-40a2-8ba6-2607ee95ea47
      version: -1
      name: Get WildFire verdict
      description: Returns a verdict for a hash.
      script: '|||wildfire-get-verdict'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      hash:
        complex:
          root: inputs.FileSHA256
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3170,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "12_13_Found Results": 0.64,
      "12_21_#default#": 0.84,
      "15_16_Trusted Signers": 0.64,
      "15_22_#default#": 0.8,
      "19_20_Trusted Signers": 0.66,
      "19_23_#default#": 0.81,
      "8_14_Benign": 0.78,
      "8_17_#default#": 0.8
    },
    "paper": {
      "dimensions": {
        "height": 1195,
        "width": 4430,
        "x": -3170,
        "y": -600
      }
    }
  }
inputs:
- key: DetectionThreshold
  value:
    simple: "5"
  required: false
  description: The minimum number of positive engines needed to mark file as malicious.
  playbookInputQuery:
- key: TrustedPublishers
  value:
    simple: |-
      Microsoft Root Authority,Microsoft Timestamping Service,
      Microsoft Code Signing PCA, Microsoft Corporation
  required: false
  description: A list of trusted publishers
  playbookInputQuery:
- key: FileSHA256
  value: {}
  required: false
  description: The file SHA256.
  playbookInputQuery:
outputs:
- contextPath: VTFileVerdict
  description: VirusTotal file verdict.
  type: unknown
- contextPath: NSRLFileVerdict
  description: NSRL file verdict.
  type: unknown
- contextPath: VTFileSigners
  description: VirusTotal file signers.
  type: unknown
- contextPath: XDRFileSigners
  description: XDR file signers.
  type: unknown
- contextPath: WildFire.Report
  description: WildFire report details.
  type: unknown
- contextPath: WildFire.Verdicts
  description: WildFire verdict.
  type: unknown
tests:
- No tests.
fromversion: 6.6.0
marketplaces:
- marketplacev2
- platform