Detonate File - ThreatGrid Deprecated

Deprecated. Use Detonate File - ThreatGrid v2 instead.

Cisco Secure Malware Analytics · 10 tasks · 9 inputs · 16 outputs

Details

ID	`detonate_file_-_threatgrid`
From Version	5.0.0
Tasks	10

README

Detonates one or more files using the ThreatGrid integration. This playbook returns relevant reports to the War Room and file reputations to the context data.

The detonation supports the following file types: EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

Commands

threat-grid-get-samples-state
threat-grid-upload-sample

Playbook Inputs

Name	Description	Default Value	Source	Required
File	The file object of the file to detonate.	None	File	Optional
FileName	The name of the file to detonate.	file-detonated-via-demisto	-	Optional
VM	The VM to use (string).	-	-	Optional
playbook	The name of the Threat Grid playbook to apply to this sample run.	Default	-	Optional
Private	The sample is marked private if this is present, and set to any value other than false.	-	-	Optional
Source	The string used for identifying the source of the detonation (user defined).	-	-	Optional
Tags	The comma-separated list of tags applied to this sample.	-	-	Optional
Interval	The polling frequency. How often the polling command should run (in minutes).	1	-	Optional
Timeout	How much time to wait before a timeout occurs (in minutes).	15	-	Optional

Playbook Outputs

Path	Description	Type
File.Malicious	The file malicious description.	unknown
File.Malicious.Vendor	The vendor that made the decision that the file is malicious.	string
File.Type	The file type. For example “PE”.	string
File.Size	The file size.	number
File.MD5	The MD5 hash of the file.	string
File.Name	The filename.	string
File.SHA1	The SHA1 hash of the file.	string
File	The file object.	unknown
File.SHA256	The SHA256 hash of the file.	string
DBotScore	The DBotScore object.	unknown
DBotScore.Indicator	The indicator we tested.	string
DBotScore.Type	The type of the indicator.	string
DBotScore.Vendor	The vendor used to calculate the score.	string
DBotScore.Score	The actual score.	number
Sample.State	The sample state.	unknown
Sample.ID	The sample ID.	unknown

Playbook Image

Detonate_File_ThreatGrid

Inputs

File — File object of the file to detonate.
FileName — Name of the file to detonate.
VM — The VM to use (string)
playbook — Name of the Threat Grid playbook to apply to this sample run
Private — If the value is set to 'False', the sample will not be private. Any value other than 'False' will set the sample to private.
Source — a string used for identifying the source of the detonation (user defined)
Tags — A comma-separated list of tags applied to this sample.
Interval — Polling frequency - how often the polling command should run (minutes)
Timeout — How much time to wait before a timeout occurs (minutes)

Outputs

File.Malicious — The File malicious description
File.Malicious.Vendor — For malicious files, the vendor that made the decision
File.Type — File type e.g. "PE"
File.Size — File size
File.MD5 — MD5 hash of the file
File.Name — Filename
File.SHA1 — SHA1 hash of the file
File — The File object
File.SHA256 — SHA256 hash of the file
DBotScore — The DBotScore object
DBotScore.Indicator — The indicator we tested
DBotScore.Type — The type of the indicator
DBotScore.Vendor — Vendor used to calculate the score
DBotScore.Score — The actual score
ThreatGrid.Sample.State — The sample state.
ThreatGrid.Sample.ID — The sample ID.

Commands used

threat-grid-get-samples-state threat-grid-upload-sample

Flowchart

Source

playbook-Detonate_File_-_ThreatGrid.yml playbook-Detonate_File_-_ThreatGrid_v2.yml playbook-Detonate_File_-_ThreatGrid_v2_README.md

Download History Raw

id: detonate_file_-_threatgrid
version: -1
name: Detonate File - ThreatGrid
description: Deprecated. Use Detonate File - ThreatGrid v2 instead.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 29dcbc1e-0bb0-45f1-82ed-eb65b6ce039d
    type: start
    task:
      id: 29dcbc1e-0bb0-45f1-82ed-eb65b6ce039d
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 1378d2a9-9fcc-47d0-817f-9d9145740752
    type: condition
    task:
      id: 1378d2a9-9fcc-47d0-817f-9d9145740752
      version: -1
      name: Is ThreatGrid enabled?
      description: Verify that there is a valid instance of ThreatGrid is enabled
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "16"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Threat Grid
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: e6a670a6-eff4-4b16-883b-f08e7d7e7bd3
    type: title
    task:
      id: e6a670a6-eff4-4b16-883b-f08e7d7e7bd3
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 70,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 80dc5945-a851-469d-8445-3930393aa5d0
    type: regular
    task:
      id: 80dc5945-a851-469d-8445-3930393aa5d0
      version: -1
      name: ThreatGrid Get Samples State
      description: Get the sample state.
      script: '|||threat-grid-get-samples-state'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      ids:
        complex:
          root: ThreatGrid
          accessor: Sample.ID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 754b0562-8ec3-4c58-8345-748d9cd51a72
    type: regular
    task:
      id: 754b0562-8ec3-4c58-8345-748d9cd51a72
      version: -1
      name: Set file to context
      description: Set the file object into context.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      append: {}
      key:
        simple: File
      value:
        complex:
          root: inputs.File
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: 97fcf073-c63a-42d4-8e65-ba6d4814d859
    type: playbook
    task:
      id: 97fcf073-c63a-42d4-8e65-ba6d4814d859
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Ids:
        complex:
          root: ThreatGrid
          accessor: Sample.ID
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: ids
      PollingCommandName:
        simple: threat-grid-get-samples-state
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: ThreatGrid.Sample(val.State!=='succ' && val.State!=='fail').ID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: 93e193f6-a438-4349-861c-f0f99b4b3997
    type: condition
    task:
      id: 93e193f6-a438-4349-861c-f0f99b4b3997
      version: -1
      name: Is there a file to detonate?
      description: Checks whether there's a file to detonate - if not then the detonation is skipped
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.File
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: 5eb99a51-d296-41dd-8a6e-93fceabc767f
    type: condition
    task:
      id: 5eb99a51-d296-41dd-8a6e-93fceabc767f
      version: -1
      name: Is the file type supported?
      description: Will not continue the execution if file type is not supported.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: match
          left:
            value:
              simple: File.Type
            iscontext: true
          right:
            value:
              simple: .*(?:EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b
          ignorecase: true
        - operator: match
          left:
            value:
              simple: File.Extension
            iscontext: true
          right:
            value:
              simple: .*(?:EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b
          ignorecase: true
        - operator: match
          left:
            value:
              simple: File.Info
            iscontext: true
          right:
            value:
              simple: .*(?:EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: 701d7a32-0c81-4fd3-83c9-fbc7aa6efd30
    type: condition
    task:
      id: 701d7a32-0c81-4fd3-83c9-fbc7aa6efd30
      version: -1
      name: Is the file size bigger than 0?
      description: Check that fail size is bigger than 0
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "20"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThan
          left:
            value:
              simple: File.Size
            iscontext: true
          right:
            value:
              simple: "0"
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: 4fe8b8b6-097b-42e5-8d2a-7d7693101c90
    type: regular
    task:
      id: 4fe8b8b6-097b-42e5-8d2a-7d7693101c90
      version: -1
      name: ThreatGrid Upload File
      description: Submits a sample to threat grid for analysis
      script: '|||threat-grid-upload-sample'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      file-id:
        complex:
          root: File
          filters:
          - - operator: greaterThan
              left:
                value:
                  simple: File.Size
                iscontext: true
              right:
                value:
                  simple: "0"
          - - operator: match
              left:
                value:
                  simple: File.Type
                iscontext: true
              right:
                value:
                  simple: .*(?:EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b
              ignorecase: true
            - operator: match
              left:
                value:
                  simple: File.Extension
                iscontext: true
              right:
                value:
                  simple: .*(?:EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b
              ignorecase: true
            - operator: match
              left:
                value:
                  simple: File.Info
                iscontext: true
              right:
                value:
                  simple: .*(?:EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b
              ignorecase: true
          accessor: EntryID
      filename:
        complex:
          root: inputs.FileName
      playbook: {}
      private:
        complex:
          root: inputs.Private
      tags:
        complex:
          root: inputs.Tags
      vm:
        complex:
          root: inputs.VM
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "5_6_#default#": 0.44
    },
    "paper": {
      "dimensions": {
        "height": 1610,
        "width": 830,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: File object of the file to detonate.
  playbookInputQuery:
- key: FileName
  value:
    simple: file-detonated-via-demisto
  required: false
  description: Name of the file to detonate.
  playbookInputQuery:
- key: VM
  value: {}
  required: false
  description: The VM to use (string)
  playbookInputQuery:
- key: playbook
  value:
    simple: default
  required: false
  description: Name of the Threat Grid playbook to apply to this sample run
  playbookInputQuery:
- key: Private
  value:
    simple: "True"
  required: false
  description: If the value is set to 'False', the sample will not be private. Any value other than 'False' will set the sample to private.
  playbookInputQuery:
- key: Source
  value: {}
  required: false
  description: a string used for identifying the source of the detonation (user defined)
  playbookInputQuery:
- key: Tags
  value: {}
  required: false
  description: A comma-separated list of tags applied to this sample.
  playbookInputQuery:
- key: Interval
  value:
    simple: "1"
  required: false
  description: Polling frequency - how often the polling command should run (minutes)
  playbookInputQuery:
- key: Timeout
  value:
    simple: "15"
  required: false
  description: How much time to wait before a timeout occurs (minutes)
  playbookInputQuery:
outputs:
- contextPath: File.Malicious
  description: The File malicious description
  type: unknown
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision
  type: string
- contextPath: File.Type
  description: File type e.g. "PE"
  type: string
- contextPath: File.Size
  description: File size
  type: number
- contextPath: File.MD5
  description: MD5 hash of the file
  type: string
- contextPath: File.Name
  description: Filename
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file
  type: string
- contextPath: File
  description: The File object
  type: unknown
- contextPath: File.SHA256
  description: SHA256 hash of the file
  type: string
- contextPath: DBotScore
  description: The DBotScore object
  type: unknown
- contextPath: DBotScore.Indicator
  description: The indicator we tested
  type: string
- contextPath: DBotScore.Type
  description: The type of the indicator
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score
  type: string
- contextPath: DBotScore.Score
  description: The actual score
  type: number
- contextPath: ThreatGrid.Sample.State
  description: The sample state.
- contextPath: ThreatGrid.Sample.ID
  description: The sample ID.
fromversion: 5.0.0
deprecated: true
tests:
- No tests (deprecated)