Detonate URL - Generic Deprecated

id: detonate_url_-_generic
version: -1
deprecated: true
name: Detonate URL - Generic
description: Deprecated. Use Detonate URL - Generic v1.5 playbook instead. Detonate URL through active integrations that support URL detonation.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: ab416b1d-600a-47a5-89dc-64d0f0002db6
    type: start
    task:
      id: ab416b1d-600a-47a5-89dc-64d0f0002db6
      version: -1
      name: ""
      description: Playbook start point
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
      - "13"
      - "12"
      - "15"
      - "16"
      - "17"
      - "18"
      - "19"
      - "20"
      - "21"
      - "23"
      - "24"
      - "25"
      - "26"
      - "27"
      - "28"
      - "29"
      - "31"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3705,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "3":
    id: "3"
    taskid: 91ee56ee-91ac-4199-89fe-50ad796c6b02
    type: title
    task:
      id: 91ee56ee-91ac-4199-89fe-50ad796c6b02
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 4135,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "11":
    id: "11"
    taskid: 754e447b-20d7-4ab6-8713-97409910d090
    type: playbook
    task:
      id: 754e447b-20d7-4ab6-8713-97409910d090
      version: -1
      name: Detonate URL - ThreatGrid
      description: Detonates one or more URLs using the Threat Grid integration. This playbook returns relevant reports to the War Room and URL reputations to the context data.
      playbookName: Detonate URL - ThreatGrid
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      "#none#":
      - "3"
    scriptarguments:
      URL:
        complex:
          root: inputs.URL
          accessor: Data
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "12":
    id: "12"
    taskid: 237ce1af-7984-4df7-8eea-e6577bf59c4a
    type: playbook
    task:
      id: 237ce1af-7984-4df7-8eea-e6577bf59c4a
      version: -1
      name: Detonate URL - McAfee ATD
      description: Detonates a URL using the McAfee Advanced Threat Defense sandbox integration.
      playbookName: Detonate URL - McAfee ATD
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      "#none#":
      - "3"
    scriptarguments:
      URL:
        complex:
          root: inputs.URL
          accessor: Data
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 480,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "13":
    id: "13"
    taskid: 22124bae-451b-432b-88e6-1a9affb9ee16
    type: playbook
    task:
      id: 22124bae-451b-432b-88e6-1a9affb9ee16
      version: -1
      name: Detonate URL - JoeSecurity
      description: |-
        Detonates one or more URLs using the Joe Security sandbox integration.
        Returns relevant reports to the War Room and URL reputations to the context data.
      playbookName: Detonate URL - JoeSecurity
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      "#none#":
      - "3"
    scriptarguments:
      URL:
        complex:
          root: inputs.URL
          accessor: Data
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 910,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "15":
    id: "15"
    taskid: 481f79ec-f360-4b69-8881-98b67f23eedb
    type: playbook
    task:
      id: 481f79ec-f360-4b69-8881-98b67f23eedb
      version: -1
      name: Detonate URL - Lastline v2
      description: Detonates a URL using the Lastline sandbox integration.
      playbookName: Detonate URL - Lastline v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      "#none#":
      - "3"
    scriptarguments:
      URL:
        complex:
          root: inputs.URL
          accessor: Data
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "16":
    id: "16"
    taskid: bf269b42-9e68-4fe8-8ae1-f197a0678116
    type: playbook
    task:
      id: bf269b42-9e68-4fe8-8ae1-f197a0678116
      version: -1
      name: Detonate URL - Cuckoo
      description: Detonating URL with Cuckoo
      playbookName: Detonate URL - Cuckoo
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      "#none#":
      - "3"
    scriptarguments:
      URL:
        complex:
          root: inputs.URL
          accessor: Data
      interval:
        simple: "1"
      timeout:
        simple: "10"
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 1770,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "17":
    id: "17"
    taskid: 527c7883-aab3-4641-87a1-296c5bc10806
    type: playbook
    task:
      id: 527c7883-aab3-4641-87a1-296c5bc10806
      version: -1
      name: Detonate URL - ANYRUN
      description: Detonates a URL using the ANYRUN sandbox.
      playbookName: Detonate URL - ANYRUN
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      "#none#":
      - "3"
    scriptarguments:
      URL:
        complex:
          root: inputs.URL
          accessor: Data
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 2200,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "18":
    id: "18"
    taskid: ae8130db-d640-476c-8509-caa0a3318d69
    type: playbook
    task:
      id: ae8130db-d640-476c-8509-caa0a3318d69
      version: -1
      name: Detonate URL - Group-IB TDS Polygon
      playbookName: Detonate URL - Group-IB TDS Polygon
      type: playbook
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      "#none#":
      - "3"
    scriptarguments:
      Interval:
        simple: "1"
      Timeout:
        simple: "60"
      url:
        complex:
          root: inputs.URL
          accessor: Data
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 2630,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "19":
    id: "19"
    taskid: 0ff5715e-873b-4d67-87da-2080cd4e5f34
    type: regular
    task:
      id: 0ff5715e-873b-4d67-87da-2080cd4e5f34
      version: -1
      name: Detonate URL - CrowdStrike Falcon Intelligence Sandbox
      description: Submits a URL for analysis.
      script: '|||cs-falcon-sandbox-submit-url'
      type: regular
      iscommand: true
      brand: CrowdStrike Falcon Sandbox V2
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      environmentID:
        simple: "100"
      polling:
        simple: "true"
      url:
        complex:
          root: inputs.URL
          accessor: Data
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3060,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 2ad2429a-91b6-4728-820f-d782e7b3a42d
    type: playbook
    task:
      id: 2ad2429a-91b6-4728-820f-d782e7b3a42d
      version: -1
      name: Detonate URL - WildFire v2.1
      description: |-
        Detonate a webpage or remote file using the WildFire integration. This playbook returns relevant reports to the War Room and file reputations to the context data.
        The detonation supports the following file types:
        APK, JAR, DOC, DOCX, RTF, OOXLS, XLSX, PPT, PPTX, XML, PE32, PDF, DMG, PKG, RAR, 7Z, JS.
      playbookName: Detonate URL - WildFire v2.1
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      "#none#":
      - "3"
    scriptarguments:
      Interval:
        simple: "1"
      Timeout:
        simple: "60"
      URL:
        complex:
          root: inputs.URL
          accessor: Data
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 3490,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "21":
    id: "21"
    taskid: 035deb07-590a-485a-8500-2b5b553efec4
    type: playbook
    task:
      id: 035deb07-590a-485a-8500-2b5b553efec4
      version: -1
      name: Detonate URL - VirusTotal (API v3)
      description: Detonate URL through VirusTotal (API v3) integration.
      playbookName: Detonate URL - VirusTotal (API v3)
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      "#none#":
      - "3"
    scriptarguments:
      URL:
        complex:
          root: inputs.URL
          accessor: Data
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 3920,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "23":
    id: "23"
    taskid: c1bbd5a6-59c4-4c09-8399-2e2ae4abd2df
    type: playbook
    task:
      id: c1bbd5a6-59c4-4c09-8399-2e2ae4abd2df
      version: -1
      name: Detonate URL - VMRay
      playbookName: Detonate URL - VMRay
      type: playbook
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      "#none#":
      - "3"
    scriptarguments:
      URL:
        complex:
          root: inputs.URL
          accessor: Data
      interval:
        simple: "1"
      timeout:
        simple: "10"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 4350,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "24":
    id: "24"
    taskid: 28a9d2ed-ee25-4a25-87f5-a19dd30e6b45
    type: playbook
    task:
      id: 28a9d2ed-ee25-4a25-87f5-a19dd30e6b45
      version: -1
      name: Detonate URL - ThreatStream
      playbookName: Detonate URL - ThreatStream
      type: playbook
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      "#none#":
      - "3"
    scriptarguments:
      Interval:
        simple: "5"
      Timeout:
        simple: "120"
      URL:
        complex:
          root: inputs.URL
          accessor: Data
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 4780,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "25":
    id: "25"
    taskid: 5535b892-f1b1-42d6-8f7e-c673377dff5c
    type: playbook
    task:
      id: 5535b892-f1b1-42d6-8f7e-c673377dff5c
      version: -1
      name: Detonate URL - Hybrid Analysis
      playbookName: Detonate URL - Hybrid Analysis
      type: playbook
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      "#none#":
      - "3"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 5210,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "26":
    id: "26"
    taskid: 538c5113-5469-4692-89b2-c1570b74aaef
    type: playbook
    task:
      id: 538c5113-5469-4692-89b2-c1570b74aaef
      version: -1
      name: Detonate URL - FireEye AX
      playbookName: Detonate URL - FireEye AX
      type: playbook
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      "#none#":
      - "3"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 5640,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "27":
    id: "27"
    taskid: 13bebc22-497e-48e6-85f0-41f6ee62fef1
    type: playbook
    task:
      id: 13bebc22-497e-48e6-85f0-41f6ee62fef1
      version: -1
      name: Detonate URL - Hatching Triage
      playbookName: Detonate URL - Hatching Triage
      type: playbook
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      "#none#":
      - "3"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 6070,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "28":
    id: "28"
    taskid: ca1a3f90-8330-4eac-885c-eec86c8b8885
    type: playbook
    task:
      id: ca1a3f90-8330-4eac-885c-eec86c8b8885
      version: -1
      name: Detonate URL - SecneurX Analysis
      description: Detonates a file using the SecneurX Analysis Integration. Returns relevant reports to the War Room and file reputations to the context data.
      playbookName: Detonate URL - SecneurX Analysis
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      Priority:
        simple: High
      Reboot:
        simple: "False"
      ReportFormat:
        simple: json
      URL:
        complex:
          root: URL
          filters:
          - - operator: isExists
              left:
                value:
                  simple: URL.Data
                iscontext: true
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 6500,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "29":
    id: "29"
    taskid: b12fdeb4-9952-416d-8e01-39eef0662454
    type: playbook
    task:
      id: b12fdeb4-9952-416d-8e01-39eef0662454
      version: -1
      name: Detonate URL - CrowdStrike Falcon Intelligence Sandbox
      playbookName: Detonate URL - CrowdStrike Falcon Intelligence Sandbox
      description: 'Detonate one or more files using the CrowdStrike Falcon Intelligence Sandbox integration.'
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      Interval:
        simple: "1"
      Timeout:
        simple: "60"
      URL:
        complex:
          root: inputs.URL
          accessor: Data
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 6930,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 1abb6283-2a97-4409-8344-027a49c5ef5e
    type: condition
    task:
      id: 1abb6283-2a97-4409-8344-027a49c5ef5e
      version: -1
      name: Check if URL exists
      description: Checks if there is a URL to detonate.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "32"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 7390,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 2fee63e9-6482-4101-8272-d42cf3a950aa
    type: regular
    task:
      id: 2fee63e9-6482-4101-8272-d42cf3a950aa
      version: -1
      name: Detonate URL - MetaDefender Sandbox
      description: Detonates a URL using the MetaDefender Sandbox Integration. Returns relevant reports to the War Room and URL reputations to the context data.
      script: metadefender-sandbox-scan-url
      type: regular
      iscommand: true
      brand: MetaDefender Sandbox
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      url:
        simple: ${inputs.URL.Data}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 7502.5,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 735,
        "width": 7832.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
  required: false
  description: The URL object of the URL to be detonated.
  playbookInputQuery:
outputs:
- contextPath: File
  description: The file's object.
  type: string
- contextPath: File.Name
  description: The file name.
  type: string
- contextPath: File.Size
  description: The file size.
  type: number
- contextPath: File.Type
  description: The file type, for example "PE" (only for report type=json).
  type: string
- contextPath: File.SHA256
  description: The SHA256 hash of the file.
  type: string
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
  type: string
- contextPath: File.MD5
  description: The MD5 hash of the file.
  type: string
- contextPath: File.Malicious.Vendor
  description: The vendor that decided the file is malicious.
  type: string
- contextPath: File.Malicious.Description
  description: The reason the vendor decided the file is malicious.
  type: string
- contextPath: DBotScore
  description: The indicator's object.
  type: string
- contextPath: DBotScore.Type
  description: The indicator type.
  type: string
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
  type: string
- contextPath: DBotScore.Vendor
  description: The vendor used to calculate the score.
  type: string
- contextPath: DBotScore.Score
  description: The actual score.
  type: number
- contextPath: Joe.Analysis.WebID
  description: The Joe Analysis-related web ID.
  type: string
- contextPath: Joe.Analysis.Status
  description: The Joe Analysis-related status.
  type: string
- contextPath: Joe.Analysis.Comments
  description: The Joe Analysis-related comments.
  type: string
- contextPath: Joe.Analysis.Time
  description: The Joe Analysis-related submitted time.
  type: date
- contextPath: Joe.Analysis.Runs
  description: The Joe Analysis-related sub-analysis information.
  type: string
- contextPath: Joe.Analysis.Result
  description: The Joe Analysis-related results.
  type: string
- contextPath: Joe.Analysis.Errors
  description: The Joe Analysis-related errors raised during sampling.
  type: string
- contextPath: Joe.Analysis.Systems
  description: The Joe Analysis-related operating systems.
  type: string
- contextPath: Joe.Analysis.MD5
  description: The MD5 hash of the Joe Analysis-related sample.
  type: string
- contextPath: Joe.Analysis.SHA1
  description: The SHA1 hash of the Joe Analysis-related sample.
  type: string
- contextPath: Joe.Analysis.SHA256
  description: The SHA256 hash of the Joe Analysis-related sample.
  type: string
- contextPath: Joe.Analysis.SampleName
  description: The Joe Analysis-related sample data name. Can be a file name or a URL.
  type: string
- contextPath: InfoFile.Name
  description: The file name.
  type: string
- contextPath: InfoFile.EntryID
  description: The EntryID of the sample.
  type: string
- contextPath: InfoFile.Size
  description: The file size.
  type: number
- contextPath: InfoFile.Type
  description: The file type, for example "PE".
  type: string
- contextPath: InfoFile.Info
  description: The file basic information.
  type: string
- contextPath: Sample.State
  description: The sample state.
  type: string
- contextPath: Sample.ID
  description: The sample ID.
  type: string
- contextPath: IP.Address
  description: The IP addresses relevant to the sample.
  type: string
- contextPath: InfoFile
  description: The report file's object.
  type: string
- contextPath: Cuckoo.Task.Category
  description: The Cuckoo-related task category.
- contextPath: Cuckoo.Task.Machine
  description: The Cuckoo-related task machine.
- contextPath: Cuckoo.Task.Errors
  description: The Cuckoo-related task errors.
- contextPath: Cuckoo.Task.Target
  description: The Cuckoo-related task target.
- contextPath: Cuckoo.Task.Package
  description: The Cuckoo-related task package.
- contextPath: Cuckoo.Task.SampleID
  description: The Cuckoo-related task sample ID.
- contextPath: Cuckoo.Task.Guest
  description: The Cuckoo-related task guest.
- contextPath: Cuckoo.Task.Custom
  description: The Cuckoo-related task custom values.
- contextPath: Cuckoo.Task.Owner
  description: The Cuckoo-related task owner.
- contextPath: Cuckoo.Task.Priority
  description: The Cuckoo-related task priority.
- contextPath: Cuckoo.Task.Platform
  description: The Cuckoo-related task platform.
- contextPath: Cuckoo.Task.Options
  description: The Cuckoo-related task options.
- contextPath: Cuckoo.Task.Status
  description: The Cuckoo-related task status.
- contextPath: Cuckoo.Task.EnforceTimeout
  description: Whether the Cuckoo-related task timeout is enforced.
- contextPath: Cuckoo.Task.Timeout
  description: The Cuckoo-related task timeout.
- contextPath: Cuckoo.Task.Memory
  description: The Cuckoo-related task memory.
- contextPath: Cuckoo.Task.Tags
  description: The Cuckoo-related task tags.
- contextPath: Cuckoo.Task.ID
  description: The Cuckoo-related task ID.
- contextPath: Cuckoo.Task.AddedOn
  description: The date the Cuckoo-related task was added.
- contextPath: Cuckoo.Task.CompletedOn
  description: The date the Cuckoo-related task was completed.
- contextPath: Cuckoo.Task.Score
  description: The reported Cuckoo-related task score.
- contextPath: Cuckoo.Task.Monitor
  description: The reported Cuckoo-related task monitor.
- contextPath: ANYRUN.Task.AnalysisDate
  description: The date and time the ANY.RUN analysis was executed.
  type: String
- contextPath: ANYRUN.Task.Behavior.Category
  description: The ANY.RUN behavior category.
  type: String
- contextPath: ANYRUN.Task.Behavior.Action
  description: The actions performed by an ANY.RUN behavior.
  type: String
- contextPath: ANYRUN.Task.Behavior.ThreatLevel
  description: The threat score associated with an ANY.RUN behavior.
  type: Number
- contextPath: ANYRUN.Task.Behavior.ProcessUUID
  description: The ANY.RUN unique ID of the process whose behaviors are profiled.
  type: String
- contextPath: ANYRUN.Task.Connection.Reputation
  description: The ANY.RUN connection reputation.
  type: String
- contextPath: ANYRUN.Task.Connection.ProcessUUID
  description: The ANY.RUN UUID of the process that created the connection.
  type: String
- contextPath: ANYRUN.Task.Connection.ASN
  description: The ANY.RUN connection autonomous system network.
  type: String
- contextPath: ANYRUN.Task.Connection.Country
  description: The ANY.RUN connection country.
  type: String
- contextPath: ANYRUN.Task.Connection.Protocol
  description: The ANY.RUN connection protocol.
  type: String
- contextPath: ANYRUN.Task.Connection.Port
  description: The ANY.RUN connection port number.
  type: Number
- contextPath: ANYRUN.Task.Connection.IP
  description: The ANY.RUN connection IP address.
  type: String
- contextPath: ANYRUN.Task.DnsRequest.Reputation
  description: The ANY.RUN process reputation of the DNS request.
  type: String
- contextPath: ANYRUN.Task.DnsRequest.IP
  description: The ANY.RUN IP addresses associated with a DNS request.
  type: string
- contextPath: ANYRUN.Task.DnsRequest.Domain
  description: The ANY.RUN domain resolution of a DNS request.
  type: String
- contextPath: ANYRUN.Task.Threat.ProcessUUID
  description: The unique ANY.RUN UUID of the process that originated the threat.
  type: String
- contextPath: ANYRUN.Task.Threat.Msg
  description: The ANY.RUN threat message.
  type: String
- contextPath: ANYRUN.Task.Threat.Class
  description: The ANY.RUN threat class.
  type: String
- contextPath: ANYRUN.Task.Threat.SrcPort
  description: The ANY.RUN port on which the threat originated.
  type: Number
- contextPath: ANYRUN.Task.Threat.DstPort
  description: The ANY.RUN threat destination port.
  type: Number
- contextPath: ANYRUN.Task.Threat.SrcIP
  description: The ANY.RUN source IP address where the threat originated.
  type: String
- contextPath: ANYRUN.Task.Threat.DstIP
  description: The ANY.RUN threat destination IP address.
  type: String
- contextPath: ANYRUN.Task.HttpRequest.Reputation
  description: The ANY.RUN HTTP request reputation.
  type: String
- contextPath: ANYRUN.Task.HttpRequest.Country
  description: The ANY.RUN HTTP request country.
  type: String
- contextPath: ANYRUN.Task.HttpRequest.ProcessUUID
  description: The ANY.RUN UUID of the process making the HTTP request.
  type: String
- contextPath: ANYRUN.Task.HttpRequest.Body
  description: The ANY.RUN HTTP request body parameters and details.
  type: string
- contextPath: ANYRUN.Task.HttpRequest.HttpCode
  description: The ANY.RUN HTTP request response code.
  type: Number
- contextPath: ANYRUN.Task.HttpRequest.Status
  description: The ANY.RUN status of the HTTP request.
  type: String
- contextPath: ANYRUN.Task.HttpRequest.ProxyDetected
  description: Whether the ANY.RUN HTTP request was made through a proxy.
  type: Boolean
- contextPath: ANYRUN.Task.HttpRequest.Port
  description: The ANY.RUN HTTP request port.
  type: Number
- contextPath: ANYRUN.Task.HttpRequest.IP
  description: The ANY.RUN HTTP request IP address.
  type: String
- contextPath: ANYRUN.Task.HttpRequest.URL
  description: The ANY.RUN HTTP request URL.
  type: String
- contextPath: ANYRUN.Task.HttpRequest.Host
  description: The ANY.RUN HTTP request host.
  type: String
- contextPath: ANYRUN.Task.HttpRequest.Method
  description: The ANY.RUN HTTP request method type.
  type: String
- contextPath: ANYRUN.Task.FileInfo
  description: The ANY.RUN submitted file details.
  type: String
- contextPath: ANYRUN.Task.OS
  description: The ANY.RUN operating system of the sandbox in which the file was analyzed.
  type: String
- contextPath: ANYRUN.Task.ID
  description: The unique ANY.RUN task ID.
  type: String
- contextPath: ANYRUN.Task.MIME
  description: The ANY.RUN MIME of the file submitted for analysis.
  type: String
- contextPath: ANYRUN.Task.Verdict
  description: The ANY.RUN verdict for the maliciousness of the submitted file or URL.
  type: String
- contextPath: ANYRUN.Task.Process.FileName
  description: The ANY.RUN process file name.
  type: String
- contextPath: ANYRUN.Task.Process.PID
  description: The ANY.RUN process identification number.
  type: Number
- contextPath: ANYRUN.Task.Process.PPID
  description: The ANY.RUN process parent process identification number.
  type: Number
- contextPath: ANYRUN.Task.Process.ProcessUUID
  description: The unique ANY.RUN process UUID.
  type: String
- contextPath: ANYRUN.Task.Process.CMD
  description: The ANY.RUN process command.
  type: String
- contextPath: ANYRUN.Task.Process.Path
  description: The path of the executed ANY.RUN process command.
  type: String
- contextPath: ANYRUN.Task.Process.User
  description: The user who executed the ANY.RUN process command.
  type: String
- contextPath: ANYRUN.Task.Process.IntegrityLevel
  description: The ANY.RUN process integrity level.
  type: String
- contextPath: ANYRUN.Task.Process.ExitCode
  description: The ANY.RUN process exit code.
  type: Number
- contextPath: ANYRUN.Task.Process.MainProcess
  description: Whether the ANY.RUN process is the main process.
  type: Boolean
- contextPath: ANYRUN.Task.Process.Version.Company
  description: The company responsible for the executed ANY.RUN process program.
  type: String
- contextPath: ANYRUN.Task.Process.Version.Description
  description: The description of the ANY.RUN process program type.
  type: String
- contextPath: ANYRUN.Task.Process.Version.Version
  description: The version of the executed program.
  type: String
- contextPath: URL.Data
  description: The URL data.
  type: String
- contextPath: URL.Malicious.Vendor
  description: The vendor that decided the URL is malicious.
  type: String
- contextPath: URL.Malicious.Description
  description: The reason the vendor decided the URL is malicious.
  type: String
- contextPath: ANYRUN.Task.Status
  description: The task analysis status.
  type: String
- contextPath: FireEyeAX.Submissions.Key
  description: The submission key
- contextPath: FireEyeAX.Submissions.Severity
  description: The severity level of the file
- contextPath: FireEyeAX.Submissions.InfoLevel
  description: The info level of the report.
- contextPath: DBotScore.Score
  description: The actual score.
  type: unknown
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
  type: unknown
- contextPath: DBotScore.Vendor
  description: The vendor used to calculate the score.
  type: unknown
- contextPath: Triage.sample-summaries.completed
  description: The date the sample analysis was completed.
- contextPath: Triage.sample-summaries.created
  description: The date the analysis report was created.
- contextPath: Triage.sample-summaries.custom
  description: The custom sample analysis.
- contextPath: Triage.sample-summaries.owner
  description: The owner of the sample summaries.
  type: unknown
- contextPath: Triage.sample-summaries.sample
  description: The unique identifier of the sample.
  type: unknown
- contextPath: Triage.sample-summaries.score
  description: The score of the sample on a scale of 0 to 10.
  type: unknown
- contextPath: Triage.sample-summaries.sha256
  description: The SHA256 of the sample.
  type: unknown
- contextPath: Triage.sample-summaries.status
  description: The status of the analysis.
  type: unknown
- contextPath: Triage.sample-summaries.target
  description: The target for the analysis.
  type: unknown
- contextPath: Triage.sample-summaries.tasks
  description: The tasks performed in the analysis.
  type: unknown
- contextPath: HybridAnalysis.URL.Scanner.Name
  description: The URL scanner name.
- contextPath: HybridAnalysis.URL.Scanner.Positives
  description: The number of positive scanners.
- contextPath: HybridAnalysis.URL.Scanner.Status
  description: The status of the scanning.
- contextPath: HybridAnalysis.URL.Scanner
  description: The place holder for the scanner data.
  type: unknown
- contextPath: SecneurXAnalysis.Report.SHA256
  description: SHA256 value of the analyzed sample
  type: string
- contextPath: SecneurXAnalysis.Report.Verdict
  description: Summary result of the analyzed sample
  type: string
- contextPath: SecneurXAnalysis.Report.Tags
  description: More details of the analyzed sample
  type: string
- contextPath: SecneurXAnalysis.Report.IOC
  description: List of IOC's observed in the analyzed sample
  type: string
- contextPath: SecneurXAnalysis.Report.Status
  description: Analysis queued sample state
  type: String
fromversion: 5.0.0
tests:
- No tests (auto formatted)
contentitemexportablefields:
  contentitemfields: {}