Intezer - Analyze File and URL

Analyze Files and URLs on Intezer Analyze

Intezer · 8 tasks · 4 inputs · 10 outputs

Details

IDIntezer - Analyze File and URL
From Version6.5.0
Tasks8
TagsPhishing Malware

README

Analyze Files and URLs on Intezer Analyze.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling
  • Calculate Severity - Generic v2

Integrations

  • Intezer v2

Scripts

This playbook does not use any scripts.

Commands

  • intezer-analyze-by-file
  • intezer-analyze-url
  • intezer-get-latest-report

Playbook Inputs

Name Description Default Value Source Required
File A file object that represents an email attachment.   Context Optional
URL The URL object.   Context Optional
Interval How often the polling command should run (in minutes). 1 - Required
Timeout The amount of time to wait before a timeout occurs (in minutes). 15 - Required

Playbook Outputs

Path Description Type
File.Malicious.Vendor For malicious files, the vendor that made the decision string
File.Metadata Metadata returned from Intezer analysis (analysis id, analysis url, family, family type, sha256, verdict, sub_verdict). Metadata will be returned only for supported files. unknown
File.ExistsInIntezer Does the file exists on intezer genome database boolean
URL.Malicious.Vendor For malicious Url, the vendor that made the decision string
URL.Metadata Metadata returned from Intezer analysis unknown
URL.ExistsInIntezer Does the url exists on intezer boolean
DBotScore The DBotScore object. unknown
DBotScore.Indicator The indicator that was tested. string
DBotScore.Type The indicator type. string
DBotScore.Vendor The vendor used to calculate the score. string
DBotScore.Score The actual score. number

Playbook Image

Intezer_Analyze_File_and_URL

Inputs

  • Interval — How often the polling command should run (in minutes).
  • Timeout — Amount of time to wait before a timeout occurs (in minutes).
  • File —
  • URL —

Outputs

  • URL.Data — The submitted Url
  • URL.Malicious.Vendor — For malicious Url, the vendor that made the decision
  • URL.Metadata — Metadata returned from Intezer analysis.
  • URL.ExistsInIntezer — Does the url exists on Intezer
  • DBotScore — The DBotScore object.
  • DBotScore.Indicator — The indicator that was tested.
  • DBotScore.Type — The indicator type.
  • DBotScore.Vendor — Vendor used to calculate the score.
  • DBotScore.Score — The actual score.
  • File — File Context.

Commands used

intezer-analyze-by-file intezer-analyze-url intezer-get-latest-report

Flowchart

yes yes yes Start Start Intezer - Analyze URL - intezer-analyze-url Intezer - Analyze URL intezer-analyze-url Is there a url to analyze? Is there a url to analyze? Is there a file to analyze? Is there a file to analyze? Intezer - Analyze attachment - intezer-analyze-by-file Intezer - Analyze attachment intezer-analyze-by-file Get File Analysis - intezer-get-latest-report Get File Analysis intezer-get-latest-report Check If the Analysis exists Check If the Analysis exists Done Done

Source

playbook-Intezer_-_Analyze_File_and_URL.yml
Download History Raw 
id: Intezer - Analyze File and URL
version: -1
fromversion: 6.5.0
name: Intezer - Analyze File and URL
description: Analyze Files and URLs on Intezer Analyze
tags:
- Phishing
- Malware
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 05110b05-c809-4429-86a5-921ba0de27b8
    type: start
    task:
      id: 05110b05-c809-4429-86a5-921ba0de27b8
      version: -1
      name: ""
      description: start
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 160,
          "y": -50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "13":
    id: "13"
    taskid: b5a2677b-25b2-4a8f-8ca2-7fdf75e33219
    type: regular
    task:
      id: b5a2677b-25b2-4a8f-8ca2-7fdf75e33219
      version: -1
      name: Intezer - Analyze URL
      description: Checks reputation of an Url
      script: Intezer v2|||intezer-analyze-url
      type: regular
      iscommand: true
      brand: Intezer v2
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      url:
        simple: ${inputs.URL.Data}
      interval:
        complex:
          root: inputs.Interval
          transformers:
          - operator: multiply
            args:
              by:
                value:
                  simple: "60"
      timeout:
        complex:
          root: inputs.Timeout
          transformers:
          - operator: multiply
            args:
              by:
                value:
                  simple: "60"
      wait_for_result:
        simple: "true"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 420,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "14":
    id: "14"
    taskid: 377bf6c2-e9ae-4b02-86cf-450cd1cdcf90
    type: condition
    task:
      id: 377bf6c2-e9ae-4b02-86cf-450cd1cdcf90
      version: -1
      name: Is there a url to analyze?
      description: Checks if there is a url to analyze.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: ${inputs.URL
                accessor: Data}
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 410,
          "y": 330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "18":
    id: "18"
    taskid: 536757a7-2039-4733-8eec-3184fe8e261c
    type: condition
    task:
      id: 536757a7-2039-4733-8eec-3184fe8e261c
      version: -1
      name: Is there a file to analyze?
      description: Check if the file exists in Intezer genome database
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "23"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.File
                filters:
                - - operator: isNotEmpty
                    left:
                      value:
                        simple: inputs.File.EntryID
                      iscontext: true
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": -80,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "19":
    id: "19"
    taskid: 03a3628d-957e-4fc1-8e01-218c1a5a20e2
    type: regular
    task:
      id: 03a3628d-957e-4fc1-8e01-218c1a5a20e2
      version: -1
      name: Intezer - Analyze attachment
      description: Checks file reputation for uploaded file (up to 150MB)
      script: Intezer v2|||intezer-analyze-by-file
      type: regular
      iscommand: true
      brand: Intezer v2
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      file_entry_id:
        simple: ${inputs.File.EntryID}
      interval:
        complex:
          root: inputs.Interval
          transformers:
          - operator: multiply
            args:
              by:
                value:
                  simple: "60"
      timeout:
        complex:
          root: inputs.Timeout
          transformers:
          - operator: multiply
            args:
              by:
                value:
                  simple: "60"
      wait_for_result:
        simple: "true"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -80,
          "y": 1230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "23":
    id: "23"
    taskid: d3361114-69db-4e36-88cc-0e7e764cbd4c
    type: regular
    task:
      id: d3361114-69db-4e36-88cc-0e7e764cbd4c
      version: -1
      name: Get File Analysis
      description: Checks file reputation of the given hash, supports SHA256, SHA1 and MD5 by looking at the latest available report
      script: Intezer v2|||intezer-get-latest-report
      type: regular
      iscommand: true
      brand: Intezer v2
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      file_hash:
        simple: ${inputs.File.SHA256}
      raise_exception_if_latest_not_found:
        simple: "false"
    separatecontext: false
    continueonerror: true
    view: |-
      {
        "position": {
          "x": -80,
          "y": 680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: errorPath
  "24":
    id: "24"
    taskid: eb7e3ca2-fd0c-406c-8fd6-c1658f80f7a6
    type: condition
    task:
      id: eb7e3ca2-fd0c-406c-8fd6-c1658f80f7a6
      version: -1
      name: Check If the Analysis exists
      description: Check if the analysis exists in Intezer genome database
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "19"
      "yes":
      - "26"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isTrue
          left:
            value:
              simple: File.ExistsInIntezer
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": -80,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "26":
    id: "26"
    taskid: a4f52bed-6b29-48aa-86e0-0985cb03ce4b
    type: title
    task:
      id: a4f52bed-6b29-48aa-86e0-0985cb03ce4b
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 200,
          "y": 1470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
view: |-
  {
    "linkLabelsPosition": {
      "18_26_#default#": 0.9
    },
    "paper": {
      "dimensions": {
        "height": 1585,
        "width": 880,
        "x": -80,
        "y": -50
      }
    }
  }
inputs:
- key: Interval
  value:
    simple: "1"
  required: true
  description: How often the polling command should run (in minutes).
  playbookInputQuery:
- key: Timeout
  value:
    simple: "15"
  required: true
  description: Amount of time to wait before a timeout occurs  (in minutes).
  playbookInputQuery:
- key: File
  value:
    simple: ${File}
  required: false
  description: ""
  playbookInputQuery:
- key: URL
  value:
    simple: ${URL}
  required: false
  description: ""
  playbookInputQuery:
outputs:
- contextPath: URL.Data
  description: The submitted Url
  type: string
- contextPath: URL.Malicious.Vendor
  description: For malicious Url, the vendor that made the decision
  type: string
- contextPath: URL.Metadata
  description: Metadata returned from Intezer analysis.
  type: Unknown
- contextPath: URL.ExistsInIntezer
  description: Does the url exists on Intezer
  type: Boolean
- contextPath: DBotScore
  description: The DBotScore object.
  type: unknown
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
  type: string
- contextPath: DBotScore.Type
  description: The indicator type.
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score.
  type: string
- contextPath: DBotScore.Score
  description: The actual score.
  type: number
- contextPath: File
  description: File Context.
  type: unknown
tests:
- No tests (auto formatted)