Detonate File From URL - WildFire Deprecated

Deprecated. Use Detonate File From URL - WildFire v2 instead.

WildFire by Palo Alto Networks · 8 tasks · 4 inputs · 30 outputs

Details

IDdetonate_file_from_url_-_wildfire
From Version5.0.0
Tasks8

README

Detonates one or more files using the Wildfire integration. This playbook returns relevant reports to the War Room and file reputations to the context data.

The detonation supports the following file types:
APK, JAR, DOC, DOCX, RTF, XLS, XLSX, PPT, PPTX, XML, PE32, PDF, DMG, PKG, RAR, 7Z.

This playbook is deprecated. please use the Detonate File From URL - WildFire v2 instead.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

  • wildfire-upload-file-url
  • wildfire-report

Playbook Inputs

Name Description Default Value Source Required
FileURL The URL of the web file to detonate. The FileUrl is taken from the context. None FileURL Optional
Interval The duration for executing the pooling (in minutes). 1 - Optional
Timeout The duration after which to stop pooling and to resume the playbook (in minutes). 15 - Optional
ReportFileType The resource type to download. The default is “pdf”. XML is also possible. - - Optional

Playbook Outputs

Path Description Type
DBotScore The DBotScore object. unknown
DBotScore.Score The actual score. number
File.Size The file size. number
File.MD5 The MD5 hash of the file. string
File.SHA1 The SHA1 hash of the file. string
File.Type The file type. For example, “PE”. string
File.SHA256 The SHA256 hash of the file. string
File.EntryID The entry ID of the sample. string
File.Malicious.Vendor The vendor that made the decision that the file is malicious. string
File.Name The filename. string
File.Malicious.Description The reason for the vendor to make the decision that the file is malicious. string
DBotScore.Indicator The indicator that was tested. string
DBotScore.Type The type of the indicator. string
DBotScore.Vendor The vendor used to calculate the score. string
IP.Address The IP address’s relevant to the sample. string
File The fle object. unknown
InfoFile The report file object. unknown
InfoFile.EntryID The EntryID of the report file. string
InfoFile.Extension The extension of the report file. string
InfoFile.Name The name of the report file. string
InfoFile.Info The info of the report file. string
InfoFile.Size The size of the report file. number
InfoFile.Type The type of the report file. string
File.Malicious The malicious object. unknown
WildFire.Report The submission object. unknown
WildFire.Report.MD5 The MD5 hash of the submission. string
WildFire.Report.SHA256 The SHA256 hash of the submission. string
WildFire.Report.FileType The type of the submission. string
WildFire.Report.Status The status of the submission. string
WildFire.Report.Size The size of the submission. number

Playbook Image

Detonate_File_From_URL_WildFire

Inputs

  • FileURL — URL of the web file to detonate. The FileUrl is taken from the context.
  • Interval — Duration for executing the pooling (in minutes)
  • Timeout — The duration after which to stop pooling and to resume the playbook (in minutes)
  • ReportFileType — The resource type to download. Default is pdf. xml is also possible.

Outputs

  • DBotScore — The DBotScore object.
  • DBotScore.Score — The actual score.
  • File.Size — File size.
  • File.MD5 — MD5 hash of the file.
  • File.SHA1 — SHA1 hash of the file.
  • File.Type — File type e.g. "PE".
  • File.SHA256 — SHA256 hash of the file.
  • File.EntryID — The Entry ID of the sample.
  • File.Malicious.Vendor — For malicious files, the vendor that made the decision.
  • File.Name — Filename.
  • File.Malicious.Description — For malicious files, the reason for the vendor to make the decision.
  • DBotScore.Indicator — The indicator we tested.
  • DBotScore.Type — The type of the indicator.
  • DBotScore.Vendor — Vendor used to calculate the score.
  • IP.Address — IP's relevant to the sample.
  • File — The File object.
  • InfoFile — The report file object.
  • InfoFile.EntryID — The EntryID of the report file.
  • InfoFile.Extension — The extension of the report file.
  • InfoFile.Name — The name of the report file.
  • InfoFile.Info — The info of the report file.
  • InfoFile.Size — The size of the report file.
  • InfoFile.Type — The type of the report file.
  • File.Malicious — The malicious object.
  • WildFire.Report — The submission object.
  • WildFire.Report.MD5 — MD5 of the submission.
  • WildFire.Report.SHA256 — SHA256 of the submission.
  • WildFire.Report.FileType — The type of the submission.
  • WildFire.Report.Status — The status of the submission.
  • WildFire.Report.Size — The size of the submission.

Commands used

wildfire-report wildfire-upload-file-url

Flowchart

yes yes yes Start Start WildFire Upload File URL - wildfire-upload-file-url WildFire Upload File URL wildfire-upload-file-url GenericPolling - GenericPolling GenericPolling GenericPolling Done Done Is there a File to detonate? Is there a File to detonate? Is WildFire sandbox enabled? Is WildFire sandbox enabled? WildFire Get Report - wildfire-report WildFire Get Report wildfire-report Was upload finished successfully? Was upload finished succe...

Source

playbook-Detonate_File_From_URL_-_WildFire.yml
Download History Raw 
id: detonate_file_from_url_-_wildfire
version: -1
name: Detonate File From URL - WildFire
description: |-
  Deprecated. Use Detonate File From URL - WildFire v2 instead.
fromversion: 5.0.0
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 219dcb92-ee7d-420e-816e-3f70b24bd953
    type: start
    task:
      id: 219dcb92-ee7d-420e-816e-3f70b24bd953
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 9a30f2f0-d0e6-44d8-883b-1eb092c13372
    type: regular
    task:
      id: 9a30f2f0-d0e6-44d8-883b-1eb092c13372
      version: -1
      name: WildFire Upload File URL
      description: URL of remote file to be uploaded
      script: '|||wildfire-upload-file-url'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      upload:
        complex:
          root: inputs.FileURL
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: 4f0aa551-1874-4223-875d-9701c6192be6
    type: playbook
    task:
      id: 4f0aa551-1874-4223-875d-9701c6192be6
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Ids:
        complex:
          root: WildFire
          accessor: Report.SHA256
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: hash
      PollingCommandName:
        simple: wildfire-report
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: WildFire.Report(val.Status != 'Success').SHA256
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 11650265-0035-421f-8e92-143af887b7a7
    type: title
    task:
      id: 11650265-0035-421f-8e92-143af887b7a7
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: 4a6315f7-7947-4cfc-8554-4e6b3edb4478
    type: condition
    task:
      id: 4a6315f7-7947-4cfc-8554-4e6b3edb4478
      version: -1
      name: Is there a File to detonate?
      description: Look for file URLs to detonate
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.FileURL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: 2a98f575-de73-4805-874d-87f4af43d99b
    type: condition
    task:
      id: 2a98f575-de73-4805-874d-87f4af43d99b
      version: -1
      name: Is WildFire sandbox enabled?
      description: Check if integration instance is enabled
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: WildFire
                transformers:
                - operator: getField
                  args:
                    field:
                      value:
                        simple: state
            iscontext: true
          right:
            value:
              simple: active
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: 83af3952-dd69-4765-8662-3b5371043d46
    type: regular
    task:
      id: 83af3952-dd69-4765-8662-3b5371043d46
      version: -1
      name: WildFire Get Report
      description: Retrieve results for a file hash using WildFire
      script: '|||wildfire-report'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      format:
        complex:
          root: inputs.ReportFileType
      hash:
        complex:
          root: WildFire
          accessor: Report.SHA256
      md5: {}
      verbose: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: df8f3151-deb4-4477-883a-b251e2af3b71
    type: condition
    task:
      id: df8f3151-deb4-4477-883a-b251e2af3b71
      version: -1
      name: Was upload finished successfully?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: WildFire
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: WildFire.Report.Status
                      iscontext: true
                    right:
                      value:
                        simple: Pending
                accessor: Report.URL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1260,
        "width": 605,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: FileURL
  value:
    complex:
      root: FileURL
  required: false
  description: URL of the web file to detonate. The FileUrl is taken from the context.
- key: Interval
  value:
    simple: "1"
  required: false
  description: Duration for executing the pooling (in minutes)
- key: Timeout
  value:
    simple: "15"
  required: false
  description: The duration after which to stop pooling and to resume the playbook (in minutes)
- key: ReportFileType
  value: {}
  required: false
  description: The resource type to download. Default is pdf. xml is also possible.
outputs:
- contextPath: DBotScore
  description: The DBotScore object.
  type: unknown
- contextPath: DBotScore.Score
  description: The actual score.
  type: number
- contextPath: File.Size
  description: File size.
  type: number
- contextPath: File.MD5
  description: MD5 hash of the file.
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file.
  type: string
- contextPath: File.Type
  description: File type e.g. "PE".
  type: string
- contextPath: File.SHA256
  description: SHA256 hash of the file.
  type: string
- contextPath: File.EntryID
  description: The Entry ID of the sample.
  type: string
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision.
  type: string
- contextPath: File.Name
  description: Filename.
  type: string
- contextPath: File.Malicious.Description
  description: For malicious files, the reason for the vendor to make the decision.
  type: string
- contextPath: DBotScore.Indicator
  description: The indicator we tested.
  type: string
- contextPath: DBotScore.Type
  description: The type of the indicator.
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score.
  type: string
- contextPath: IP.Address
  description: IP's relevant to the sample.
  type: string
- contextPath: File
  description: The File object.
  type: unknown
- contextPath: InfoFile
  description: The report file object.
  type: unknown
- contextPath: InfoFile.EntryID
  description: The EntryID of the report file.
  type: string
- contextPath: InfoFile.Extension
  description: The extension of the report file.
  type: string
- contextPath: InfoFile.Name
  description: The name of the report file.
  type: string
- contextPath: InfoFile.Info
  description: The info of the report file.
  type: string
- contextPath: InfoFile.Size
  description: The size of the report file.
  type: number
- contextPath: InfoFile.Type
  description: The type of the report file.
  type: string
- contextPath: File.Malicious
  description: The malicious object.
  type: unknown
- contextPath: WildFire.Report
  description: The submission object.
  type: unknown
- contextPath: WildFire.Report.MD5
  description: MD5 of the submission.
  type: string
- contextPath: WildFire.Report.SHA256
  description: SHA256 of the submission.
  type: string
- contextPath: WildFire.Report.FileType
  description: The type of the submission.
  type: string
- contextPath: WildFire.Report.Status
  description: The status of the submission.
  type: string
- contextPath: WildFire.Report.Size
  description: The size of the submission.
  type: number
tests:
- No tests (deprecated)
deprecated: true
supportedModules:
- agentix
- xsiam