Recorded Future Threat Assessment

Details

ID	`Recorded Future Threat Assessment`
From Version	5.0.0
Tasks	7

README

Threat Assessment using the Recorded Future SOAR Triage API and the context Phishing.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts. Depends on the recorded futures indicator field; threat assessment.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Recorded Future v2

Scripts

This playbook does not use any scripts.

Commands

recordedfuture-threat-assessment

Playbook Inputs

Name	Description	Default Value	Required
CVE	CVE ID to check if it is related to the C2 context.	CVE.ID	Optional
IP	IP Address to check if it is related to the C2 context.	IP.Address	Optional
URL	URL to check if it is related to the C2 context.	URL.Data	Optional
MD5	MD5 to check if it is related to the C2 context.	File.MD5	Optional
SHA1	SHA-1 to check if it is related to the C2 context.	File.SHA1	Optional
SHA256	SHA-256 to check if it is related to the C2 context.	File.SHA256	Optional
Domain	Domain to check if it is related to the C2 context.	Domain.Name	Optional
threat-assessment-context	Context to use for assessment. This is used by Recorded Future to calculate the relevant score and verdict. Valid values are “c2”, “malware” and “phishing”.	phishing	Required

Playbook Outputs

Path	Description	Type
DBotScore.Indicator	The indicator that was tested	string
DBotScore.Type	Indicator type	string
DBotScore.Vendor	Vendor used to calculate the score	string
DBotScore.Score	The actual score	number
File.SHA256	File SHA-256	string
File.SHA512	File SHA-512	string
File.SHA1	File SHA-1	string
File.MD5	File MD5	string
File.CRC32	File CRC32	string
File.CTPH	File CTPH	string
IP.Address	IP address	string
IP.ASN	ASN	string
IP.Geo.Country	IP Geolocation Country	string
Domain.Name	Domain name	string
URL.Data	URL name	string
CVE.ID	Vulnerability name	string
RecordedFuture.verdict	Recorded Future verdict	boolean
RecordedFuture.context	Threat Assessment Context	string
RecordedFuture.riskScore	Recorded Future Max Score	number
RecordedFuture.Entities.id	Entity ID	string
RecordedFuture.Entities.name	Entity Name	string
RecordedFuture.Entities.type	Entity Type	string
RecordedFuture.Entities.score	Entity Score	string
RecordedFuture.Entities.Evidence.ruleid	Recorded Future Risk Rule ID	string
RecordedFuture.Entities.Evidence.timestamp	Recorded Future Evidence Timestamp	date
RecordedFuture.Entities.Evidence.mitigation	Recorded Future Evidence Mitigation	string
RecordedFuture.Entities.Evidence.description	Recorded Future Evidence Description	string
RecordedFuture.Entities.Evidence.rule	Recorded Future Risk Rule	string
RecordedFuture.Entities.Evidence.level	Recorded Future Risk Rule Level	number

Playbook Image

Recorded Future Threat Assessment

Inputs

CVE — CVE ID to check if it is related to the C2 context.
IP — IP Address to check if it is related to the C2 context.
URL — URL to check if it is related to the C2 context.
MD5 — MD5 to check if it is related to the C2 context.
SHA1 — SHA-1 to check if it is related to the C2 context.
SHA256 — SHA-256 to check if it is related to the C2 context.
Domain — Domain to check if it is related to the C2 context.
threat-assessment-context — Context to use for assessment. This is used by Recorded Future to calculate the relevant score and verdict. Valid values are "c2", "malware" and "phishing".
filter — Makes sure that we filter out values that are zero in score from the threat assessment api.

Outputs

DBotScore.Indicator — The indicator that was tested
DBotScore.Type — Indicator type
DBotScore.Vendor — Vendor used to calculate the score
DBotScore.Score — The actual score
File.SHA256 — SHA-256
File.SHA512 — SHA-512
File.SHA1 — SHA-1
File.MD5 — MD5
File.CRC32 — CRC32
File.CTPH — CTPH
IP.Address — IP address
IP.ASN — ASN
IP.Geo.Country — IP Geolocation Country
Domain.Name — Domain name
URL.Data — URL name
CVE.ID — Vulnerability name
RecordedFuture.verdict — Recorded Future verdict
RecordedFuture.context — Threat Assessment Context
RecordedFuture.riskScore — Recorded Future Max Score
RecordedFuture.Entities.id — Entity ID
RecordedFuture.Entities.name — Entity Name
RecordedFuture.Entities.type — Entity Type
RecordedFuture.Entities.score — Entity Score
RecordedFuture.Entities.Evidence.ruleid — Recorded Future Risk Rule ID
RecordedFuture.Entities.Evidence.timestamp — Recorded Future Evidence Timestamp
RecordedFuture.Entities.Evidence.mitigation — Recorded Future Evidence Mitigation
RecordedFuture.Entities.Evidence.description — Recorded Future Evidence Description
RecordedFuture.Entities.Evidence.rule — Recorded Future Risk Rule
RecordedFuture.Entities.Evidence.level — Recorded Future Risk Rule Level

Commands used

recordedfuture-threat-assessment setIndicator

Flowchart

Source

playbook-Recorded_Future_Threat_Assessment.yml

Download History Raw

id: Recorded Future Threat Assessment
version: -1
name: Recorded Future Threat Assessment
description: Threat Assessment using the Recorded Future SOAR Triage API and the context
  Phishing.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: adb7954a-1b6a-4644-8985-ad77bdbc0295
    type: start
    task:
      id: adb7954a-1b6a-4644-8985-ad77bdbc0295
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: d70bec20-aa9b-44c2-8901-a8b730247d25
    type: condition
    task:
      id: d70bec20-aa9b-44c2-8901-a8b730247d25
      version: -1
      name: Is there anything to assess?
      description: Checks whether the playbook's input contains at least one domain
        name to enrich.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "24"
      "yes":
      - "29"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.CVE
            iscontext: true
        - operator: isExists
          left:
            value:
              simple: inputs.IP
            iscontext: true
        - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
        - operator: isExists
          left:
            value:
              simple: inputs.MD5
            iscontext: true
        - operator: isExists
          left:
            value:
              simple: inputs.SHA1
            iscontext: true
        - operator: isExists
          left:
            value:
              simple: inputs.SHA256
            iscontext: true
        - operator: isExists
          left:
            value:
              simple: inputs.Domain
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "24":
    id: "24"
    taskid: d1410bed-68ef-4308-8a99-964df74ff88e
    type: title
    task:
      id: d1410bed-68ef-4308-8a99-964df74ff88e
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 0,
          "y": 1100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: 8b5c54f4-ef8e-4b2f-8af7-6bc093b49ff3
    type: condition
    task:
      id: 8b5c54f4-ef8e-4b2f-8af7-6bc093b49ff3
      version: -1
      name: Is Recorded Future API enabled?
      description: Checks if there is an active instance of the Recorded Future API
        integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "24"
      "yes":
      - "28"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Recorded Future v2
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 410,
          "y": 505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "28":
    id: "28"
    taskid: 436a7665-15ab-4274-80fe-e9d17d0896e9
    type: regular
    task:
      id: 436a7665-15ab-4274-80fe-e9d17d0896e9
      version: -1
      name: Get Threat Assessment from Recorded Future
      description: Get an indication of the risk based on context.
      script: Recorded Future v2|||recordedfuture-threat-assessment
      type: regular
      iscommand: true
      brand: Recorded Future v2
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      context:
        simple: ${inputs.threat-assessment-context}
      cve:
        simple: ${inputs.CVE}
      domain:
        simple: ${inputs.Domain}
      file:
        simple: ${inputs.MD5},${inputs.SHA1},${inputs.SHA256}
      filter:
        simple: ${inputs.filter}
      ip:
        simple: ${inputs.IP}
      url:
        simple: ${inputs.URL}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 410,
          "y": 820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "29":
    id: "29"
    taskid: 53365659-56c0-4f05-8e96-4437c06fcc74
    type: title
    task:
      id: 53365659-56c0-4f05-8e96-4437c06fcc74
      version: -1
      name: Threat Assessment Using Recorded Future API
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 410,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "30":
    id: "30"
    taskid: 80d37316-6d8f-4e04-8993-39d4432ca5ee
    type: regular
    task:
      id: 80d37316-6d8f-4e04-8993-39d4432ca5ee
      version: -1
      name: setIndicator
      description: Change the properties of an indicator
      script: Builtin|||setIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      recordedfuturethreatassessment:
        simple: ${RecordedFuture.Entities.context}
      value:
        simple: ${RecordedFuture.Entities.name}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 410,
          "y": 980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "16_24_#default#": 0.57
    },
    "paper": {
      "dimensions": {
        "height": 1115,
        "width": 790,
        "x": 0,
        "y": 50
      }
    }
  }
inputs:
- key: CVE
  value:
    complex:
      root: CVE
      accessor: ID
      transformers:
      - operator: uniq
  required: false
  description: CVE ID to check if it is related to the C2 context.
  playbookInputQuery:
- key: IP
  value:
    complex:
      root: IP
      accessor: Address
      transformers:
      - operator: uniq
  required: false
  description: IP Address to check if it is related to the C2 context.
  playbookInputQuery:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
      transformers:
      - operator: uniq
  required: false
  description: URL to check if it is related to the C2 context.
  playbookInputQuery:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
      transformers:
      - operator: uniq
  required: false
  description: MD5 to check if it is related to the C2 context.
  playbookInputQuery:
- key: SHA1
  value:
    complex:
      root: File
      accessor: SHA1
      transformers:
      - operator: uniq
  required: false
  description: SHA-1 to check if it is related to the C2 context.
  playbookInputQuery:
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
      transformers:
      - operator: uniq
  required: false
  description: SHA-256 to check if it is related to the C2 context.
  playbookInputQuery:
- key: Domain
  value:
    complex:
      root: Domain
      accessor: Name
      transformers:
      - operator: uniq
  required: false
  description: Domain to check if it is related to the C2 context.
  playbookInputQuery:
- key: threat-assessment-context
  value:
    simple: phishing
  required: true
  description: Context to use for assessment. This is used by Recorded Future to calculate
    the relevant score and verdict. Valid values are "c2", "malware" and "phishing".
  playbookInputQuery:
- key: filter
  value:
    simple: "yes"
  required: false
  description: 'Makes sure that we filter out values that are zero in score from the
    threat assessment api. '
  playbookInputQuery:
outputs:
- contextPath: DBotScore.Indicator
  description: The indicator that was tested
  type: string
- contextPath: DBotScore.Type
  description: Indicator type
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score
  type: string
- contextPath: DBotScore.Score
  description: The actual score
  type: number
- contextPath: File.SHA256
  description: SHA-256
  type: string
- contextPath: File.SHA512
  description: SHA-512
  type: string
- contextPath: File.SHA1
  description: SHA-1
  type: string
- contextPath: File.MD5
  description: MD5
  type: string
- contextPath: File.CRC32
  description: CRC32
  type: string
- contextPath: File.CTPH
  description: CTPH
  type: string
- contextPath: IP.Address
  description: IP address
  type: string
- contextPath: IP.ASN
  description: ASN
  type: string
- contextPath: IP.Geo.Country
  description: IP Geolocation Country
  type: string
- contextPath: Domain.Name
  description: Domain name
  type: string
- contextPath: URL.Data
  description: URL name
  type: string
- contextPath: CVE.ID
  description: Vulnerability name
  type: string
- contextPath: RecordedFuture.verdict
  description: Recorded Future verdict
  type: boolean
- contextPath: RecordedFuture.context
  description: Threat Assessment Context
  type: string
- contextPath: RecordedFuture.riskScore
  description: Recorded Future Max Score
  type: number
- contextPath: RecordedFuture.Entities.id
  description: Entity ID
  type: string
- contextPath: RecordedFuture.Entities.name
  description: Entity Name
  type: string
- contextPath: RecordedFuture.Entities.type
  description: Entity Type
  type: string
- contextPath: RecordedFuture.Entities.score
  description: Entity Score
  type: string
- contextPath: RecordedFuture.Entities.Evidence.ruleid
  description: Recorded Future Risk Rule ID
  type: string
- contextPath: RecordedFuture.Entities.Evidence.timestamp
  description: Recorded Future Evidence Timestamp
  type: date
- contextPath: RecordedFuture.Entities.Evidence.mitigation
  description: Recorded Future Evidence Mitigation
  type: string
- contextPath: RecordedFuture.Entities.Evidence.description
  description: Recorded Future Evidence Description
  type: string
- contextPath: RecordedFuture.Entities.Evidence.rule
  description: Recorded Future Risk Rule
  type: string
- contextPath: RecordedFuture.Entities.Evidence.level
  description: Recorded Future Risk Rule Level
  type: number
tests:
- Recorded Future Test Playbook
fromversion: 5.0.0