Recorded Future File Intelligence

File enrichment using Recorded Future intelligence

Recorded Future Intelligence · 11 tasks · 3 inputs · 93 outputs

Details

IDRecorded Future File Intelligence
From Version5.0.0
Tasks11

README

File Enrichment using Recorded Future Intelligence

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts. Depends on the recorded futures indicator field; risk rules.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • Recorded Future v2

Scripts

This playbook does not use any scripts.

Commands

  • recordedfuture-intelligence

Playbook Inputs

Name Description Default Value Required
MD5 File MD5 hash to enrich. File.MD5 Optional
SHA256 File SHA-256 hash to enrich. File.SHA256 Optional
SHA1 File SHA-1 hash to enrich. File.SHA1 Optional

Playbook Outputs

Path Description Type
DBotScore.Indicator The indicator that was tested string
DBotScore.Type Indicator type string
DBotScore.Vendor Vendor used to calculate the score string
DBotScore.Score The actual score number
File.SHA256 File SHA-256 string
File.SHA512 File SHA-512 string
File.SHA1 File SHA-1 string
File.MD5 File MD5 string
File.CRC32 File CRC32 string
File.CTPH File CTPH string
RecordedFuture.File.criticality Risk Criticality number
RecordedFuture.File.criticalityLabel Risk Criticality Label string
RecordedFuture.File.riskString Risk String string
RecordedFuture.File.riskSummary Risk Summary string
RecordedFuture.File.rules Risk Rules string
RecordedFuture.File.score Risk Score number
RecordedFuture.File.firstSeen Evidence First Seen date
RecordedFuture.File.lastSeen Evidence Last Seen date
RecordedFuture.File.intelCard Recorded Future Intelligence Card URL string
RecordedFuture.File.hashAlgorithm Hash Algorithm string
RecordedFuture.File.type Entity Type string
RecordedFuture.File.name Entity string
RecordedFuture.File.id Recorded Future Entity ID string
RecordedFuture.File.metrics.type Recorded Future Metrics Type string
RecordedFuture.File.metrics.value Recorded Future Metrics Value number
RecordedFuture.File.threatLists.description Recorded Future Threat List Description string
RecordedFuture.File.threatLists.id Recorded Future Threat List ID string
RecordedFuture.File.threatLists.name Recorded Future Threat List Name string
RecordedFuture.File.threatLists.type Recorded Future Threat List Type string
RecordedFuture.File.relatedEntities.RelatedAttacker.count Recorded Future Related Count number
RecordedFuture.File.relatedEntities.RelatedAttacker.id Recorded Future Related ID string
RecordedFuture.File.relatedEntities.RelatedAttacker.name Recorded Future Related Name string
RecordedFuture.File.relatedEntities.RelatedAttacker.type Recorded Future Related Type string
RecordedFuture.File.relatedEntities.RelatedTarget.count Recorded Future Related Count number
RecordedFuture.File.relatedEntities.RelatedTarget.id Recorded Future Related ID string
RecordedFuture.File.relatedEntities.RelatedTarget.name Recorded Future Related Name string
RecordedFuture.File.relatedEntities.RelatedTarget.type Recorded Future Related Type string
RecordedFuture.File.relatedEntities.RelatedThreatActor.count Recorded Future Related Count number
RecordedFuture.File.relatedEntities.RelatedThreatActor.id Recorded Future Related ID string
RecordedFuture.File.relatedEntities.RelatedThreatActor.name Recorded Future Related Name string
RecordedFuture.File.relatedEntities.RelatedThreatActor.type Recorded Future Related Type string
RecordedFuture.File.relatedEntities.RelatedMalware.count Recorded Future Related Count number
RecordedFuture.File.relatedEntities.RelatedMalware.id Recorded Future Related ID string
RecordedFuture.File.relatedEntities.RelatedMalware.name Recorded Future Related Name string
RecordedFuture.File.relatedEntities.RelatedMalware.type Recorded Future Related Type string
RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.count Recorded Future Related Count number
RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.id Recorded Future Related ID string
RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.name Recorded Future Related Name string
RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.type Recorded Future Related Type string
RecordedFuture.File.relatedEntities.RelatedIpAddress.count Recorded Future Related Count number
RecordedFuture.File.relatedEntities.RelatedIpAddress.id Recorded Future Related ID string
RecordedFuture.File.relatedEntities.RelatedIpAddress.name Recorded Future Related Name string
RecordedFuture.File.relatedEntities.RelatedIpAddress.type Recorded Future Related Type string
RecordedFuture.File.relatedEntities.RelatedInternetDomainName.count Recorded Future Related Count number
RecordedFuture.File.relatedEntities.RelatedInternetDomainName.id Recorded Future Related ID string
RecordedFuture.File.relatedEntities.RelatedInternetDomainName.name Recorded Future Related Name string
RecordedFuture.File.relatedEntities.RelatedInternetDomainName.type Recorded Future Related Type string
RecordedFuture.File.relatedEntities.RelatedProduct.count Recorded Future Related Count number
RecordedFuture.File.relatedEntities.RelatedProduct.id Recorded Future Related ID string
RecordedFuture.File.relatedEntities.RelatedProduct.name Recorded Future Related Name string
RecordedFuture.File.relatedEntities.RelatedProduct.type Recorded Future Related Type string
RecordedFuture.File.relatedEntities.RelatedCountries.count Recorded Future Related Count number
RecordedFuture.File.relatedEntities.RelatedCountries.id Recorded Future Related ID string
RecordedFuture.File.relatedEntities.RelatedCountries.name Recorded Future Related Name string
RecordedFuture.File.relatedEntities.RelatedCountries.type Recorded Future Related Type string
RecordedFuture.File.relatedEntities.RelatedHash.count Recorded Future Related Count number
RecordedFuture.File.relatedEntities.RelatedHash.id Recorded Future Related ID string
RecordedFuture.File.relatedEntities.RelatedHash.name Recorded Future Related Name string
RecordedFuture.File.relatedEntities.RelatedHash.type Recorded Future Related Type string
RecordedFuture.File.relatedEntities.RelatedTechnology.count Recorded Future Related Count number
RecordedFuture.File.relatedEntities.RelatedTechnology.id Recorded Future Related ID string
RecordedFuture.File.relatedEntities.RelatedTechnology.name Recorded Future Related Name string
RecordedFuture.File.relatedEntities.RelatedTechnology.type Recorded Future Related Type string
RecordedFuture.File.relatedEntities.RelatedEmailAddress.count Recorded Future Related Count number
RecordedFuture.File.relatedEntities.RelatedEmailAddress.id Recorded Future Related ID string
RecordedFuture.File.relatedEntities.RelatedEmailAddress.name Recorded Future Related Name string
RecordedFuture.File.relatedEntities.RelatedEmailAddress.type Recorded Future Related Type string
RecordedFuture.File.relatedEntities.RelatedAttackVector.count Recorded Future Related Count number
RecordedFuture.File.relatedEntities.RelatedAttackVector.id Recorded Future Related ID string
RecordedFuture.File.relatedEntities.RelatedAttackVector.name Recorded Future Related Name string
RecordedFuture.File.relatedEntities.RelatedAttackVector.type Recorded Future Related Type string
RecordedFuture.File.relatedEntities.RelatedMalwareCategory.count Recorded Future Related Count number
RecordedFuture.File.relatedEntities.RelatedMalwareCategory.id Recorded Future Related ID string
RecordedFuture.File.relatedEntities.RelatedMalwareCategory.name Recorded Future Related Name string
RecordedFuture.File.relatedEntities.RelatedMalwareCategory.type Recorded Future Related Type string
RecordedFuture.File.relatedEntities.RelatedOperations.count Recorded Future Related Count number
RecordedFuture.File.relatedEntities.RelatedOperations.id Recorded Future Related ID string
RecordedFuture.File.relatedEntities.RelatedOperations.name Recorded Future Related Name string
RecordedFuture.File.relatedEntities.RelatedOperations.type Recorded Future Related Type string
RecordedFuture.File.relatedEntities.RelatedCompany.count Recorded Future Related Count number
RecordedFuture.File.relatedEntities.RelatedCompany.id Recorded Future Related ID string
RecordedFuture.File.relatedEntities.RelatedCompany.name Recorded Future Related Name string
RecordedFuture.File.relatedEntities.RelatedCompany.type Recorded Future Related Type string

Playbook Image

Recorded Future File Intelligence

Inputs

  • MD5 — File MD5 hash to enrich.
  • SHA256 — File SHA-256 hash to enrich.
  • SHA1 — File SHA-1 hash to enrich.

Outputs

  • DBotScore.Indicator — The indicator that was tested
  • DBotScore.Type — Indicator type
  • DBotScore.Vendor — Vendor used to calculate the score
  • DBotScore.Score — The actual score
  • File.SHA256 — File SHA-256
  • File.SHA512 — File SHA-512
  • File.SHA1 — File SHA-1
  • File.MD5 — File MD5
  • File.CRC32 — File CRC32
  • File.CTPH — File CTPH
  • RecordedFuture.File.criticality — Risk Criticality
  • RecordedFuture.File.criticalityLabel — Risk Criticality Label
  • RecordedFuture.File.riskString — Risk String
  • RecordedFuture.File.riskSummary — Risk Summary
  • RecordedFuture.File.rules — Risk Rules
  • RecordedFuture.File.score — Risk Score
  • RecordedFuture.File.firstSeen — Evidence First Seen
  • RecordedFuture.File.lastSeen — Evidence Last Seen
  • RecordedFuture.File.intelCard — Recorded Future Intelligence Card URL
  • RecordedFuture.File.hashAlgorithm — Hash Algorithm
  • RecordedFuture.File.type — Entity Type
  • RecordedFuture.File.name — Entity
  • RecordedFuture.File.id — Recorded Future Entity ID
  • RecordedFuture.File.metrics.type — Recorded Future Metrics Type
  • RecordedFuture.File.metrics.value — Recorded Future Metrics Value
  • RecordedFuture.File.threatLists.description — Recorded Future Threat List Description
  • RecordedFuture.File.threatLists.id — Recorded Future Threat List ID
  • RecordedFuture.File.threatLists.name — Recorded Future Threat List Name
  • RecordedFuture.File.threatLists.type — Recorded Future Threat List Type
  • RecordedFuture.File.relatedEntities.RelatedAttacker.count — Recorded Future Related Attacker Count
  • RecordedFuture.File.relatedEntities.RelatedAttacker.id — Recorded Future Related Attacker ID
  • RecordedFuture.File.relatedEntities.RelatedAttacker.name — Recorded Future Related Attacker Name
  • RecordedFuture.File.relatedEntities.RelatedAttacker.type — Recorded Future Related Attacker Type
  • RecordedFuture.File.relatedEntities.RelatedTarget.count — Recorded Future Related Target Count
  • RecordedFuture.File.relatedEntities.RelatedTarget.id — Recorded Future Related Target ID
  • RecordedFuture.File.relatedEntities.RelatedTarget.name — Recorded Future Related Target Name
  • RecordedFuture.File.relatedEntities.RelatedTarget.type — Recorded Future Related Target Type
  • RecordedFuture.File.relatedEntities.RelatedThreatActor.count — Recorded Future Related Threat Actor Count
  • RecordedFuture.File.relatedEntities.RelatedThreatActor.id — Recorded Future Related Threat Actor ID
  • RecordedFuture.File.relatedEntities.RelatedThreatActor.name — Recorded Future Related Threat Actor Name
  • RecordedFuture.File.relatedEntities.RelatedThreatActor.type — Recorded Future Related Threat Actor Type
  • RecordedFuture.File.relatedEntities.RelatedMalware.count — Recorded Future Related Malware Count
  • RecordedFuture.File.relatedEntities.RelatedMalware.id — Recorded Future Related Malware ID
  • RecordedFuture.File.relatedEntities.RelatedMalware.name — Recorded Future Related Malware Name
  • RecordedFuture.File.relatedEntities.RelatedMalware.type — Recorded Future Related Malware Type
  • RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.count — Recorded Future Related Vulnerability Count
  • RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.id — Recorded Future Related Vulnerability ID
  • RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.name — Recorded Future Related Vulnerability Name
  • RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.type — Recorded Future Related Vulnerability Type
  • RecordedFuture.File.relatedEntities.RelatedIpAddress.count — Recorded Future Related IP Address Count
  • RecordedFuture.File.relatedEntities.RelatedIpAddress.id — Recorded Future Related IP Address ID
  • RecordedFuture.File.relatedEntities.RelatedIpAddress.name — Recorded Future Related IP Address Name
  • RecordedFuture.File.relatedEntities.RelatedIpAddress.type — Recorded Future Related IP Address Type
  • RecordedFuture.File.relatedEntities.RelatedInternetDomainName.count — Recorded Future Related Domain Name Count
  • RecordedFuture.File.relatedEntities.RelatedInternetDomainName.id — Recorded Future Related Domain Name ID
  • RecordedFuture.File.relatedEntities.RelatedInternetDomainName.name — Recorded Future Related Domain Name Name
  • RecordedFuture.File.relatedEntities.RelatedInternetDomainName.type — Recorded Future Related Domain Name Type
  • RecordedFuture.File.relatedEntities.RelatedProduct.count — Recorded Future Related Product Count
  • RecordedFuture.File.relatedEntities.RelatedProduct.id — Recorded Future Related Product ID
  • RecordedFuture.File.relatedEntities.RelatedProduct.name — Recorded Future Related Product Name
  • RecordedFuture.File.relatedEntities.RelatedProduct.type — Recorded Future Related Product Type
  • RecordedFuture.File.relatedEntities.RelatedCountries.count — Recorded Future Related Countries Count
  • RecordedFuture.File.relatedEntities.RelatedCountries.id — Recorded Future Related Countries IDs
  • RecordedFuture.File.relatedEntities.RelatedCountries.name — Recorded Future Related Countries Names
  • RecordedFuture.File.relatedEntities.RelatedCountries.type — Recorded Future Related Countries Type
  • RecordedFuture.File.relatedEntities.RelatedHash.count — Recorded Future Related Hash Count
  • RecordedFuture.File.relatedEntities.RelatedHash.id — Recorded Future Related Hash ID
  • RecordedFuture.File.relatedEntities.RelatedHash.name — Recorded Future Related Hash Name
  • RecordedFuture.File.relatedEntities.RelatedHash.type — Recorded Future Related Hash Type
  • RecordedFuture.File.relatedEntities.RelatedTechnology.count — Recorded Future Related Technology Count
  • RecordedFuture.File.relatedEntities.RelatedTechnology.id — Recorded Future Related Technology ID
  • RecordedFuture.File.relatedEntities.RelatedTechnology.name — Recorded Future Related Technology Name
  • RecordedFuture.File.relatedEntities.RelatedTechnology.type — Recorded Future Related Technology Type
  • RecordedFuture.File.relatedEntities.RelatedEmailAddress.count — Recorded Future Related Email Address Count
  • RecordedFuture.File.relatedEntities.RelatedEmailAddress.id — Recorded Future Related Email Address ID
  • RecordedFuture.File.relatedEntities.RelatedEmailAddress.name — Recorded Future Related Email Address Name
  • RecordedFuture.File.relatedEntities.RelatedEmailAddress.type — Recorded Future Related Email Address Type
  • RecordedFuture.File.relatedEntities.RelatedAttackVector.count — Recorded Future Related Attack Vector Count
  • RecordedFuture.File.relatedEntities.RelatedAttackVector.id — Recorded Future Related Attack Vector ID
  • RecordedFuture.File.relatedEntities.RelatedAttackVector.name — Recorded Future Related Attack Vector Name
  • RecordedFuture.File.relatedEntities.RelatedAttackVector.type — Recorded Future Related Attack Vector Type
  • RecordedFuture.File.relatedEntities.RelatedMalwareCategory.count — Recorded Future Related Malware Category Count
  • RecordedFuture.File.relatedEntities.RelatedMalwareCategory.id — Recorded Future Related Malware Category ID
  • RecordedFuture.File.relatedEntities.RelatedMalwareCategory.name — Recorded Future Related Malware Category Name
  • RecordedFuture.File.relatedEntities.RelatedMalwareCategory.type — Recorded Future Related Malware Category Type
  • RecordedFuture.File.relatedEntities.RelatedOperations.count — Recorded Future Related Operations Count
  • RecordedFuture.File.relatedEntities.RelatedOperations.id — Recorded Future Related Operations ID
  • RecordedFuture.File.relatedEntities.RelatedOperations.name — Recorded Future Related Operations Name
  • RecordedFuture.File.relatedEntities.RelatedOperations.type — Recorded Future Related Operations Type
  • RecordedFuture.File.relatedEntities.RelatedCompany.count — Recorded Future Related Company Count
  • RecordedFuture.File.relatedEntities.RelatedCompany.id — Recorded Future Related Company ID
  • RecordedFuture.File.relatedEntities.RelatedCompany.name — Recorded Future Related Company Name
  • RecordedFuture.File.relatedEntities.RelatedCompany.type — Recorded Future Related Company Type

Commands used

recordedfuture-intelligence setIndicator

Flowchart

yes yes yes yes Start Start Enrich Using Recorded Future API Enrich Using Recorded Fut... Get MD5 reputation - recordedfuture-intelligence Get MD5 reputation recordedfuture-intelligence Done Done Is there an MD5 hash? Is there an MD5 hash? Is there a SHA-256 hash? Is there a SHA-256 hash? Get SHA-256 reputation - recordedfuture-intelligence Get SHA-256 reputation recordedfuture-intelligence Is there a SHA-1 hash? Is there a SHA-1 hash? Get SHA-1 reputation - recordedfuture-intelligence Get SHA-1 reputation recordedfuture-intelligence Is Recorded Future API enabled? Is Recorded Future API en... setIndicator - setIndicator setIndicator setIndicator

Source

playbook-Recorded_Future_File_Intelligence.yml
Download History Raw 
id: Recorded Future File Intelligence
version: -1
name: Recorded Future File Intelligence
description: File enrichment using Recorded Future intelligence
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 588280ab-3d96-4e42-894a-5ce668f93975
    type: start
    task:
      id: 588280ab-3d96-4e42-894a-5ce668f93975
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": -120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 0785a415-4790-411f-81cb-50c1af4d824a
    type: title
    task:
      id: 0785a415-4790-411f-81cb-50c1af4d824a
      version: -1
      name: Enrich Using Recorded Future API
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
      - "15"
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 46717e9e-cbd6-4608-89f1-f9063ba12d18
    type: regular
    task:
      id: 46717e9e-cbd6-4608-89f1-f9063ba12d18
      version: -1
      name: Get MD5 reputation
      description: Get threat intelligence for an IP, domain, CVE, URL or file.
      script: Recorded Future v2|||recordedfuture-intelligence
      type: regular
      iscommand: true
      brand: Recorded Future v2
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      entity:
        simple: ${inputs.MD5}
      entity_type:
        simple: file
      fetch_related_entities:
        simple: "yes"
      fetch_riskyCIDRips:
        simple: "no"
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 655
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 1f693d22-0d30-4759-8569-b52781f139d2
    type: title
    task:
      id: 1f693d22-0d30-4759-8569-b52781f139d2
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1620,
          "y": 1060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: 1dce6482-686c-46ab-8d86-b3ca0591f4b5
    type: condition
    task:
      id: 1dce6482-686c-46ab-8d86-b3ca0591f4b5
      version: -1
      name: Is there an MD5 hash?
      description: Check if there is an MD5 hash in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "5"
    scriptarguments:
      value:
        simple: ${File.MD5}
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.MD5
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: 52e94cf9-0a92-473c-8eca-2435eeee8433
    type: condition
    task:
      id: 52e94cf9-0a92-473c-8eca-2435eeee8433
      version: -1
      name: Is there a SHA-256 hash?
      description: Check if there is a SHA-256 hash in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "16"
    scriptarguments:
      value:
        simple: ${File.SHA256}
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 500,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: b962d2d8-b0bb-4f67-808e-22b37331dd63
    type: regular
    task:
      id: b962d2d8-b0bb-4f67-808e-22b37331dd63
      version: -1
      name: Get SHA-256 reputation
      description: Get threat intelligence for an IP, domain, CVE, URL or file.
      script: Recorded Future v2|||recordedfuture-intelligence
      type: regular
      iscommand: true
      brand: Recorded Future v2
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      entity:
        simple: ${inputs.SHA256}
      entity_type:
        simple: file
      fetch_related_entities:
        simple: "yes"
      fetch_riskyCIDRips:
        simple: "no"
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 665
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: 8aeac1b0-572f-49f2-831a-668e505524d8
    type: condition
    task:
      id: 8aeac1b0-572f-49f2-831a-668e505524d8
      version: -1
      name: Is there a SHA-1 hash?
      description: Check if there is a SHA-1 hash in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "18"
    scriptarguments:
      value:
        simple: ${File.SHA256}
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.SHA1
            iscontext: true
    view: |-
      {
        "position": {
          "x": 950,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: 24a11895-e064-426b-8d92-844ea6142077
    type: regular
    task:
      id: 24a11895-e064-426b-8d92-844ea6142077
      version: -1
      name: Get SHA-1 reputation
      description: Get threat intelligence for an IP, domain, CVE, URL or file.
      script: Recorded Future v2|||recordedfuture-intelligence
      type: regular
      iscommand: true
      brand: Recorded Future v2
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      entity:
        simple: ${inputs.SHA1}
      entity_type:
        simple: file
      fetch_related_entities:
        simple: "yes"
      fetch_riskyCIDRips:
        simple: "no"
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 962.5,
          "y": 665
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: e5527ed7-a775-4874-805f-9ac4403fda47
    type: condition
    task:
      id: e5527ed7-a775-4874-805f-9ac4403fda47
      version: -1
      name: Is Recorded Future API enabled?
      description: Check if a given value is true. Will return 'no' otherwise
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Recorded Future v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 500,
          "y": 10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: a8b74507-3494-49e8-8154-23d55650d716
    type: regular
    task:
      id: a8b74507-3494-49e8-8154-23d55650d716
      version: -1
      name: setIndicator
      description: Change the properties of an indicator
      script: Builtin|||setIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      recordedfutureriskrules:
        simple: ${RecordedFuture.File.concatRules}
      value:
        simple: ${RecordedFuture.File.name}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "14_7_#default#": 0.52,
      "15_7_#default#": 0.61
    },
    "paper": {
      "dimensions": {
        "height": 1245,
        "width": 1950,
        "x": 50,
        "y": -120
      }
    }
  }
inputs:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: File MD5 hash to enrich.
  playbookInputQuery:
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
  required: false
  description: File SHA-256 hash to enrich.
  playbookInputQuery:
- key: SHA1
  value:
    complex:
      root: File
      accessor: SHA1
  required: false
  description: File SHA-1 hash to enrich.
  playbookInputQuery:
outputs:
- contextPath: DBotScore.Indicator
  description: The indicator that was tested
  type: string
- contextPath: DBotScore.Type
  description: Indicator type
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score
  type: string
- contextPath: DBotScore.Score
  description: The actual score
  type: number
- contextPath: File.SHA256
  description: File SHA-256
  type: string
- contextPath: File.SHA512
  description: File SHA-512
  type: string
- contextPath: File.SHA1
  description: File SHA-1
  type: string
- contextPath: File.MD5
  description: File MD5
  type: string
- contextPath: File.CRC32
  description: File CRC32
  type: string
- contextPath: File.CTPH
  description: File CTPH
  type: string
- contextPath: RecordedFuture.File.criticality
  description: Risk Criticality
  type: number
- contextPath: RecordedFuture.File.criticalityLabel
  description: Risk Criticality Label
  type: string
- contextPath: RecordedFuture.File.riskString
  description: Risk String
  type: string
- contextPath: RecordedFuture.File.riskSummary
  description: Risk Summary
  type: string
- contextPath: RecordedFuture.File.rules
  description: Risk Rules
  type: string
- contextPath: RecordedFuture.File.score
  description: Risk Score
  type: number
- contextPath: RecordedFuture.File.firstSeen
  description: Evidence First Seen
  type: date
- contextPath: RecordedFuture.File.lastSeen
  description: Evidence Last Seen
  type: date
- contextPath: RecordedFuture.File.intelCard
  description: Recorded Future Intelligence Card URL
  type: string
- contextPath: RecordedFuture.File.hashAlgorithm
  description: Hash Algorithm
  type: string
- contextPath: RecordedFuture.File.type
  description: Entity Type
  type: string
- contextPath: RecordedFuture.File.name
  description: Entity
  type: string
- contextPath: RecordedFuture.File.id
  description: Recorded Future Entity ID
  type: string
- contextPath: RecordedFuture.File.metrics.type
  description: Recorded Future Metrics Type
  type: string
- contextPath: RecordedFuture.File.metrics.value
  description: Recorded Future Metrics Value
  type: number
- contextPath: RecordedFuture.File.threatLists.description
  description: Recorded Future Threat List Description
  type: string
- contextPath: RecordedFuture.File.threatLists.id
  description: Recorded Future Threat List ID
  type: string
- contextPath: RecordedFuture.File.threatLists.name
  description: Recorded Future Threat List Name
  type: string
- contextPath: RecordedFuture.File.threatLists.type
  description: Recorded Future Threat List Type
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedAttacker.count
  description: Recorded Future Related Attacker Count
  type: number
- contextPath: RecordedFuture.File.relatedEntities.RelatedAttacker.id
  description: Recorded Future Related Attacker ID
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedAttacker.name
  description: Recorded Future Related Attacker Name
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedAttacker.type
  description: Recorded Future Related Attacker Type
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedTarget.count
  description: Recorded Future Related Target Count
  type: number
- contextPath: RecordedFuture.File.relatedEntities.RelatedTarget.id
  description: Recorded Future Related Target ID
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedTarget.name
  description: Recorded Future Related Target Name
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedTarget.type
  description: Recorded Future Related Target Type
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedThreatActor.count
  description: Recorded Future Related Threat Actor Count
  type: number
- contextPath: RecordedFuture.File.relatedEntities.RelatedThreatActor.id
  description: Recorded Future Related Threat Actor ID
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedThreatActor.name
  description: Recorded Future Related Threat Actor Name
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedThreatActor.type
  description: Recorded Future Related Threat Actor Type
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedMalware.count
  description: Recorded Future Related Malware Count
  type: number
- contextPath: RecordedFuture.File.relatedEntities.RelatedMalware.id
  description: Recorded Future Related Malware ID
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedMalware.name
  description: Recorded Future Related Malware Name
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedMalware.type
  description: Recorded Future Related Malware Type
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.count
  description: Recorded Future Related Vulnerability Count
  type: number
- contextPath: RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.id
  description: Recorded Future Related Vulnerability ID
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.name
  description: Recorded Future Related Vulnerability Name
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.type
  description: Recorded Future Related Vulnerability Type
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedIpAddress.count
  description: Recorded Future Related IP Address Count
  type: number
- contextPath: RecordedFuture.File.relatedEntities.RelatedIpAddress.id
  description: Recorded Future Related IP Address ID
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedIpAddress.name
  description: Recorded Future Related IP Address Name
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedIpAddress.type
  description: Recorded Future Related IP Address Type
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedInternetDomainName.count
  description: Recorded Future Related Domain Name Count
  type: number
- contextPath: RecordedFuture.File.relatedEntities.RelatedInternetDomainName.id
  description: Recorded Future Related Domain Name ID
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedInternetDomainName.name
  description: Recorded Future Related Domain Name Name
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedInternetDomainName.type
  description: Recorded Future Related Domain Name Type
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedProduct.count
  description: Recorded Future Related Product Count
  type: number
- contextPath: RecordedFuture.File.relatedEntities.RelatedProduct.id
  description: Recorded Future Related Product ID
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedProduct.name
  description: Recorded Future Related Product Name
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedProduct.type
  description: Recorded Future Related Product Type
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedCountries.count
  description: Recorded Future Related Countries Count
  type: number
- contextPath: RecordedFuture.File.relatedEntities.RelatedCountries.id
  description: Recorded Future Related Countries IDs
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedCountries.name
  description: Recorded Future Related Countries Names
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedCountries.type
  description: Recorded Future Related Countries Type
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedHash.count
  description: Recorded Future Related Hash Count
  type: number
- contextPath: RecordedFuture.File.relatedEntities.RelatedHash.id
  description: Recorded Future Related Hash ID
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedHash.name
  description: Recorded Future Related Hash Name
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedHash.type
  description: Recorded Future Related Hash Type
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedTechnology.count
  description: Recorded Future Related Technology Count
  type: number
- contextPath: RecordedFuture.File.relatedEntities.RelatedTechnology.id
  description: Recorded Future Related Technology ID
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedTechnology.name
  description: Recorded Future Related Technology Name
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedTechnology.type
  description: Recorded Future Related Technology Type
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedEmailAddress.count
  description: Recorded Future Related Email Address Count
  type: number
- contextPath: RecordedFuture.File.relatedEntities.RelatedEmailAddress.id
  description: Recorded Future Related Email Address ID
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedEmailAddress.name
  description: Recorded Future Related Email Address Name
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedEmailAddress.type
  description: Recorded Future Related Email Address Type
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedAttackVector.count
  description: Recorded Future Related Attack Vector Count
  type: number
- contextPath: RecordedFuture.File.relatedEntities.RelatedAttackVector.id
  description: Recorded Future Related Attack Vector ID
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedAttackVector.name
  description: Recorded Future Related Attack Vector Name
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedAttackVector.type
  description: Recorded Future Related Attack Vector Type
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedMalwareCategory.count
  description: Recorded Future Related Malware Category Count
  type: number
- contextPath: RecordedFuture.File.relatedEntities.RelatedMalwareCategory.id
  description: Recorded Future Related Malware Category ID
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedMalwareCategory.name
  description: Recorded Future Related Malware Category Name
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedMalwareCategory.type
  description: Recorded Future Related Malware Category Type
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedOperations.count
  description: Recorded Future Related Operations Count
  type: number
- contextPath: RecordedFuture.File.relatedEntities.RelatedOperations.id
  description: Recorded Future Related Operations ID
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedOperations.name
  description: Recorded Future Related Operations Name
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedOperations.type
  description: Recorded Future Related Operations Type
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedCompany.count
  description: Recorded Future Related Company Count
  type: number
- contextPath: RecordedFuture.File.relatedEntities.RelatedCompany.id
  description: Recorded Future Related Company ID
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedCompany.name
  description: Recorded Future Related Company Name
  type: string
- contextPath: RecordedFuture.File.relatedEntities.RelatedCompany.type
  description: Recorded Future Related Company Type
  type: string
tests:
- Recorded Future Test Playbook
fromversion: 5.0.0