Detonate File - ThreatGrid Deprecated

Deprecated. Use Detonate File - ThreatGrid v2 instead.

Cisco Secure Malware Analytics · 10 tasks · 9 inputs · 16 outputs

Details

IDdetonate_file_-_threatgrid
From Version5.0.0
Tasks10

README

Detonates one or more files using the ThreatGrid integration. This playbook returns relevant reports to the War Room and file reputations to the context data.

The detonation supports the following file types: EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

  • Set

Commands

  • threat-grid-get-samples-state
  • threat-grid-upload-sample

Playbook Inputs

Name Description Default Value Source Required
File The file object of the file to detonate. None File Optional
FileName The name of the file to detonate. file-detonated-via-demisto - Optional
VM The VM to use (string). - - Optional
playbook The name of the Threat Grid playbook to apply to this sample run. Default - Optional
Private The sample is marked private if this is present, and set to any value other than false. - - Optional
Source The string used for identifying the source of the detonation (user defined). - - Optional
Tags The comma-separated list of tags applied to this sample. - - Optional
Interval The polling frequency. How often the polling command should run (in minutes). 1 - Optional
Timeout How much time to wait before a timeout occurs (in minutes). 15 - Optional

Playbook Outputs

Path Description Type
File.Malicious The file malicious description. unknown
File.Malicious.Vendor The vendor that made the decision that the file is malicious. string
File.Type The file type. For example “PE”. string
File.Size The file size. number
File.MD5 The MD5 hash of the file. string
File.Name The filename. string
File.SHA1 The SHA1 hash of the file. string
File The file object. unknown
File.SHA256 The SHA256 hash of the file. string
DBotScore The DBotScore object. unknown
DBotScore.Indicator The indicator we tested. string
DBotScore.Type The type of the indicator. string
DBotScore.Vendor The vendor used to calculate the score. string
DBotScore.Score The actual score. number
Sample.State The sample state. unknown
Sample.ID The sample ID. unknown

Playbook Image

Detonate_File_ThreatGrid

Inputs

  • File — File object of the file to detonate.
  • FileName — Name of the file to detonate.
  • VM — The VM to use (string)
  • playbook — Name of the Threat Grid playbook to apply to this sample run
  • Private — If the value is set to 'False', the sample will not be private. Any value other than 'False' will set the sample to private.
  • Source — a string used for identifying the source of the detonation (user defined)
  • Tags — A comma-separated list of tags applied to this sample.
  • Interval — Polling frequency - how often the polling command should run (minutes)
  • Timeout — How much time to wait before a timeout occurs (minutes)

Outputs

  • File.Malicious — The File malicious description
  • File.Malicious.Vendor — For malicious files, the vendor that made the decision
  • File.Type — File type e.g. "PE"
  • File.Size — File size
  • File.MD5 — MD5 hash of the file
  • File.Name — Filename
  • File.SHA1 — SHA1 hash of the file
  • File — The File object
  • File.SHA256 — SHA256 hash of the file
  • DBotScore — The DBotScore object
  • DBotScore.Indicator — The indicator we tested
  • DBotScore.Type — The type of the indicator
  • DBotScore.Vendor — Vendor used to calculate the score
  • DBotScore.Score — The actual score
  • ThreatGrid.Sample.State — The sample state.
  • ThreatGrid.Sample.ID — The sample ID.

Commands used

threat-grid-get-samples-state threat-grid-upload-sample

Flowchart

yes yes yes yes Start Start Is ThreatGrid enabled? Is ThreatGrid enabled? Done Done ThreatGrid Get Samples State - threat-grid-get-samples-state ThreatGrid Get Samples State threat-grid-get-samples-state Set file to context - Set Set file to context Set GenericPolling - GenericPolling GenericPolling GenericPolling Is there a file to detonate? Is there a file to detonate? Is the file type supported? Is the file type supported? Is the file size bigger than 0? Is the file size bigger t... ThreatGrid Upload File - threat-grid-upload-sample ThreatGrid Upload File threat-grid-upload-sample

Source

playbook-Detonate_File_-_ThreatGrid.yml playbook-Detonate_File_-_ThreatGrid_v2.yml playbook-Detonate_File_-_ThreatGrid_v2_README.md
Download History Raw 
Detonate one or more files using the ThreatGrid integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM

## Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks
This playbook does not use any sub-playbooks.

### Integrations
* ThreatGridv2

### Scripts
* Set

### Commands
* threat-grid-sample-upload

## Playbook Inputs
---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| File | File object of the file to detonate. | File | Required |

## Playbook Outputs
---

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| File.Type | File type e.g. "PE" | string |
| File.Size | File Size | number |
| File.Extension | File Extension | string |

## Playbook Image
---
![Detonate File - ThreatGrid](../doc_files/Detonate_File_-_ThreatGrid_v2.png)