URL Enrichment - Generic v2

Enrich URLs using one or more integrations. URL enrichment includes: * SSL verification for URLs. * Threat information. * Providing of URL screenshots. * URL Reputation using !url.

Common Playbooks · 14 tasks · 4 inputs · 22 outputs

Details

ID	`URL Enrichment - Generic v2`
From Version	5.0.0
Tasks	14

README

Enrich URLs using one or more integrations.

URL enrichment includes:

SSL verification for URLs.
Threat information.
Providing of URL screenshots.
URL Reputation using !url.

Limitation

The “Get URL screenshot” task has a timeout of 10 minutes when using the Rasterize integration. This allows processing a large number of URLs. If the task still fails due to timeout because the Rasterize command is processing too many URLs, the timeout value of the task needs to be increased.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Rasterize

Scripts

Exists
URLSSLVerification

Commands

rasterize
url

Playbook Inputs

Name	Description	Default Value	Required
URL	The URLs to enrich.	URL.Data	Optional
Rasterize	Define if you would like the system take safe screenshots of input URLs. Possible values: True / False. The default value is true.	True	Optional
VerifyURL	Define if you would like the system perform SSL certificate verification on the URLs. Possible values: True / False. The default value is false.	False	Optional
UseReputationCommand	Define if you would like to use the !url command. Note: This input should be used whenever there is no auto-extract enabled in the investigation flow. Possible values: True / False. The default value is false.	False	Required

Playbook Outputs

Path	Description	Type
URL	The URL object.	uknown
URL.Data	The enriched URL.	string
DBotScore	The DBotScore object.	unknown
URL.Malicious	Whether the detected URL was malicious.	unknown
URL.Malicious.Vendor	For malicious URLs, the vendor that made the decision.	unknown
URL.Malicious.Description	For malicious URLs, the reason that the vendor made the decision.	unknown
DBotScore.Indicator	The indicator	string
DBotScore.Type	The indicator’s type	string
DBotScore.Vendor	The reputation vendor	string
DBotScore.Score	The reputation score	number
DBotScore.Reliability	Reliability of the source providing the intelligence data.	unknown
URL.Relationships.EntityA	The source of the relationship.	unknown
URL.Relationships.EntityB	The destination of the relationship.	unknown
URL.Relationships.Relationship	The name of the relationship.	unknown
URL.Relationships.EntityAType	The type of the source of the relationship.	unknown
URL.Relationships.EntityBType	The type of the destination of the relationship.	unknown
InfoFile.EntryID	The EntryID of the image/pdf file.	unknown
InfoFile.Extension	The extension of the image/pdf file.	unknown
InfoFile.Name	The name of the image/pdf file.	unknown
InfoFile.Info	The info of the image/pdf file.	unknown
InfoFile.Size	The size of the image/pdf file.	unknown
InfoFile.Type	The type of the image/pdf file.	unknown

Playbook Image

URL Enrichment - Generic v2

Inputs

URL — The URLs to enrich.
Rasterize — Define if you would like the system take safe screenshots of input URLs. Possible values: True / False. The default value is true.
VerifyURL — Define if you would like the system perform SSL certificate verification on the URLs. Possible values: True / False. The default value is false.
UseReputationCommand — Define if you would like to use the !url command. Note: This input should be used whenever there is no auto-extract enabled in the investigation flow. Possible values: True / False. The default value is false.

Outputs

URL — The URL object.
URL.Data — The enriched URL.
DBotScore — The DBotScore object.
URL.Malicious — Whether the detected URL was malicious.
URL.Malicious.Vendor — For malicious URLs, the vendor that made the decision.
URL.Malicious.Description — For malicious URLs, the reason that the vendor made the decision.
DBotScore.Indicator — The indicator.
DBotScore.Type — The indicator's type.
DBotScore.Vendor — The reputation vendor.
DBotScore.Score — The reputation score.
DBotScore.Reliability — Reliability of the source providing the intelligence data.
URL.Relationships.EntityA — The source of the relationship.
URL.Relationships.EntityB — The destination of the relationship.
URL.Relationships.Relationship — The name of the relationship.
URL.Relationships.EntityAType — The type of the source of the relationship.
URL.Relationships.EntityBType — The type of the destination of the relationship.
InfoFile.EntryID — The EntryID of the image/pdf file.
InfoFile.Extension — The extension of the image/pdf file.
InfoFile.Name — The name of the image/pdf file.
InfoFile.Info — The info of the image/pdf file.
InfoFile.Size — The size of the image/pdf file.
InfoFile.Type — The type of the image/pdf file.

Commands used

rasterize url

Flowchart

Source

playbook-URL_Enrichment_-_Generic_v2.yml

Download History Raw

id: URL Enrichment - Generic v2
version: -1
fromversion: 5.0.0
name: URL Enrichment - Generic v2
description: |-
  Enrich URLs using one or more integrations.

  URL enrichment includes:
  * SSL verification for URLs.
  * Threat information.
  * Providing of URL screenshots.
  * URL Reputation using !url.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: e1a236ab-b35b-4b70-84a7-3ca08b9bbe95
    type: start
    task:
      id: e1a236ab-b35b-4b70-84a7-3ca08b9bbe95
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 41
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 2e1b93fe-512d-4fba-80dd-2912bf3382f5
    type: condition
    task:
      id: 2e1b93fe-512d-4fba-80dd-2912bf3382f5
      version: -1
      name: Is there a URL to enrich?
      description: Checks whether there is at least one URL to enrich.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "37"
      "yes":
      - "29"
      - "31"
      - "38"
    scriptarguments:
      value:
        simple: inputs.URL
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.URL
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 490,
          "y": 175
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 7956570c-4a34-462b-84aa-0f8c6d01cf43
    type: title
    task:
      id: 7956570c-4a34-462b-84aa-0f8c6d01cf43
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 1095
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 426d5e5a-76ec-4310-8157-e3ce1795f88f
    type: condition
    task:
      id: 426d5e5a-76ec-4310-8157-e3ce1795f88f
      version: -1
      name: 'Is Rasterize integration enabled? '
      description: Checks if there is an active instance of the Rasterize integration enabled.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "24"
      "yes":
      - "26"
    scriptarguments:
      value:
        complex:
          root: modules
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: brand
                iscontext: true
              right:
                value:
                  simple: Rasterize
          - - operator: isEqualString
              left:
                value:
                  simple: state
                iscontext: true
              right:
                value:
                  simple: active
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -40,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 13c4e2ea-abb5-49b0-8139-79ba102250c7
    type: regular
    task:
      id: 13c4e2ea-abb5-49b0-8139-79ba102250c7
      version: -1
      name: Get URL screenshot
      description: Gets a screenshot of the URL page.
      tags:
      - url_screenshots
      script: Rasterize|||rasterize
      type: regular
      iscommand: true
      brand: Rasterize
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      url:
        complex:
          root: inputs.URL
          transformers:
          - operator: uniq
      execution-timeout:
        simple: "600"
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -40,
          "y": 920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 71af55e1-a11a-42f9-84f6-ce3ce93e17ce
    type: condition
    task:
      id: 71af55e1-a11a-42f9-84f6-ce3ce93e17ce
      version: -1
      name: Capture screenshots of the URL?
      description: Checks if the playbook's Rasterize input is set to "True", which determines whether screenshots of the URLs are created.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "24"
      "yes":
      - "25"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.Rasterize
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": -40,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 7fc4755c-5a08-4f90-8bab-12c892b21df4
    type: title
    task:
      id: 7fc4755c-5a08-4f90-8bab-12c892b21df4
      version: -1
      name: URL Screenshots
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -40,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 11224752-fee9-4a8f-82c0-5af370081779
    type: title
    task:
      id: 11224752-fee9-4a8f-82c0-5af370081779
      version: -1
      name: URL Verification
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "33"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 489.5,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: ab4dd806-764c-4b25-8e34-98b9a0fc87f7
    type: regular
    task:
      id: ab4dd806-764c-4b25-8e34-98b9a0fc87f7
      version: -1
      name: Verify SSL for URLs
      description: Verify URL SSL certificate.
      scriptName: URLSSLVerification
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      url:
        complex:
          root: inputs.URL
          transformers:
          - operator: uniq
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 0a60d379-a6c4-449e-87e2-4939b8d0ad13
    type: condition
    task:
      id: 0a60d379-a6c4-449e-87e2-4939b8d0ad13
      version: -1
      name: Verify URLs?
      description: Checks if the playbook's VerifyURL input is set to "True", to determine whether to perform SSL verification on the URLs.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "24"
      "yes":
      - "32"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.VerifyURL
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 490,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 395ad908-d5b6-4449-8665-b085546d0d42
    type: title
    task:
      id: 395ad908-d5b6-4449-8665-b085546d0d42
      version: -1
      name: No URLs
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "24"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -510,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    continueonerrortype: ""
    id: "38"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "40"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 704516ae-95d9-4ef5-8772-1958046fcac7
      iscommand: false
      name: URL Reputation
      type: title
      version: -1
      description: ''
    taskid: 704516ae-95d9-4ef5-8772-1958046fcac7
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1010,
          "y": 360
        }
      }
  "39":
    continueonerrortype: ""
    id: "39"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "24"
    note: false
    quietmode: 0
    scriptarguments:
      url:
        complex:
          root: inputs.URL
          transformers:
          - operator: uniq
    separatecontext: false
    skipunavailable: true
    task:
      brand: ""
      description: Checks the reputation of a URL.
      id: 66cd353d-652e-4786-8d2e-af0fbd9c63e7
      iscommand: true
      name: Check Reputation
      script: '|||url'
      type: regular
      version: -1
    taskid: 66cd353d-652e-4786-8d2e-af0fbd9c63e7
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1010,
          "y": 710
        }
      }
  "40":
    conditions:
    - condition:
      - - ignorecase: true
          left:
            iscontext: true
            value:
              complex:
                root: inputs.UseReputationCommand
          operator: isEqualString
          right:
            value:
              simple: "True"
      label: "yes"
    continueonerrortype: ""
    id: "40"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - "24"
      "yes":
      - "39"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: e0db6ab1-2c0e-4859-84eb-e764c3fd01e5
      iscommand: false
      name: Should use !url command?
      description: Check if should run URL reputation command
      type: condition
      version: -1
    taskid: e0db6ab1-2c0e-4859-84eb-e764c3fd01e5
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1010,
          "y": 500
        }
      }
view: |-
  {
    "linkLabelsPosition": {
      "25_24_#default#": 0.53,
      "25_26_yes": 0.47,
      "27_25_yes": 0.5,
      "33_24_#default#": 0.13,
      "33_32_yes": 0.67,
      "40_24_#default#": 0.31
    },
    "paper": {
      "dimensions": {
        "height": 1119,
        "width": 1900,
        "x": -510,
        "y": 41
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
      transformers:
      - operator: uniq
  required: false
  description: The URLs to enrich.
  playbookInputQuery:
- key: Rasterize
  value:
    simple: "True"
  required: false
  description: |-
    Define if you would like the system take safe screenshots of input URLs.
    Possible values: True / False.
    The default value is true.
  playbookInputQuery:
- key: VerifyURL
  value:
    simple: "False"
  required: false
  description: |-
    Define if you would like the system perform SSL certificate verification on the URLs.
    Possible values: True / False.
    The default value is false.
  playbookInputQuery:
- description: |-
    Define if you would like to use the !url command.
    Note: This input should be used whenever there is no auto-extract enabled in the investigation flow.
    Possible values: True / False.
    The default value is false.
  key: UseReputationCommand
  playbookInputQuery:
  required: true
  value:
    simple: "False"
outputs:
- contextPath: URL
  description: The URL object.
  type: uknown
- contextPath: URL.Data
  description: The enriched URL.
  type: string
- contextPath: DBotScore
  description: The DBotScore object.
  type: unknown
- contextPath: URL.Malicious
  description: Whether the detected URL was malicious.
  type: unknown
- contextPath: URL.Malicious.Vendor
  description: For malicious URLs, the vendor that made the decision.
- contextPath: URL.Malicious.Description
  description: For malicious URLs, the reason that the vendor made the decision.
- contextPath: DBotScore.Indicator
  description: The indicator.
  type: string
- contextPath: DBotScore.Type
  description: The indicator's type.
  type: string
- contextPath: DBotScore.Vendor
  description: The reputation vendor.
  type: string
- contextPath: DBotScore.Score
  description: The reputation score.
  type: number
- contextPath: DBotScore.Reliability
  description: Reliability of the source providing the intelligence data.
- contextPath: URL.Relationships.EntityA
  description: The source of the relationship.
- contextPath: URL.Relationships.EntityB
  description: The destination of the relationship.
- contextPath: URL.Relationships.Relationship
  description: The name of the relationship.
- contextPath: URL.Relationships.EntityAType
  description: The type of the source of the relationship.
- contextPath: URL.Relationships.EntityBType
  description: The type of the destination of the relationship.
- contextPath: InfoFile.EntryID
  description: The EntryID of the image/pdf file.
- contextPath: InfoFile.Extension
  description: The extension of the image/pdf file.
- contextPath: InfoFile.Name
  description: The name of the image/pdf file.
- contextPath: InfoFile.Info
  description: The info of the image/pdf file.
- contextPath: InfoFile.Size
  description: The size of the image/pdf file.
- contextPath: InfoFile.Type
  description: The type of the image/pdf file.
tests:
- URL Enrichment - Generic v2 - Test
system: true
marketplaces:
- xsoar
- marketplacev2
- platform