WildFire - Detonate file Deprecated

Deprecated. Use WildFire - Detonate file v2 instead.

WildFire by Palo Alto Networks · 11 tasks · 4 inputs · 27 outputs

Details

ID	`WildFire - Detonate file`
From Version	5.0.0
Tasks	11

README

Detonate one or more files using the Wildfire integration. This playbook
returns relevant reports to the War Room and file reputations to the context data.
The detonation supports the following file types -
APK, JAR, DOC, DOCX, RTF, XLS, XLSX, PPT, PPTX, OOXML, PE32, PE, PDF, DMG, PKG, RAR, 7Z, JS, ELF, HTA, LNK, VBS, PS1, PERL, PYTHON, SHELL.

Note: Base64 encoded files are currently not supported

This playbook is deprecated. please use the WildFire - Detonate file v2 instead.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

Palo_Alto_Networks_WildFire_v2

Scripts

SetAndHandleEmpty

Commands

wildfire-upload
wildfire-report

Playbook Inputs

Name	Description	Default Value	Required
File	File object of the file to detonate. The file is taken from the context.	File	Optional
Interval	The duration for executing the polling (in minutes).	1	Optional
Timeout	The duration after which to stop polling and to resume the playbook. (in minutes)	15	Optional
ReportFileType	The resource type to download.		Optional

Playbook Outputs

Path	Description	Type
DBotScore.Score	The actual score.	string
DBotScore.Type	The type of the indicator.	string
File.Type	The file type, e.g. “PE”.	string
File.Size	The file size	number
File.MD5	The MD5 hash of the file.	string
File.Name	The filename.	string
File.SHA1	The SHA1 hash of the file.	string
File	The file object.	unknown
File.SHA256	TheSHA256 hash of the file.	string
File.Malicious	The malicious object.	unknown
File.Malicious.Vendor	The vendor that made the decision that the file is malicious.	string
DBotScore	The DBot object.	unknown
DBotScore.Indicator	The indicator that was tested.	string
DBotScore.Vendor	The vendor used to calculate the score.	string
WildFire.Report	The submission object.	unknown
WildFire.Report.Status	The status of the submission.	string
WildFire.Report.SHA256	The SHA256 hash of the submission.	string
InfoFile	The report file object.	unknown
InfoFile.EntryID	The EntryID of the report file.	string
InfoFile.Extension	The extension of the report file.	string
InfoFile.Name	The name of the report file.	string
InfoFile.Info	The info of the report file.	string
InfoFile.Size	The size of the report file.	number
InfoFile.Type	The type of the report file.	string
WildFire.Report.MD5	The MD5 hash of the submission.	string
WildFire.Report.FileType	The type of the submission.	string
WildFire.Report.Size	The size of the submission.	number

Playbook Image

WildFire - Detonate file

Inputs

File — File object of the file to detonate. The file is taken from the context.
Interval — The duration for executing the polling (in minutes).
Timeout — The duration after which to stop polling and to resume the playbook. (in minutes)
ReportFileType — The resource type to download.

Outputs

DBotScore.Score — The actual score.
DBotScore.Type — The type of the indicator.
File.Type — The file type, e.g. "PE".
File.Size — The file size.
File.MD5 — The MD5 hash of the file.
File.Name — The filename.
File.SHA1 — The SHA1 hash of the file.
File — The file object.
File.SHA256 — TheSHA256 hash of the file.
File.Malicious — The malicious object.
File.Malicious.Vendor — The vendor that made the decision that the file is malicious.
DBotScore — The DBot object.
DBotScore.Indicator — The indicator that was tested.
DBotScore.Vendor — The vendor used to calculate the score.
WildFire.Report — The submission object.
WildFire.Report.Status — The status of the submission.
WildFire.Report.SHA256 — The SHA256 hash of the submission.
InfoFile — The report file object.
InfoFile.EntryID — The EntryID of the report file.
InfoFile.Extension — The extension of the report file.
InfoFile.Name — The name of the report file.
InfoFile.Info — The info of the report file.
InfoFile.Size — The size of the report file.
InfoFile.Type — The type of the report file.
WildFire.Report.MD5 — The MD5 hash of the submission.
WildFire.Report.FileType — The type of the submission.
WildFire.Report.Size — The size of the submission.

Commands used

wildfire-report wildfire-upload

Flowchart

Source

playbook-Detonate_File_-_WildFire.yml

Download History Raw

id: WildFire - Detonate file
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: WildFire - Detonate file
description: |-
  Deprecated. Use WildFire - Detonate file v2 instead.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: ff6c3afb-1f37-491b-8569-f2f9d6a79ff3
    type: start
    task:
      id: ff6c3afb-1f37-491b-8569-f2f9d6a79ff3
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 57.5,
          "y": -20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: d89662d0-dedb-49ff-8cba-4855a985cc38
    type: playbook
    task:
      id: d89662d0-dedb-49ff-8cba-4855a985cc38
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      Ids:
        complex:
          root: WildFire
          accessor: Report.SHA256
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: hash
      PollingCommandName:
        simple: wildfire-report
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: WildFire.Report(val.Status != 'Success').SHA256
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 4d801593-76c0-45bc-880c-46572315ab6d
    type: regular
    task:
      id: 4d801593-76c0-45bc-880c-46572315ab6d
      version: -1
      name: WildFire Get Report
      description: Retrieve results for a file hash using WildFire.
      script: '|||wildfire-report'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      format:
        complex:
          root: inputs.ReportFileType
      hash:
        complex:
          root: WildFire
          accessor: Report.SHA256
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 7cb53d1d-e613-47cd-847e-c1908e384d53
    type: title
    task:
      id: 7cb53d1d-e613-47cd-847e-c1908e384d53
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 57.5,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 55af7034-b0cf-40c7-86a5-f7efd9d31e9b
    type: condition
    task:
      id: 55af7034-b0cf-40c7-86a5-f7efd9d31e9b
      version: -1
      name: Is WildFire sandbox enabled?
      description: Check if integration instance is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: WildFire
                  - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: WildFire-v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 57.5,
          "y": 115
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 8cee3949-c005-4291-8152-14691d22614b
    type: title
    task:
      id: 8cee3949-c005-4291-8152-14691d22614b
      version: -1
      name: Filter only supported files
      description: Check if file type is supported.
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: d6b386f8-698e-42d5-8944-bc6317356f61
    type: regular
    task:
      id: d6b386f8-698e-42d5-8944-bc6317356f61
      version: -1
      name: WildFire Upload File
      description: Uploads a file to WildFire for analysis.
      script: '|||wildfire-upload'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      upload:
        complex:
          root: SupportedFilesToUpload
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: d1c6a572-54e7-4233-8228-daa0f7dcb176
    type: condition
    task:
      id: d1c6a572-54e7-4233-8228-daa0f7dcb176
      version: -1
      name: Did the upload finish successfully?
      description: Checks if the upload was successfully finished.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: WildFire
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: WildFire.Report.Status
                      iscontext: true
                    right:
                      value:
                        simple: Pending
                accessor: Report.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 480,
          "y": 990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: c9040900-138b-4e2d-89d5-a424d4cd7ff4
    type: regular
    task:
      id: c9040900-138b-4e2d-89d5-a424d4cd7ff4
      version: -1
      name: Set ASCII file types
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: SupportedFilesToUpload
      value:
        complex:
          root: inputs.File
          filters:
          - - operator: inList
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: js,hta,vbs,ps1,pl,sh,py
              ignorecase: true
          accessor: EntryID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 690,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 04e9fcb8-1770-4f8e-80c3-34d5d9f2bdfc
    type: regular
    task:
      id: 04e9fcb8-1770-4f8e-80c3-34d5d9f2bdfc
      version: -1
      name: Set Non ASCII file types
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: SupportedFilesToUpload
      value:
        complex:
          root: inputs.File
          filters:
          - - operator: inList
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: APK,JAR,DOC,DOCX,XLS,XLSX,PPT,PPTX,OOXML,PE32,PE,PDF,DMG,PKG,RAR,7Z,ELF,DLL,MSI,RTF,LNK
              ignorecase: true
          - - operator: notContainsString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: ASCII text
              ignorecase: true
          accessor: EntryID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 280,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 4ef96e35-bb0b-4a27-8f95-f98fda94c98e
    type: condition
    task:
      id: 4ef96e35-bb0b-4a27-8f95-f98fda94c98e
      version: -1
      name: Are there any supported files to detonate?
      description: Check if there are any supported files to upload to wildfire for detonation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: SupportedFilesToUpload
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "13_2_yes": 0.55,
      "13_5_#default#": 0.35,
      "16_12_yes": 0.58,
      "16_5_#default#": 0.25,
      "7_5_#default#": 0.26
    },
    "paper": {
      "dimensions": {
        "height": 1620,
        "width": 1012.5,
        "x": 57.5,
        "y": -20
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: File object of the file to detonate. The file is taken from the context.
  playbookInputQuery:
- key: Interval
  value:
    simple: "1"
  required: false
  description: The duration for executing the polling (in minutes).
  playbookInputQuery:
- key: Timeout
  value:
    simple: "15"
  required: false
  description: The duration after which to stop polling and to resume the playbook. (in minutes)
  playbookInputQuery:
- key: ReportFileType
  value: {}
  required: false
  description: The resource type to download.
  playbookInputQuery:
outputs:
- contextPath: DBotScore.Score
  description: The actual score.
  type: string
- contextPath: DBotScore.Type
  description: The type of the indicator.
  type: string
- contextPath: File.Type
  description: The file type, e.g. "PE".
  type: string
- contextPath: File.Size
  description: The file size.
  type: number
- contextPath: File.MD5
  description: The MD5 hash of the file.
  type: string
- contextPath: File.Name
  description: The filename.
  type: string
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
  type: string
- contextPath: File
  description: The file object.
  type: unknown
- contextPath: File.SHA256
  description: TheSHA256 hash of the file.
  type: string
- contextPath: File.Malicious
  description: The malicious object.
  type: unknown
- contextPath: File.Malicious.Vendor
  description: The vendor that made the decision that the file is malicious.
  type: string
- contextPath: DBotScore
  description: The DBot object.
  type: unknown
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
  type: string
- contextPath: DBotScore.Vendor
  description: The vendor used to calculate the score.
  type: string
- contextPath: WildFire.Report
  description: The submission object.
  type: unknown
- contextPath: WildFire.Report.Status
  description: The status of the submission.
  type: string
- contextPath: WildFire.Report.SHA256
  description: The SHA256 hash of the submission.
  type: string
- contextPath: InfoFile
  description: The report file object.
  type: unknown
- contextPath: InfoFile.EntryID
  description: The EntryID of the report file.
  type: string
- contextPath: InfoFile.Extension
  description: The extension of the report file.
  type: string
- contextPath: InfoFile.Name
  description: The name of the report file.
  type: string
- contextPath: InfoFile.Info
  description: The info of the report file.
  type: string
- contextPath: InfoFile.Size
  description: The size of the report file.
  type: number
- contextPath: InfoFile.Type
  description: The type of the report file.
  type: string
- contextPath: WildFire.Report.MD5
  description: The MD5 hash of the submission.
  type: string
- contextPath: WildFire.Report.FileType
  description: The type of the submission.
  type: string
- contextPath: WildFire.Report.Size
  description: The size of the submission.
  type: number
tests:
- No tests (deprecated)
fromversion: 5.0.0
deprecated: true
supportedModules:
- agentix
- xsiam