Detonate URL - CrowdStrike Deprecated

Deprecated. Use the cs-falcon-sandbox-submit-url command with polling=true instead.

CrowdStrike Falcon Sandbox · 8 tasks · 5 inputs · 14 outputs

Details

IDdetonate_url_-_crowdstrike
From Version5.0.0
Tasks8

README

(Deprecated). Use the command cs-falcon-sandbox-submit-url with polling=true instead.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

  • VxStream

Scripts

This playbook does not use any scripts.

Commands

  • crowdstrike-scan
  • crowdstrike-submit-url

Playbook Inputs

Name Description Default Value Source Required
URL The URL to detonate. Data URL Optional
EnvironmentID The environment ID to submit the file to. To get all IDs run the crowdstrike-get-environments command. 100 - Optional
Interval The polling frequency. How often the polling command should run (in minutes). 5 - Optional
Timeout How much time to wait before a timeout occurs (in minutes). 30 - Optional

Playbook Outputs

Path Description Type
File.SHA256 The SHA256 hash of the file. string
File.Malicious The file’s malicious description. unknown
File.Type The file type. For example, “PE”. string
File.Size The file size. number
File.MD5 The MD5 hash of the file. string
File.Name The filename. string
File.SHA1 The SHA1 hash of the file. string
File The file object. unknown
File.Malicious.Vendor The vendor that made the decision that the file was malicious. string
DBotScore The DBotScore object. unknown
DBotScore.Indicator The indicator we tested. string
DBotScore.Type The type of the indicator. string
DBotScore.Vendor The vendor used to calculate the score. string
DBotScore.Score The actual score. number

Playbook Image

Detonate_URL_CrowdStrike

Inputs

  • URL — URL to detonate.
  • EnvironmentID — The environment ID to submit the file to. To get all IDs run the crowdstrike-get-environments command.
  • Interval — Polling frequency - how often the polling command should run (minutes).
  • Timeout — How much time to wait before a timeout occurs (minutes).
  • dontThrowErrorOnFileDetonation — Should the playbook fail due to an unsupported file type? use true or false.

Outputs

  • File.SHA256 — The SHA256 hash of the file.
  • File.Malicious — The file malicious description.
  • File.Type — File type, for example "PE".
  • File.Size — The file size.
  • File.MD5 — The MD5 hash of the file.
  • File.Name — The file name.
  • File.SHA1 — The SHA1 hash of the file.
  • File — The file object.
  • File.Malicious.Vendor — The vendor that decided the file was malicious.
  • DBotScore — The DBotScore object.
  • DBotScore.Indicator — The tested indicator.
  • DBotScore.Type — The indicator type.
  • DBotScore.Vendor — The vendor used to calculate the score.
  • DBotScore.Score — The actual score.

Commands used

crowdstrike-scan crowdstrike-submit-url

Flowchart

yes yes yes Start Start Is CrowdStrike enabled? Is CrowdStrike enabled? Done Done CrowdStrike Scan - crowdstrike-scan CrowdStrike Scan crowdstrike-scan CrowdStrike Upload Sample - crowdstrike-submit-url CrowdStrike Upload Sample crowdstrike-submit-url Is there a URL to detonate? Is there a URL to detonate? GenericPolling - GenericPolling GenericPolling GenericPolling Was a job created ? (A job is not created if the file type is not supported.) Was a job created ? (A jo...

Source

playbook-Detonate_URL_-_CrowdStrike.yml
Download History Raw 
id: detonate_url_-_crowdstrike
version: -1
name: Detonate URL - CrowdStrike
fromversion: 5.0.0
description: Deprecated. Use the cs-falcon-sandbox-submit-url command with polling=true instead.
starttaskid: "0"
deprecated: true
tasks:
  "0":
    id: "0"
    taskid: 7e5790ea-f1c7-4f11-8d48-429dd24f4891
    type: start
    task:
      id: 7e5790ea-f1c7-4f11-8d48-429dd24f4891
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: be76ffb3-369b-4003-888f-59bc9b4ca113
    type: condition
    task:
      id: be76ffb3-369b-4003-888f-59bc9b4ca113
      version: -1
      name: Is CrowdStrike enabled?
      description: |
        Verify there is a valid instance of CrowdStrike enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: VxStream
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 755a05f3-fba3-45c7-87bb-fad3c2606f93
    type: title
    task:
      id: 755a05f3-fba3-45c7-87bb-fad3c2606f93
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 4a4fb455-3725-4948-8a5c-98028d2073cf
    type: regular
    task:
      id: 4a4fb455-3725-4948-8a5c-98028d2073cf
      version: -1
      name: CrowdStrike Scan
      description: Downloads the PDF report to the War Room.
      script: VxStream|||crowdstrike-scan
      type: regular
      iscommand: true
      brand: VxStream
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      file:
        complex:
          root: File
          accessor: SHA256
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: db9e268a-d1ff-4aa9-83c7-2bb90fa1ccd8
    type: regular
    task:
      id: db9e268a-d1ff-4aa9-83c7-2bb90fa1ccd8
      version: -1
      name: CrowdStrike Upload Sample
      description: Uploads a sample to CrowdStrike.
      script: VxStream|||crowdstrike-submit-url
      type: regular
      iscommand: true
      brand: VxStream
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      dontThrowErrorOnFileDetonation:
        complex:
          root: inputs.dontThrowErrorOnFileDetonation
      environmentID:
        complex:
          root: inputs.EnvironmentID
      url:
        complex:
          root: inputs.URL
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: 8e34e69c-6900-4586-8342-57dc35adee90
    type: condition
    task:
      id: 8e34e69c-6900-4586-8342-57dc35adee90
      version: -1
      name: Is there a URL to detonate?
      description: Checks whether there's a file to detonate.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: bda1000b-f890-47a5-8432-681b470ed1b0
    type: playbook
    task:
      id: bda1000b-f890-47a5-8432-681b470ed1b0
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (Optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      AdditionalPollingCommandArgNames: {}
      AdditionalPollingCommandArgValues: {}
      Ids:
        complex:
          root: File
          accessor: SHA256
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: file
      PollingCommandName:
        simple: crowdstrike-scan
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: File(val.state === 'NO_CONTENT').hash
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: 2f73943a-4e0e-4375-8c46-7ad0d607944f
    type: condition
    task:
      id: 2f73943a-4e0e-4375-8c46-7ad0d607944f
      version: -1
      name: Was a job created ? (A job is not created if the file type is not supported.)
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "16"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: CrowdStrike
                accessor: JobID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1260,
        "width": 605,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: false
  description: URL to detonate.
  playbookInputQuery:
- key: EnvironmentID
  value:
    simple: "100"
  required: false
  description: The environment ID to submit the file to. To get all IDs run the crowdstrike-get-environments
    command.
  playbookInputQuery:
- key: Interval
  value:
    simple: "5"
  required: false
  description: Polling frequency - how often the polling command should run (minutes).
  playbookInputQuery:
- key: Timeout
  value:
    simple: "30"
  required: false
  description: How much time to wait before a timeout occurs (minutes).
  playbookInputQuery:
- key: dontThrowErrorOnFileDetonation
  value:
    simple: "false"
  required: false
  description: |-
    Should the playbook fail due to an unsupported file type?
    use true or false.
  playbookInputQuery:
outputs:
- contextPath: File.SHA256
  description: The SHA256 hash of the file.
  type: string
- contextPath: File.Malicious
  description: The file malicious description.
  type: unknown
- contextPath: File.Type
  description: File type, for example "PE".
  type: string
- contextPath: File.Size
  description: The file size.
  type: number
- contextPath: File.MD5
  description: The MD5 hash of the file.
  type: string
- contextPath: File.Name
  description: The file name.
  type: string
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
  type: string
- contextPath: File
  description: The file object.
  type: unknown
- contextPath: File.Malicious.Vendor
  description: The vendor that decided the file was malicious.
  type: string
- contextPath: DBotScore
  description: The DBotScore object.
  type: unknown
- contextPath: DBotScore.Indicator
  description: The tested indicator.
  type: string
- contextPath: DBotScore.Type
  description: The indicator type.
  type: string
- contextPath: DBotScore.Vendor
  description: The vendor used to calculate the score.
  type: string
- contextPath: DBotScore.Score
  description: The actual score.
  type: number
tests:
- No test - deprecated.