Recorded Future File Reputation

File reputation using Recorded Future SOAR enrichment

Recorded Future Intelligence · 11 tasks · 3 inputs · 23 outputs

Details

ID	`Recorded Future File Reputation`
From Version	5.0.0
Tasks	11

README

File reputation using Recorded Future SOAR Enrichment

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts. Depends on the recorded futures indicator field; risk rules.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Recorded Future v2

Scripts

This playbook does not use any scripts.

Commands

file

Playbook Inputs

Name	Description	Default Value	Required
MD5	File MD5 hash to get reputation of.	File.MD5	Optional
SHA256	File SHA-256 hash to get reputation of.	File.SHA256	Optional
SHA1	File SHA-1 hash to get reputation of.	File.SHA1	Optional

Playbook Outputs

Path	Description	Type
DBotScore.Indicator	The indicator that was tested	string
DBotScore.Type	Indicator type	string
DBotScore.Vendor	Vendor used to calculate the score	string
DBotScore.Score	The actual score	number
File.SHA256	File SHA-256	string
File.SHA512	File SHA-512	string
File.SHA1	File SHA-1	string
File.MD5	File MD5	string
File.CRC32	File CRC32	string
File.CTPH	File CTPH	string
File.Malicious.Vendor	For malicious files, the vendor that made the decision	string
File.Malicious.Description	For malicious files, the reason that the vendor made the decision	string
RecordedFuture.File.riskScore	Recorded Future Hash Risk Score	number
RecordedFuture.File.riskLevel	Recorded Future Hash Risk Level	string
RecordedFuture.File.Evidence.rule	Recorded Risk Rule Name	string
RecordedFuture.File.Evidence.mitigation	Recorded Risk Rule Mitigation	string
RecordedFuture.File.Evidence.description	Recorded Risk Rule description	string
RecordedFuture.File.Evidence.timestamp	Recorded Risk Rule timestamp	date
RecordedFuture.File.Evidence.level	Recorded Risk Rule Level	number
RecordedFuture.File.Evidence.ruleid	Recorded Risk Rule ID	string
RecordedFuture.File.name	Hash	string
RecordedFuture.File.maxRules	Maximum count of Recorded Future Hash Risk Rules	number
RecordedFuture.File.ruleCount	Number of triggered Recorded Future Hash Risk Rules	number

Playbook Image

Recorded Future File Reputation

Inputs

MD5 — MD5 hash for which to get the reputation.
SHA256 — SHA-256 hash for which to get the reputation.
SHA1 — SHA-1 hash for which to get reputation.

Outputs

DBotScore.Indicator — The indicator that was tested
DBotScore.Type — Indicator type
DBotScore.Vendor — Vendor used to calculate the score
DBotScore.Score — The actual score
File.SHA256 — File SHA-256
File.SHA512 — File SHA-512
File.SHA1 — File SHA-1
File.MD5 — File MD5
File.CRC32 — File CRC32
File.CTPH — File CTPH
File.Malicious.Vendor — For malicious files, the vendor that made the decision
File.Malicious.Description — For malicious files, the reason that the vendor made the decision
RecordedFuture.File.riskScore — Recorded Future Hash Risk Score
RecordedFuture.File.riskLevel — Recorded Future Hash Risk Level
RecordedFuture.File.Evidence.rule — Recorded Future Risk Rule Name
RecordedFuture.File.Evidence.mitigation — Recorded Future Risk Rule Mitigation
RecordedFuture.File.Evidence.description — Recorded Future Risk Rule description
RecordedFuture.File.Evidence.timestamp — Recorded Future Risk Rule timestamp
RecordedFuture.File.Evidence.level — Recorded Future Risk Rule Level
RecordedFuture.File.Evidence.ruleid — Recorded Future Risk Rule ID
RecordedFuture.File.name — Hash
RecordedFuture.File.maxRules — Maximum count of Recorded Future Hash Risk Rules
RecordedFuture.File.ruleCount — Number of triggered Recorded Future Hash Risk Rules

Commands used

file setIndicator

Flowchart

Source

playbook-Recorded_Future_File_Reputation.yml

Download History Raw

id: Recorded Future File Reputation
version: -1
name: Recorded Future File Reputation
description: File reputation using Recorded Future SOAR enrichment
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 74181337-dde0-4a67-8cb3-947f1e5b475c
    type: start
    task:
      id: 74181337-dde0-4a67-8cb3-947f1e5b475c
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": -200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 736504e0-6cc2-4ea8-8ba5-c12192af0bc2
    type: title
    task:
      id: 736504e0-6cc2-4ea8-8ba5-c12192af0bc2
      version: -1
      name: Get reputation using Recorded Future API
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
      - "15"
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 35a895eb-d8ec-4fd6-8b25-eb7f23b7da9e
    type: regular
    task:
      id: 35a895eb-d8ec-4fd6-8b25-eb7f23b7da9e
      version: -1
      name: Get MD5 reputation
      description: Get a quick indication of the risk associated with a file.
      script: Recorded Future v2|||file
      type: regular
      iscommand: true
      brand: Recorded Future v2
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      file:
        complex:
          root: inputs.MD5
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 665
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 0cb4b168-d43a-426e-85f4-63341287ee88
    type: title
    task:
      id: 0cb4b168-d43a-426e-85f4-63341287ee88
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1370,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: 58bb05e5-2b1d-4971-83e5-90ac5d7518de
    type: condition
    task:
      id: 58bb05e5-2b1d-4971-83e5-90ac5d7518de
      version: -1
      name: Is there an MD5 hash?
      description: Check if there is an MD5 hash in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "5"
    scriptarguments:
      value:
        simple: ${File.MD5}
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.MD5
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: b870b692-b1a9-47f2-8852-c68c345aff51
    type: condition
    task:
      id: b870b692-b1a9-47f2-8852-c68c345aff51
      version: -1
      name: Is there a SHA-256 hash?
      description: Check if there is a SHA-256 hash in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "16"
    scriptarguments:
      value:
        simple: ${File.SHA256}
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 500,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: fad9cc52-fc61-4eb3-80c4-70a4af1ac54c
    type: regular
    task:
      id: fad9cc52-fc61-4eb3-80c4-70a4af1ac54c
      version: -1
      name: Get SHA-256 reputation
      description: Get a quick indication of the risk associated with a file.
      script: Recorded Future v2|||file
      type: regular
      iscommand: true
      brand: Recorded Future v2
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      file:
        complex:
          root: inputs.SHA256
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 665
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: b4368d5a-c045-407b-8cfb-aab08cebdfac
    type: condition
    task:
      id: b4368d5a-c045-407b-8cfb-aab08cebdfac
      version: -1
      name: Is there a SHA-1 hash?
      description: Check if there is a SHA-1 hash in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "18"
    scriptarguments:
      value:
        simple: ${File.SHA256}
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.SHA1
            iscontext: true
    view: |-
      {
        "position": {
          "x": 950,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: eb590faf-6a42-4447-8f10-f09b45b979a7
    type: regular
    task:
      id: eb590faf-6a42-4447-8f10-f09b45b979a7
      version: -1
      name: Get SHA-1 reputation
      description: Get a quick indication of the risk associated with a file.
      script: Recorded Future v2|||file
      type: regular
      iscommand: true
      brand: Recorded Future v2
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      file:
        complex:
          root: inputs.SHA1
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 962.5,
          "y": 665
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: 4783ab5f-c69d-4c75-8188-72fb800630a1
    type: condition
    task:
      id: 4783ab5f-c69d-4c75-8188-72fb800630a1
      version: -1
      name: Is Recorded Future API enabled?
      description: Checks if there is an active instance of the Recorded Future API
        integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Recorded Future v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 500,
          "y": -70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: 97caa79f-8b3d-4565-86ae-2b0027ae5e8f
    type: regular
    task:
      id: 97caa79f-8b3d-4565-86ae-2b0027ae5e8f
      version: -1
      name: setIndicator
      description: Change the properties of an indicator
      script: Builtin|||setIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      recordedfutureriskrules:
        simple: ${RecordedFuture.File.rules}
      value:
        simple: ${RecordedFuture.File.name}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 855
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "14_7_#default#": 0.52,
      "15_7_#default#": 0.61
    },
    "paper": {
      "dimensions": {
        "height": 1315,
        "width": 1700,
        "x": 50,
        "y": -200
      }
    }
  }
inputs:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: MD5 hash for which to get the reputation.
  playbookInputQuery:
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
  required: false
  description: SHA-256 hash for which to get the reputation.
  playbookInputQuery:
- key: SHA1
  value:
    complex:
      root: File
      accessor: SHA1
  required: false
  description: SHA-1 hash for which to get reputation.
  playbookInputQuery:
outputs:
- contextPath: DBotScore.Indicator
  description: The indicator that was tested
  type: string
- contextPath: DBotScore.Type
  description: Indicator type
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score
  type: string
- contextPath: DBotScore.Score
  description: The actual score
  type: number
- contextPath: File.SHA256
  description: File SHA-256
  type: string
- contextPath: File.SHA512
  description: File SHA-512
  type: string
- contextPath: File.SHA1
  description: File SHA-1
  type: string
- contextPath: File.MD5
  description: File MD5
  type: string
- contextPath: File.CRC32
  description: File CRC32
  type: string
- contextPath: File.CTPH
  description: File CTPH
  type: string
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision
  type: string
- contextPath: File.Malicious.Description
  description: For malicious files, the reason that the vendor made the decision
  type: string
- contextPath: RecordedFuture.File.riskScore
  description: Recorded Future Hash Risk Score
  type: number
- contextPath: RecordedFuture.File.riskLevel
  description: Recorded Future Hash Risk Level
  type: string
- contextPath: RecordedFuture.File.Evidence.rule
  description: Recorded Future Risk Rule Name
  type: string
- contextPath: RecordedFuture.File.Evidence.mitigation
  description: Recorded Future Risk Rule Mitigation
  type: string
- contextPath: RecordedFuture.File.Evidence.description
  description: Recorded Future Risk Rule description
  type: string
- contextPath: RecordedFuture.File.Evidence.timestamp
  description: Recorded Future Risk Rule timestamp
  type: date
- contextPath: RecordedFuture.File.Evidence.level
  description: Recorded Future Risk Rule Level
  type: number
- contextPath: RecordedFuture.File.Evidence.ruleid
  description: Recorded Future Risk Rule ID
  type: string
- contextPath: RecordedFuture.File.name
  description: Hash
  type: string
- contextPath: RecordedFuture.File.maxRules
  description: Maximum count of Recorded Future Hash Risk Rules
  type: number
- contextPath: RecordedFuture.File.ruleCount
  description: Number of triggered Recorded Future Hash Risk Rules
  type: number
tests:
- Recorded Future Test Playbook
fromversion: 5.0.0