Search For Hash In Sandbox - Generic

This playbook searches for a specific hash in the supported sandboxes. If the hash is known, the playbook provides a detailed analysis of the sandbox report. Currently, supported sandboxes are Falcon Intelligence Sandbox, Wildfire and Joe Sandbox.

Common Playbooks · 29 tasks · 1 input · 6 outputs

Inputs

  • FileSha256 — The SHA256 hash to search for.

Outputs

  • AttackPattern — The MITRE Attack pattern information.
  • MITREATTACK — Full MITRE data for the attack pattern.
  • NonFoundHashes — A list of hashes that are not found in the sandboxes.
  • WildFire.Report — The results of the Wildfire report.
  • csfalconx.resource.sandbox — The results of the Falcon Intelligence Sandbox report.
  • DetectedHashes — A list of hashes that were detected by the sandboxes.

Commands used

attack-pattern cs-fx-find-reports cs-fx-get-full-report extractIndicators joe-download-report joe-search rasterize-pdf wildfire-report

Flowchart

no yes no yes yes yes yes yes yes yes no yes yes yes yes yes Start Start Is Falcon Intelligence Sandbox enabled? - IsIntegrationAvailable Is Falcon Intelligence Sa... IsIntegrationAvailable Is WildFire enabled? - IsIntegrationAvailable Is WildFire enabled? IsIntegrationAvailable Search for hash in Wildfire - wildfire-report Search for hash in Wildfire wildfire-report Search for hash in Falcon Intelligence Sandbox - cs-fx-find-reports Search for hash in Falcon... cs-fx-find-reports Is there a hash to check? Is there a hash to check? Done Done Get full report from Falcon Intelligence Sandbox - cs-fx-get-full-report Get full report from Falc... cs-fx-get-full-report Are there MITRE findings? Are there MITRE findings? Mitre Attack - Extract Technique Information From ID - Mitre Attack - Extract Technique Information From ID Mitre Attack - Extract Te... Mitre Attack - Extract Techni... Get Wildfire PDF report - wildfire-report Get Wildfire PDF report wildfire-report Rasterize PDF - rasterize-pdf Rasterize PDF rasterize-pdf Is there a report to rasterize? Is there a report to rast... Is JoeSecurity Sandbox enabled? - IsIntegrationAvailable Is JoeSecurity Sandbox en... IsIntegrationAvailable Search for hash in Joe Sandbox - joe-search Search for hash in Joe Sa... joe-search Get a full report from Joe Sandbox - JSON - joe-download-report Get a full report from Jo... joe-download-report Any results from the Joe search? Any results from the Joe ... Get a full report from Joe Sandbox - PDF - joe-download-report Get a full report from Jo... joe-download-report Rasterize PDF - rasterize-pdf Rasterize PDF rasterize-pdf Extract Indicators from the report - extractIndicators Extract Indicators from t... extractIndicators Enrich Mitre Attack Techniques information. - attack-pattern Enrich Mitre Attack Techn... attack-pattern Integration is not available Integration is not available Are there MITRE findings? Are there MITRE findings? Set Unfound Hashes to Context Set Unfound Hashes to Con... Set Detected Hashes - WildFire - SetAndHandleEmpty Set Detected Hashes - Wil... SetAndHandleEmpty Set Detected Hashes - Falcon Intelligence Sandbox - SetAndHandleEmpty Set Detected Hashes - Fal... SetAndHandleEmpty Set Detected Hashes - JoeSecurity Sandbox - SetAndHandleEmpty Set Detected Hashes - Joe... SetAndHandleEmpty Set Non-Found Hashes - SetAndHandleEmpty Set Non-Found Hashes SetAndHandleEmpty Any results from the Falcon Intelligence Sandbox search? Any results from the Falc...