Detonate URL - Generic Deprecated
Deprecated. Use Detonate URL - Generic v1.5 playbook instead. Detonate URL through active integrations that support URL detonation.
Common Playbooks · 21 tasks · 1 input · 138 outputs
Details
| ID | detonate_url_-_generic |
|---|---|
| From Version | 5.0.0 |
| Tasks | 21 |
README
Detonate URL through active integrations that support URL detonation.
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
- Detonate URL - JoeSecurity
- Detonate URL - Hybrid Analysis
- Detonate URL - Lastline v2
- Detonate URL - ThreatGrid
- Detonate URL - WildFire v2.1
- Detonate URL - McAfee ATD
- Detonate URL - ANYRUN
- Detonate URL - Group-IB TDS Polygon
- Detonate URL - CrowdStrike Falcon Intelligence Sandbox
- Detonate URL - VirusTotal (API v3)
- Detonate URL - Hatching Triage
- Detonate URL - FireEye AX
- Detonate URL - Cuckoo
- Detonate URL - SecneurX Analysis
- Detonate URL - VMRay
- Detonate URL - ThreatStream
Integrations
- CrowdStrike Falcon Sandbox V2
- OPSWAT Filescan
Scripts
This playbook does not use any scripts.
Commands
- cs-falcon-sandbox-submit-url
- opswat-filescan-scan-url
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| URL | The URL object of the URL to be detonated. | URL | Optional |
Playbook Outputs
| Path | Description | Type |
|---|---|---|
| File | The file’s object. | string |
| File.Name | The file name. | string |
| File.Size | The file size. | number |
| File.Type | The file type, for example “PE” (only for report type=json). | string |
| File.SHA256 | The SHA256 hash of the file. | string |
| File.SHA1 | The SHA1 hash of the file. | string |
| File.MD5 | The MD5 hash of the file. | string |
| File.Malicious.Vendor | The vendor that decided the file is malicious. | string |
| File.Malicious.Description | The reason the vendor decided the file is malicious. | string |
| DBotScore | The indicator’s object. | string |
| DBotScore.Type | The indicator type. | string |
| DBotScore.Indicator | The indicator that was tested. | string |
| DBotScore.Vendor | The vendor used to calculate the score. | string |
| DBotScore.Score | The actual score. | number |
| Joe.Analysis.WebID | The Joe Analysis-related web ID. | string |
| Joe.Analysis.Status | The Joe Analysis-related status. | string |
| Joe.Analysis.Comments | The Joe Analysis-related comments. | string |
| Joe.Analysis.Time | The Joe Analysis-related submitted time. | date |
| Joe.Analysis.Runs | The Joe Analysis-related sub-analysis information. | string |
| Joe.Analysis.Result | The Joe Analysis-related results. | string |
| Joe.Analysis.Errors | The Joe Analysis-related errors raised during sampling. | string |
| Joe.Analysis.Systems | The Joe Analysis-related operating systems. | string |
| Joe.Analysis.MD5 | The MD5 hash of the Joe Analysis-related sample. | string |
| Joe.Analysis.SHA1 | The SHA1 hash of the Joe Analysis-related sample. | string |
| Joe.Analysis.SHA256 | The SHA256 hash of the Joe Analysis-related sample. | string |
| Joe.Analysis.SampleName | The Joe Analysis-related sample data name. Can be a file name or a URL. | string |
| InfoFile.Name | The file name. | string |
| InfoFile.EntryID | The EntryID of the sample. | string |
| InfoFile.Size | The file size. | number |
| InfoFile.Type | The file type, for example “PE”. | string |
| InfoFile.Info | The file basic information. | string |
| Sample.State | The sample state. | string |
| Sample.ID | The sample ID. | string |
| IP.Address | The IP addresses relevant to the sample. | string |
| InfoFile | The report file’s object. | string |
| Cuckoo.Task.Category | The Cuckoo-related task category. | unknown |
| Cuckoo.Task.Machine | The Cuckoo-related task machine. | unknown |
| Cuckoo.Task.Errors | The Cuckoo-related task errors. | unknown |
| Cuckoo.Task.Target | The Cuckoo-related task target. | unknown |
| Cuckoo.Task.Package | The Cuckoo-related task package. | unknown |
| Cuckoo.Task.SampleID | The Cuckoo-related task sample ID. | unknown |
| Cuckoo.Task.Guest | The Cuckoo-related task guest. | unknown |
| Cuckoo.Task.Custom | The Cuckoo-related task custom values. | unknown |
| Cuckoo.Task.Owner | The Cuckoo-related task owner. | unknown |
| Cuckoo.Task.Priority | The Cuckoo-related task priority. | unknown |
| Cuckoo.Task.Platform | The Cuckoo-related task platform. | unknown |
| Cuckoo.Task.Options | The Cuckoo-related task options. | unknown |
| Cuckoo.Task.Status | The Cuckoo-related task status. | unknown |
| Cuckoo.Task.EnforceTimeout | Whether the Cuckoo-related task timeout is enforced. | unknown |
| Cuckoo.Task.Timeout | The Cuckoo-related task timeout. | unknown |
| Cuckoo.Task.Memory | The Cuckoo-related task memory. | unknown |
| Cuckoo.Task.Tags | The Cuckoo-related task tags. | unknown |
| Cuckoo.Task.ID | The Cuckoo-related task ID. | unknown |
| Cuckoo.Task.AddedOn | The date the Cuckoo-related task was added. | unknown |
| Cuckoo.Task.CompletedOn | The date the Cuckoo-related task was completed. | unknown |
| Cuckoo.Task.Score | The reported Cuckoo-related task score. | unknown |
| Cuckoo.Task.Monitor | The reported Cuckoo-related task monitor. | unknown |
| ANYRUN.Task.AnalysisDate | The date and time the ANY.RUN analysis was executed. | String |
| ANYRUN.Task.Behavior.Category | The ANY.RUN behavior category. | String |
| ANYRUN.Task.Behavior.Action | The actions performed by an ANY.RUN behavior. | String |
| ANYRUN.Task.Behavior.ThreatLevel | The threat score associated with an ANY.RUN behavior. | Number |
| ANYRUN.Task.Behavior.ProcessUUID | The ANY.RUN unique ID of the process whose behaviors are profiled. | String |
| ANYRUN.Task.Connection.Reputation | The ANY.RUN connection reputation. | String |
| ANYRUN.Task.Connection.ProcessUUID | The ANY.RUN UUID of the process that created the connection. | String |
| ANYRUN.Task.Connection.ASN | The ANY.RUN connection autonomous system network. | String |
| ANYRUN.Task.Connection.Country | The ANY.RUN connection country. | String |
| ANYRUN.Task.Connection.Protocol | The ANY.RUN connection protocol. | String |
| ANYRUN.Task.Connection.Port | The ANY.RUN connection port number. | Number |
| ANYRUN.Task.Connection.IP | The ANY.RUN connection IP address. | String |
| ANYRUN.Task.DnsRequest.Reputation | The ANY.RUN process reputation of the DNS request. | String |
| ANYRUN.Task.DnsRequest.IP | The ANY.RUN IP addresses associated with a DNS request. | string |
| ANYRUN.Task.DnsRequest.Domain | The ANY.RUN domain resolution of a DNS request. | String |
| ANYRUN.Task.Threat.ProcessUUID | The unique ANY.RUN UUID of the process that originated the threat. | String |
| ANYRUN.Task.Threat.Msg | The ANY.RUN threat message. | String |
| ANYRUN.Task.Threat.Class | The ANY.RUN threat class. | String |
| ANYRUN.Task.Threat.SrcPort | The ANY.RUN port on which the threat originated. | Number |
| ANYRUN.Task.Threat.DstPort | The ANY.RUN threat destination port. | Number |
| ANYRUN.Task.Threat.SrcIP | The ANY.RUN source IP address where the threat originated. | String |
| ANYRUN.Task.Threat.DstIP | The ANY.RUN threat destination IP address. | String |
| ANYRUN.Task.HttpRequest.Reputation | The ANY.RUN HTTP request reputation. | String |
| ANYRUN.Task.HttpRequest.Country | The ANY.RUN HTTP request country. | String |
| ANYRUN.Task.HttpRequest.ProcessUUID | The ANY.RUN UUID of the process making the HTTP request. | String |
| ANYRUN.Task.HttpRequest.Body | The ANY.RUN HTTP request body parameters and details. | string |
| ANYRUN.Task.HttpRequest.HttpCode | The ANY.RUN HTTP request response code. | Number |
| ANYRUN.Task.HttpRequest.Status | The ANY.RUN status of the HTTP request. | String |
| ANYRUN.Task.HttpRequest.ProxyDetected | Whether the ANY.RUN HTTP request was made through a proxy. | Boolean |
| ANYRUN.Task.HttpRequest.Port | The ANY.RUN HTTP request port. | Number |
| ANYRUN.Task.HttpRequest.IP | The ANY.RUN HTTP request IP address. | String |
| ANYRUN.Task.HttpRequest.URL | The ANY.RUN HTTP request URL. | String |
| ANYRUN.Task.HttpRequest.Host | The ANY.RUN HTTP request host. | String |
| ANYRUN.Task.HttpRequest.Method | The ANY.RUN HTTP request method type. | String |
| ANYRUN.Task.FileInfo | The ANY.RUN submitted file details. | String |
| ANYRUN.Task.OS | The ANY.RUN operating system of the sandbox in which the file was analyzed. | String |
| ANYRUN.Task.ID | The unique ANY.RUN task ID. | String |
| ANYRUN.Task.MIME | The ANY.RUN MIME of the file submitted for analysis. | String |
| ANYRUN.Task.Verdict | The ANY.RUN verdict for the maliciousness of the submitted file or URL. | String |
| ANYRUN.Task.Process.FileName | The ANY.RUN process file name. | String |
| ANYRUN.Task.Process.PID | The ANY.RUN process identification number. | Number |
| ANYRUN.Task.Process.PPID | The ANY.RUN process parent process identification number. | Number |
| ANYRUN.Task.Process.ProcessUUID | The unique ANY.RUN process UUID. | String |
| ANYRUN.Task.Process.CMD | The ANY.RUN process command. | String |
| ANYRUN.Task.Process.Path | The path of the executed ANY.RUN process command. | String |
| ANYRUN.Task.Process.User | The user who executed the ANY.RUN process command. | String |
| ANYRUN.Task.Process.IntegrityLevel | The ANY.RUN process integrity level. | String |
| ANYRUN.Task.Process.ExitCode | The ANY.RUN process exit code. | Number |
| ANYRUN.Task.Process.MainProcess | Whether the ANY.RUN process is the main process. | Boolean |
| ANYRUN.Task.Process.Version.Company | The company responsible for the executed ANY.RUN process program. | String |
| ANYRUN.Task.Process.Version.Description | The description of the ANY.RUN process program type. | String |
| ANYRUN.Task.Process.Version.Version | The version of the executed program. | String |
| URL.Data | The URL data. | String |
| URL.Malicious.Vendor | The vendor that decided the URL is malicious. | String |
| URL.Malicious.Description | The reason the vendor decided the URL is malicious. | String |
| ANYRUN.Task.Status | The task analysis status. | String |
| FireEyeAX.Submissions.Key | The submission key | unknown |
| FireEyeAX.Submissions.Severity | The severity level of the file | unknown |
| FireEyeAX.Submissions.InfoLevel | The info level of the report. | unknown |
| DBotScore.Score | The actual score. | unknown |
| DBotScore.Indicator | The indicator that was tested. | unknown |
| DBotScore.Vendor | The vendor used to calculate the score. | unknown |
| Triage.sample-summaries.completed | The date the sample analysis was completed. | unknown |
| Triage.sample-summaries.created | The date the analysis report was created. | unknown |
| Triage.sample-summaries.custom | The custom sample analysis. | unknown |
| Triage.sample-summaries.owner | The owner of the sample summaries. | unknown |
| Triage.sample-summaries.sample | The unique identifier of the sample. | unknown |
| Triage.sample-summaries.score | The score of the sample on a scale of 0 to 10. | unknown |
| Triage.sample-summaries.sha256 | The SHA256 of the sample. | unknown |
| Triage.sample-summaries.status | The status of the analysis. | unknown |
| Triage.sample-summaries.target | The target for the analysis. | unknown |
| Triage.sample-summaries.tasks | The tasks performed in the analysis. | unknown |
| HybridAnalysis.URL.Scanner.Name | The URL scanner name. | unknown |
| HybridAnalysis.URL.Scanner.Positives | The number of positive scanners. | unknown |
| HybridAnalysis.URL.Scanner.Status | The status of the scanning. | unknown |
| HybridAnalysis.URL.Scanner | The place holder for the scanner data. | unknown |
| SecneurXAnalysis.Report.SHA256 | SHA256 value of the analyzed sample | string |
| SecneurXAnalysis.Report.Verdict | Summary result of the analyzed sample | string |
| SecneurXAnalysis.Report.Tags | More details of the analyzed sample | string |
| SecneurXAnalysis.Report.IOC | List of IOC’s observed in the analyzed sample | string |
| SecneurXAnalysis.Report.Status | Analysis queued sample state | String |
Playbook Image
Inputs
URL— The URL object of the URL to be detonated.
Outputs
File— The file's object.File.Name— The file name.File.Size— The file size.File.Type— The file type, for example "PE" (only for report type=json).File.SHA256— The SHA256 hash of the file.File.SHA1— The SHA1 hash of the file.File.MD5— The MD5 hash of the file.File.Malicious.Vendor— The vendor that decided the file is malicious.File.Malicious.Description— The reason the vendor decided the file is malicious.DBotScore— The indicator's object.DBotScore.Type— The indicator type.DBotScore.Indicator— The indicator that was tested.DBotScore.Vendor— The vendor used to calculate the score.DBotScore.Score— The actual score.Joe.Analysis.WebID— The Joe Analysis-related web ID.Joe.Analysis.Status— The Joe Analysis-related status.Joe.Analysis.Comments— The Joe Analysis-related comments.Joe.Analysis.Time— The Joe Analysis-related submitted time.Joe.Analysis.Runs— The Joe Analysis-related sub-analysis information.Joe.Analysis.Result— The Joe Analysis-related results.Joe.Analysis.Errors— The Joe Analysis-related errors raised during sampling.Joe.Analysis.Systems— The Joe Analysis-related operating systems.Joe.Analysis.MD5— The MD5 hash of the Joe Analysis-related sample.Joe.Analysis.SHA1— The SHA1 hash of the Joe Analysis-related sample.Joe.Analysis.SHA256— The SHA256 hash of the Joe Analysis-related sample.Joe.Analysis.SampleName— The Joe Analysis-related sample data name. Can be a file name or a URL.InfoFile.Name— The file name.InfoFile.EntryID— The EntryID of the sample.InfoFile.Size— The file size.InfoFile.Type— The file type, for example "PE".InfoFile.Info— The file basic information.Sample.State— The sample state.Sample.ID— The sample ID.IP.Address— The IP addresses relevant to the sample.InfoFile— The report file's object.Cuckoo.Task.Category— The Cuckoo-related task category.Cuckoo.Task.Machine— The Cuckoo-related task machine.Cuckoo.Task.Errors— The Cuckoo-related task errors.Cuckoo.Task.Target— The Cuckoo-related task target.Cuckoo.Task.Package— The Cuckoo-related task package.Cuckoo.Task.SampleID— The Cuckoo-related task sample ID.Cuckoo.Task.Guest— The Cuckoo-related task guest.Cuckoo.Task.Custom— The Cuckoo-related task custom values.Cuckoo.Task.Owner— The Cuckoo-related task owner.Cuckoo.Task.Priority— The Cuckoo-related task priority.Cuckoo.Task.Platform— The Cuckoo-related task platform.Cuckoo.Task.Options— The Cuckoo-related task options.Cuckoo.Task.Status— The Cuckoo-related task status.Cuckoo.Task.EnforceTimeout— Whether the Cuckoo-related task timeout is enforced.Cuckoo.Task.Timeout— The Cuckoo-related task timeout.Cuckoo.Task.Memory— The Cuckoo-related task memory.Cuckoo.Task.Tags— The Cuckoo-related task tags.Cuckoo.Task.ID— The Cuckoo-related task ID.Cuckoo.Task.AddedOn— The date the Cuckoo-related task was added.Cuckoo.Task.CompletedOn— The date the Cuckoo-related task was completed.Cuckoo.Task.Score— The reported Cuckoo-related task score.Cuckoo.Task.Monitor— The reported Cuckoo-related task monitor.ANYRUN.Task.AnalysisDate— The date and time the ANY.RUN analysis was executed.ANYRUN.Task.Behavior.Category— The ANY.RUN behavior category.ANYRUN.Task.Behavior.Action— The actions performed by an ANY.RUN behavior.ANYRUN.Task.Behavior.ThreatLevel— The threat score associated with an ANY.RUN behavior.ANYRUN.Task.Behavior.ProcessUUID— The ANY.RUN unique ID of the process whose behaviors are profiled.ANYRUN.Task.Connection.Reputation— The ANY.RUN connection reputation.ANYRUN.Task.Connection.ProcessUUID— The ANY.RUN UUID of the process that created the connection.ANYRUN.Task.Connection.ASN— The ANY.RUN connection autonomous system network.ANYRUN.Task.Connection.Country— The ANY.RUN connection country.ANYRUN.Task.Connection.Protocol— The ANY.RUN connection protocol.ANYRUN.Task.Connection.Port— The ANY.RUN connection port number.ANYRUN.Task.Connection.IP— The ANY.RUN connection IP address.ANYRUN.Task.DnsRequest.Reputation— The ANY.RUN process reputation of the DNS request.ANYRUN.Task.DnsRequest.IP— The ANY.RUN IP addresses associated with a DNS request.ANYRUN.Task.DnsRequest.Domain— The ANY.RUN domain resolution of a DNS request.ANYRUN.Task.Threat.ProcessUUID— The unique ANY.RUN UUID of the process that originated the threat.ANYRUN.Task.Threat.Msg— The ANY.RUN threat message.ANYRUN.Task.Threat.Class— The ANY.RUN threat class.ANYRUN.Task.Threat.SrcPort— The ANY.RUN port on which the threat originated.ANYRUN.Task.Threat.DstPort— The ANY.RUN threat destination port.ANYRUN.Task.Threat.SrcIP— The ANY.RUN source IP address where the threat originated.ANYRUN.Task.Threat.DstIP— The ANY.RUN threat destination IP address.ANYRUN.Task.HttpRequest.Reputation— The ANY.RUN HTTP request reputation.ANYRUN.Task.HttpRequest.Country— The ANY.RUN HTTP request country.ANYRUN.Task.HttpRequest.ProcessUUID— The ANY.RUN UUID of the process making the HTTP request.ANYRUN.Task.HttpRequest.Body— The ANY.RUN HTTP request body parameters and details.ANYRUN.Task.HttpRequest.HttpCode— The ANY.RUN HTTP request response code.ANYRUN.Task.HttpRequest.Status— The ANY.RUN status of the HTTP request.ANYRUN.Task.HttpRequest.ProxyDetected— Whether the ANY.RUN HTTP request was made through a proxy.ANYRUN.Task.HttpRequest.Port— The ANY.RUN HTTP request port.ANYRUN.Task.HttpRequest.IP— The ANY.RUN HTTP request IP address.ANYRUN.Task.HttpRequest.URL— The ANY.RUN HTTP request URL.ANYRUN.Task.HttpRequest.Host— The ANY.RUN HTTP request host.ANYRUN.Task.HttpRequest.Method— The ANY.RUN HTTP request method type.ANYRUN.Task.FileInfo— The ANY.RUN submitted file details.ANYRUN.Task.OS— The ANY.RUN operating system of the sandbox in which the file was analyzed.ANYRUN.Task.ID— The unique ANY.RUN task ID.ANYRUN.Task.MIME— The ANY.RUN MIME of the file submitted for analysis.ANYRUN.Task.Verdict— The ANY.RUN verdict for the maliciousness of the submitted file or URL.ANYRUN.Task.Process.FileName— The ANY.RUN process file name.ANYRUN.Task.Process.PID— The ANY.RUN process identification number.ANYRUN.Task.Process.PPID— The ANY.RUN process parent process identification number.ANYRUN.Task.Process.ProcessUUID— The unique ANY.RUN process UUID.ANYRUN.Task.Process.CMD— The ANY.RUN process command.ANYRUN.Task.Process.Path— The path of the executed ANY.RUN process command.ANYRUN.Task.Process.User— The user who executed the ANY.RUN process command.ANYRUN.Task.Process.IntegrityLevel— The ANY.RUN process integrity level.ANYRUN.Task.Process.ExitCode— The ANY.RUN process exit code.ANYRUN.Task.Process.MainProcess— Whether the ANY.RUN process is the main process.ANYRUN.Task.Process.Version.Company— The company responsible for the executed ANY.RUN process program.ANYRUN.Task.Process.Version.Description— The description of the ANY.RUN process program type.ANYRUN.Task.Process.Version.Version— The version of the executed program.URL.Data— The URL data.URL.Malicious.Vendor— The vendor that decided the URL is malicious.URL.Malicious.Description— The reason the vendor decided the URL is malicious.ANYRUN.Task.Status— The task analysis status.FireEyeAX.Submissions.Key— The submission keyFireEyeAX.Submissions.Severity— The severity level of the fileFireEyeAX.Submissions.InfoLevel— The info level of the report.DBotScore.Score— The actual score.DBotScore.Indicator— The indicator that was tested.DBotScore.Vendor— The vendor used to calculate the score.Triage.sample-summaries.completed— The date the sample analysis was completed.Triage.sample-summaries.created— The date the analysis report was created.Triage.sample-summaries.custom— The custom sample analysis.Triage.sample-summaries.owner— The owner of the sample summaries.Triage.sample-summaries.sample— The unique identifier of the sample.Triage.sample-summaries.score— The score of the sample on a scale of 0 to 10.Triage.sample-summaries.sha256— The SHA256 of the sample.Triage.sample-summaries.status— The status of the analysis.Triage.sample-summaries.target— The target for the analysis.Triage.sample-summaries.tasks— The tasks performed in the analysis.HybridAnalysis.URL.Scanner.Name— The URL scanner name.HybridAnalysis.URL.Scanner.Positives— The number of positive scanners.HybridAnalysis.URL.Scanner.Status— The status of the scanning.HybridAnalysis.URL.Scanner— The place holder for the scanner data.SecneurXAnalysis.Report.SHA256— SHA256 value of the analyzed sampleSecneurXAnalysis.Report.Verdict— Summary result of the analyzed sampleSecneurXAnalysis.Report.Tags— More details of the analyzed sampleSecneurXAnalysis.Report.IOC— List of IOC's observed in the analyzed sampleSecneurXAnalysis.Report.Status— Analysis queued sample state
Commands used
cs-falcon-sandbox-submit-url
Flowchart
Detonate URL through one or more active integrations that support URL detonation. Supported integrations: - SecneurX Analysis - ANY.RUN Cloud Sandbox - McAfee Advanced Threat Defense - WildFire - Lastline - Cuckoo Sandbox - Cisco Secure Malware Analytics (ThreatGrid) - JoeSecurity - CrowdStrike Falcon Sandbox - FireEye AX - VMRay Analyzer - Polygon - CrowdStrike Falcon Intelligence Sandbox - OPSWAT Filescan - VirusTotal - Anomali ThreatStream - Hatching Triage - ThreatGrid ## Dependencies This playbook uses the following sub-playbooks, integrations, and scripts. ### Sub-playbooks * Detonate URL - SecneurX Analysis * Detonate URL - ThreatStream * Detonate URL - VMRay * Detonate URL - Cuckoo * Detonate URL - McAfee ATD * Detonate URL - Group-IB TDS Polygon * Detonate URL - ThreatGrid v2 * Detonate URL - WildFire v2.2 * Detonate URL - VirusTotal (API v3) * Detonate URL - Hatching Triage * Detonate URL - CrowdStrike Falcon Intelligence Sandbox v2 * Detonate URL - FireEye AX * Detonate URL - Lastline v2 * ANYRUN Detonate Url Android * ANYRUN Detonate Url Linux * ANYRUN Detonate Url Windows ### Integrations This playbook does not use any integrations. ### Scripts This playbook does not use any scripts. ### Commands * opswat-filescan-scan-url * joe-submit-url ## Playbook Inputs --- | **Name** | **Description** | **Default Value** | **Required** | | --- | --- | --- | --- | | URL | The URL object of the URL to be detonated. | URL.Data | Optional | ## Playbook Outputs --- | **Path** | **Description** | **Type** | |--------------------------------------------------------------------------| --- | --- | | ThreatGrid.Sample.id | The sample id. | string | | ThreatGrid.Sample.filename | The sample filename. | string | | ThreatGrid.Sample.state | The state of the sample, one of a stable set of strings "wait, prep, run, proc, succ, fail". | string | | ThreatGrid.Sample.status | The sample status. | string | | ThreatGrid.Sample.md5 | The sample md5. | string | | ThreatGrid.Sample.sha1 | The sample sha1. | string | | ThreatGrid.Sample.sha256 | The sample sha256. | string | | ThreatGrid.Sample.os | The sample os. | string | | ThreatGrid.Sample.submitted_at | The sample submission time. | string | | ATD.Task.taskId | The task ID of the sample uploaded. | string | | ATD.Task.jobId | The job ID of the sample uploaded. | string | | ATD.Task.messageId | The message Id relevant to the sample uploaded. | string | | ATD.Task.url | The URL detonated. | string | | ATD.Task.srcIp | Source IPv4 address. | string | | ATD.Task.destIp | Destination IPv4 address. | string | | ATD.Task.MD5 | MD5 of the sample uploaded. | string | | ATD.Task.SHA1 | SHA1 of the sample uploaded. | string | | ATD.Task.SHA256 | SHA256 of the sample uploaded. | string | | File.Name | Filename \(only in case of report type=json\). | string | | File.Type | File type e.g. "PE" \(only in case of report type=json\). | string | | File.MD5 | MD5 hash of the file \(only in case of report type=json\). | string | | File.SHA1 | SHA1 hash of the file \(only in case of report type=json\). | string | | File.SHA256 | SHA256 hash of the file \(only in case of report type=json\). | string | | File.EntryID | The Entry ID of the sample. | string | | File.Malicious | File Malicious object. | unknown | | DBotScore.Indicator | The indicator we tested \(only in case of report type=json\). | string | | DBotScore.Type | The type of the indicator \(only in case of report type=json\). | string | | DBotScore.Vendor | Vendor used to calculate the score \(only in case of report type=json\). | string | | DBotScore.Score | The actual score \(only in case of report type=json\). | number | | IP.Address | IP's relevant to the sample. | string | | InfoFile.EntryID | The EntryID of the report file. | string | | InfoFile.Extension | The extension of the report file. | string | | InfoFile.Name | The name of the report file. | string | | InfoFile.Info | The info of the report file. | string | | InfoFile.Size | The size of the report file. | number | | InfoFile.Type | The type of the report file. | string | | URL.Malicious | URL Malicious object. | string | | DBotScore.Reliability | The reliability of the source providing the intelligence data. | string | | URL.Data | The URL. | string | | Joe.Analysis.AnalysisID | The analysis ID. | string | | Joe.Analysis.Classification | The classification. | string | | Joe.Analysis.Comments | The comments. | string | | Joe.Analysis.detection | The detection. | string | | Joe.Analysis.duration | The duration. | string | | Joe.Analysis.encrypted | True if the analysis data is encrypted. | string | | Joe.Analysis.filename | The filename. | string | | Joe.Analysis.score | The score. | string | | Joe.Analysis.scriptname | The script name. | string | | Joe.Analysis.status | The status. | string | | Joe.Analysis.threatname | The threat name. | string | | Joe.Analysis.time | The time. | string | | Joe.Analysis.webid | The web ID. | string | | Joe.Analysis.runs.detection | The detection. | string | | Joe.Analysis.runs.error | The error. | string | | Joe.Analysis.runs.score | The score. | string | | Joe.Analysis.runs.sigma | The sigma. | string | | Joe.Analysis.runs.snort | The snort. | string | | Joe.Analysis.runs.system | The system. | string | | Joe.Analysis.runs.yara | The YARA. | string | | Joe.Submission.most_relevant_analysis.detection | The detection. | string | | Joe.Submission.most_relevant_analysis.score | The submission score. | string | | Joe.Submission.most_relevant_analysis.webid | The submission web ID. | string | | Joe.Submission.name | The submission name. | string | | Joe.Submission.status | The submission status. | string | | Joe.Submission.submission_id | The submission ID. | string | | Joe.Submission.time | The submission time. | string | | File.Size | File size \(only in case of report type=json\). | number | | File.Malicious.Vendor | The vendor that determined that a file is malicious. | string | | File.Malicious.Description | The reason that the vendor determined that the file is malicious. | string | | File.Malicious.Score | The score that the malicious file received from the vendor. | number | | URL.Malicious.Vendor | The vendor that determined that a URL is malicious. | string | | URL.Malicious.Description | The reason that the vendor determined that the URL is malicious. | string | | URL.Malicious.Score | The score that the malicious URL received from the vendor. | number | | Lastline.Submission.Status | Status of the submission. | string | | Lastline.Submission.DNSqueries | List of DNS queries done by the analysis subject. | string | | Lastline.Submission.NetworkConnections | List of network connections done by the analysis subject. | string | | Lastline.Submission.DownloadedFiles | List of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element. | string | | Lastline.Submission.UUID | ID of the submission. | string | | Lastline.Submission.YaraSignatures.name | Yara signatures name. | string | | Lastline.Submission.YaraSignatures.score | The score according to the yara signatures. from 0 to 100. | number | | Lastline.Submission.YaraSignatures.internal | True if the signature is only for internal use. | boolean | | Lastline.Submission.Process.arguments | Argument of the process. | string | | Lastline.Submission.Process.process_id | The process ID. | string | | Lastline.Submission.Process.executable.abs_path | Absolute path of the executable of the process. | string | | Lastline.Submission.Process.executable.filename | Filename of the executable. | string | | Lastline.Submission.Process.executable.yara_signature_hits | Yara signature of the executable of the process. | string | | Cuckoo.Task.Category | Category of task. | string | | Cuckoo.Task.Machine | Machine of task. | string | | Cuckoo.Task.Errors | Errors of task. | string | | Cuckoo.Task.Traget | Traget of task. | string | | Cuckoo.Task.Package | Package of task. | string | | Cuckoo.Task.SampleID | Sample ID of task. | string | | Cuckoo.Task.Guest | Task guest. | string | | Cuckoo.Task.Custom | Custom values of task. | string | | Cuckoo.Task.Owner | Task owner. | string | | Cuckoo.Task.Priority | Priority of task. | string | | Cuckoo.Task.Platform | Platform of task. | string | | Cuckoo.Task.Options | Task options. | string | | Cuckoo.Task.Status | Task status. | string | | Cuckoo.Task.EnforceTimeout | Is timeout of task enforced. | string | | Cuckoo.Task.Timeout | Task timeout. | string | | Cuckoo.Task.Memory | Task memory. | string | | Cuckoo.Task.Tags | Task tags. | string | | Cuckoo.Task.ID | ID of task. | string | | Cuckoo.Task.AddedOn | Date on which the task was added. | string | | Cuckoo.Task.CompletedOn | Date on which the task was completed. | string | | Cuckoo.Task.Score | Reported score of the the task. | string | | Cuckoo.Task.Monitor | Monitor of the reported task. | string | | ANYRUN.Task.AnalysisDate | Date and time the analysis was executed. | String | | ANYRUN.Task.FileInfo | Details of the submitted file. | String | | ANYRUN.Task.OS | OS of the sandbox in which the file was analyzed. | String | | ANYRUN.Task.ID | The unique ID of the task. | String | | ANYRUN.Task.MIME | The MIME of the file submitted for analysis. | String | | ANYRUN.Task.Verdict | ANY.RUN verdict for the maliciousness of the submitted file or URL. | String | | ANYRUN.Task.Status | Task analysis status. | String | | ANYRUN.Task.Behavior.Category | Category of a process behavior. | String | | ANYRUN.Task.Behavior.Action | Actions performed by a process. | String | | ANYRUN.Task.Behavior.ThreatLevel | Threat score associated with a process behavior. | Number | | ANYRUN.Task.Behavior.ProcessUUID | Unique ID of the process whose behaviors are being profiled. | String | | ANYRUN.Task.Connection.Reputation | Connection reputation. | String | | ANYRUN.Task.Connection.ProcessUUID | ID of the process that created the connection. | String | | ANYRUN.Task.Connection.ASN | Connection autonomous system network. | String | | ANYRUN.Task.Connection.Country | Connection country. | String | | ANYRUN.Task.Connection.Protocol | Connection protocol. | String | | ANYRUN.Task.Connection.Port | Connection port number. | Number | | ANYRUN.Task.Connection.IP | Connection IP number. | String | | ANYRUN.Task.DnsRequest.Reputation | Reputation of the DNS request. | String | | ANYRUN.Task.DnsRequest.IP | IP addresses associated with a DNS request. | Unknown | | ANYRUN.Task.DnsRequest.Domain | Domain resolution of a DNS request. | String | | ANYRUN.Task.Threat.ProcessUUID | Unique process ID from where the threat originated. | String | | ANYRUN.Task.Threat.Msg | Threat message. | String | | ANYRUN.Task.Threat.Class | Class of the threat. | String | | ANYRUN.Task.Threat.SrcPort | Port on which the threat originated. | Number | | ANYRUN.Task.Threat.DstPort | Destination port of the threat. | Number | | ANYRUN.Task.Threat.SrcIP | Source IP address where the threat originated. | String | | ANYRUN.Task.Threat.DstIP | Destination IP address of the threat. | String | | ANYRUN.Task.HttpRequest.Reputation | Reputation of the HTTP request. | String | | ANYRUN.Task.HttpRequest.Country | HTTP request country. | String | | ANYRUN.Task.HttpRequest.ProcessUUID | ID of the process making the HTTP request. | String | | ANYRUN.Task.HttpRequest.Body | HTTP request body parameters and details. | Unknown | | ANYRUN.Task.HttpRequest.HttpCode | HTTP request response code. | Number | | ANYRUN.Task.HttpRequest.Status | Status of the HTTP request. | String | | ANYRUN.Task.HttpRequest.ProxyDetected | Whether the HTTP request was made through a proxy. | Boolean | | ANYRUN.Task.HttpRequest.Port | HTTP request port. | Number | | ANYRUN.Task.HttpRequest.IP | HTTP request IP address. | String | | ANYRUN.Task.HttpRequest.URL | HTTP request URL. | String | | ANYRUN.Task.HttpRequest.Host | HTTP request host. | String | | ANYRUN.Task.HttpRequest.Method | HTTP request method type. | String | | ANYRUN.Task.Process.FileName | File name of the process. | String | | ANYRUN.Task.Process.PID | Process identification number. | Number | | ANYRUN.Task.Process.PPID | Parent process identification number. | Number | | ANYRUN.Task.Process.ProcessUUID | Unique process ID \(used by ANY.RUN\). | String | | ANYRUN.Task.Process.CMD | Process command. | String | | ANYRUN.Task.Process.Path | Path of the executed command. | String | | ANYRUN.Task.Process.User | User who executed the command. | String | | ANYRUN.Task.Process.IntegrityLevel | The process integrity level. | String | | ANYRUN.Task.Process.ExitCode | Process exit code. | Number | | ANYRUN.Task.Process.MainProcess | Whether the process is the main process. | Boolean | | ANYRUN.Task.Process.Version.Company | Company responsible for the program executed. | String | | ANYRUN.Task.Process.Version.Description | Description of the type of program. | String | | ANYRUN.Task.Process.Version.Version | Version of the program executed. | String | | Domain.Name | The Domain name. | string | | Domain.DNS | A list of IP objects resolved by DNS. | string | | RegistryKey.Path | The path to the registry key. | string | | RegistryKey.Value | The value at the given RegistryKey. | string | | Process.Name | Process name. | string | | Process.PID | Process PID. | number | | Process.CommandLine | Process Command Line. | string | | Process.Path | Process path. | string | | Process.StartTime | Process start time. | date | | Process.EndTime | Process end time. | date | | Polygon.Analysis.ID | Analysis ID in THF. | number | | Polygon.Analysis.Name | File Name. | string | | Polygon.Analysis.Size | File Size. | number | | Polygon.Analysis.Started | Analysis start timestamp. | date | | Polygon.Analysis.Analyzed | Analysis finish timestamp. | date | | Polygon.Analysis.MD5 | Analyzed file MD5 hash. | string | | Polygon.Analysis.SHA1 | Analyzed file SHA1 hash. | string | | Polygon.Analysis.SHA256 | Analyzed file SHA256. | string | | Polygon.Analysis.Result | Analysis verdict. | string | | Polygon.Analysis.Status | The analysis status. | string | | Polygon.Analysis.Verdict | Analysis verdict. | boolean | | Polygon.Analysis.Probability | Verdict probability. | string | | Polygon.Analysis.Families | Malware families. | string | | Polygon.Analysis.Score | Polygon score. | number | | Polygon.Analysis.Internet-connection | Internet availability. | string | | Polygon.Analysis.Type | File type. | string | | Polygon.Analysis.DumpExists | Network activity dump exists. | boolean | | Polygon.Analysis.File | The information about files in analysis. | string | | Polygon.Analysis.URL | The information about URL indicators. | string | | Polygon.Analysis.IP | The information about IP indicators. | string | | Polygon.Analysis.Domain | The information about Domain indicators. | string | | Polygon.Analysis.RegistryKey | The information about registry keys which were modified during the analysis. | string | | Polygon.Analysis.Process | The information about processes started during the analysis. | string | | CrowdStrike.Submit.job_id | The The submitted report job ID. | string | | CrowdStrike.Submit.submission_type | The type of the submission. | string | | CrowdStrike.Submit.submission_id | The submission ID. | string | | CrowdStrike.Submit.environment_id | The submission environment ID. | string | | CrowdStrike.Submit.sha256 | The SHA256 hash of the file. | string | | CrowdStrike.Report.job_id | The report job ID. | string | | CrowdStrike.Report.environment_id | The report environment ID. | string | | CrowdStrike.Report.environment_description | The environment description. | string | | CrowdStrike.Report.size | The file size. | string | | CrowdStrike.Report.type | The file type. | string | | CrowdStrike.Report.type_short | The short description of the file type. | string | | CrowdStrike.Report.target_url | The target url. | string | | CrowdStrike.Report.state | The report state. | string | | CrowdStrike.Report.error_type | The error type. | string | | CrowdStrike.Report.error_origin | The error origin. | string | | CrowdStrike.Report.submit_name | The file name when submitted. | string | | CrowdStrike.Report.md5 | The MD5 hash of the file. | string | | CrowdStrike.Report.sha1 | The SHA1 hash of the file. | string | | CrowdStrike.Report.sha256 | The SHA256 hash of the file. | string | | CrowdStrike.Report.sha512 | The SHA512 hash of the file. | string | | CrowdStrike.Report.ssdeep | The SSDeep hash of the file. | string | | CrowdStrike.Report.imphash | The imphash hash of the file. | string | | CrowdStrike.Report.av_detect | The AV Multiscan range, for example 50-70 \(min 0, max 100\). | string | | CrowdStrike.Report.vx_family | The file malware famil. | string | | CrowdStrike.Report.url_analysis | Whether this report is url analysis. | string | | CrowdStrike.Report.analysis_start_time | The start time of the analysis. | string | | CrowdStrike.Report.threat_score | The file threat score. | string | | CrowdStrike.Report.interesting | Whether the file was found to be interesting. | string | | CrowdStrike.Report.threat_level | The file threat level. | string | | CrowdStrike.Report.verdict | The file verdict. | string | | CrowdStrike.Report.total_network_connections | The total number of network connections. | number | | CrowdStrike.Report.total_processes | The total number of processes. | number | | CrowdStrike.Report.total_signatures | The total number of signatures. | number | | CrowdStrike.Report.file_metadata | The file metadata. | string | | CrowdStrike.Report.network_mode | The network mode. | string | | CrowdStrike.Report.submissions.submission_id | The submission ID. | string | | CrowdStrike.Report.submissions.filename | The name of the file. | string | | CrowdStrike.Report.submissions.url | The url. | string | | CrowdStrike.Report.submissions.created_at | When the submission was created. | string | | File.MalwareFamily | The file family classification. | string | | WildFire.Report.MD5 | MD5 of the submission. | string | | WildFire.Report.SHA256 | SHA256 of the report. | string | | WildFire.Report.Status | The status of the submission. | string | | WildFire.Report.URL | URL of the submission. | string | | WildFire.Report.iocs | Associated IOCs. | string | | WildFire.Report.verdict | The verdict of the report. | string | | WildFire.Report.Platform | The platform of the report. | string | | WildFire.Report.Software | The software of the report. | string | | File.DigitalSignature.Publisher | The entity that signed the file for authenticity purposes. | string | | WildFire.Report.NetworkInfo.URL.Host | The submission related hosts. | string | | WildFire.Report.NetworkInfo.URL.Method | The submission related method. | string | | WildFire.Report.NetworkInfo.URL.URI | The submission related URI. | string | | WildFire.Report.NetworkInfo.URL.UserAgent | The submission related user agent. | string | | WildFire.Report.NetworkInfo.UDP.IP | The submission related IPs, in UDP protocol. | string | | WildFire.Report.NetworkInfo.UDP.Port | The submission related ports, in UDP protocol. | string | | WildFire.Report.NetworkInfo.UDP.JA3 | The submission related JA3s, in UDP protocol. | string | | WildFire.Report.NetworkInfo.UDP.JA3S | The submission related JA3Ss, in UDP protocol. | string | | WildFire.Report.NetworkInfo.UDP.Country | The submission related countries, in UDP protocol. | string | | WildFire.Report.NetworkInfo.TCP.IP | The submission related IPs, in TCP protocol. | string | | WildFire.Report.NetworkInfo.TCP.JA3 | The submission related JA3s, in TCP protocol. | string | | WildFire.Report.NetworkInfo.TCP.JA3S | The submission related JA3Ss, in TCP protocol. | string | | WildFire.Report.NetworkInfo.TCP.Country | The submission related Countries, in TCP protocol. | string | | WildFire.Report.NetworkInfo.TCP.Port | The submission related ports, in TCP protocol. | string | | WildFire.Report.NetworkInfo.DNS.Query | The submission DNS queries. | string | | WildFire.Report.NetworkInfo.DNS.Response | The submission DNS responses. | string | | WildFire.Report.NetworkInfo.DNS.Type | The submission DNS Types. | string | | WildFire.Report.Evidence.md5 | The submission evidence MD5 hash. | string | | WildFire.Report.Evidence.Text | The submission evidence text. | string | | WildFire.Report.detection_reasons.description | Reason for the detection verdict. | string | | WildFire.Report.detection_reasons.name | Name of the detection. | string | | WildFire.Report.detection_reasons.type | Type of the detection. | string | | WildFire.Report.detection_reasons.verdict | Verdict of the detection. | string | | WildFire.Report.detection_reasons.artifacts | Artifacts of the detection reasons. | string | | WildFire.Report.ProcessList.Service | The process service. | string | | WildFire.Report.ProcessList.ProcessCommand | The process command. | string | | WildFire.Report.ProcessList.ProcessName | The process name. | string | | WildFire.Report.ProcessList.ProcessPid | The process pid. | string | | WildFire.Report.ProcessList.ProcessFile | Lists files that started a child processes, including the process name and the action the process performed. | string | | WildFire.Report.ProcessTree.ProcessName | The process name. | string | | WildFire.Report.ProcessTree.ProcessPid | The process pid. | string | | WildFire.Report.ProcessTree.ProcessText | The action the process performed. | string | | WildFire.Report.ProcessTree.Process.ChildName | The child process name. | string | | WildFire.Report.ProcessTree.Process.ChildPid | The child process pid. | string | | WildFire.Report.ProcessTree.Process.ChildText | The action the child process performed. | string | | WildFire.Report.ExtractedURL.URL | The extracted URL. | string | | WildFire.Report.ExtractedURL.Verdict | The extracted verdict. | string | | WildFire.Report.Summary.Text | The summary of the report. | string | | WildFire.Report.Summary.Details | The details summary of the report. | string | | WildFire.Report.Summary.Behavior | The behavior summary of the report. | string | | WildFire.Report.ELF.ShellCommands | The shell commands. | string | | VirusTotal.Analysis.data.attributes.stats.harmless | Number of engines found the indicator harmless. | number | | VirusTotal.Analysis.data.attributes.stats.malicious | Number of engines found the indicator malicious. | number | | VirusTotal.Analysis.data.attributes.stats.suspicious | Number of engines found the indicator suspicious. | number | | VirusTotal.Analysis.data.attributes.stats.timeout | Number of engines found the indicator timeout. | number | | VirusTotal.Analysis.data.attributes.stats.undetected | Number of engines found the indicator undetected. | number | | VirusTotal.Analysis.data.attributes.date | Date of the analysis in epoch. | number | | VirusTotal.Analysis.data.attributes.status | Status of the analysis. | string | | VirusTotal.Analysis.data.id | ID of the analysis. | string | | VirusTotal.Analysis.data.type | Type of object \(analysis\). | string | | VirusTotal.Analysis.meta.url_info.id | ID of the url. | string | | VirusTotal.Analysis.meta.url_info.url | The URL. | string | | VirusTotal.Analysis.id | The analysis ID. | string | | VMRay.Job.JobID | The ID of a new job. | number | | VMRay.Job.SampleID | The ID of sample. | number | | VMRay.Job.Created | The timestamp of the created job. | date | | VMRay.Job.VMName | The name of virtual machine. | string | | VMRay.Job.VMID | The ID of virtual machine. | number | | VMRay.Sample.SampleID | The sample ID of the task. | number | | VMRay.Sample.Created | The timestamp of the created sample. | date | | VMRay.Sample.FileName | The file name of the sample. | string | | VMRay.Sample.MD5 | The MD5 hash of the sample. | string | | VMRay.Sample.SHA1 | The SHA1 hash of the sample. | string | | VMRay.Sample.SHA256 | The SHA256 hash of the sample. | string | | VMRay.Sample.SSDeep | The SSDeep of the sample. | string | | VMRay.Sample.Verdict | Verdict for the sample \(Malicious, Suspicious, Clean, Not Available\). | String | | VMRay.Sample.VerdictReason | Description of the Verdict Reason. | String | | VMRay.Sample.Severity | Severity of the sample \(Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown\). Deprecated. | string | | VMRay.Sample.Type | The file type. | string | | VMRay.Sample.Classifications | The classifications of the sample. | string | | VMRay.Submission.SubmissionID | The submission ID. | number | | VMRay.Submission.HadErrors | Whether there are any errors in the submission. | boolean | | VMRay.Submission.IsFinished | The status of submission. Can be, "true" or "false". | boolean | | VMRay.Submission.MD5 | The MD5 hash of the sample in submission. | string | | VMRay.Submission.SHA1 | The SHA1 hash of the sample in submission. | string | | VMRay.Submission.SHA256 | The SHA256 hash of the sample in submission. | string | | VMRay.Submission.Verdict | Verdict for the sample \(Malicious, Suspicious, Clean, Not Available\). | String | | VMRay.Submission.VerdictReason | Description of the Verdict Reason. | String | | VMRay.Submission.Severity | Severity of the sample \(Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown\). Deprecated. | string | | VMRay.Submission.SSDeep | The SSDeep hash of the sample in submission. | string | | VMRay.Submission.SampleID | The ID of the sample in submission. | string | | VMRay.Sample.IOC.URL.AnalysisID | The IDs of the other analyses that contain the given URL. | string | | VMRay.Sample.IOC.URL.URL | The URL. | string | | VMRay.Sample.IOC.URL.Operation | The operation of the specified URL. | string | | VMRay.Sample.IOC.URL.ID | The ID of the URL. | string | | VMRay.Sample.IOC.URL.Type | The type of the URL. | string | | VMRay.Sample.IOC.Domain.AnalysisID | The IDs of the other analyses that contain the given domain. | string | | VMRay.Sample.IOC.Domain.Domain | The domain. | string | | VMRay.Sample.IOC.Domain.ID | The ID of the domain. | string | | VMRay.Sample.IOC.Domain.Type | The type of the domain. | string | | VMRay.Sample.IOC.IP.AnalysisID | The IDs of the other analyses that contain the given IP address. | string | | VMRay.Sample.IOC.IP.IP | The IP address. | string | | VMRay.Sample.IOC.IP.Operation | The operation of the given IP address. | string | | VMRay.Sample.IOC.IP.ID | The ID of the IP address. | string | | VMRay.Sample.IOC.IP.Type | The type of the IP address. | string | | VMRay.Sample.IOC.Mutex.AnalysisID | The IDs of other analyses that contain the given IP address. | string | | VMRay.Sample.IOC.Mutex.Name | The name of the mutex. | string | | VMRay.Sample.IOC.Mutex.Operation | The operation of the given mutex. | string | | VMRay.Sample.IOC.Mutex.ID | The ID of the mutex. | string | | VMRay.Sample.IOC.Mutex.Type | The type of the mutex. | string | | VMRay.Sample.IOC.File.AnalysisID | The IDs of other analyses that contain the given file. | string | | VMRay.Sample.IOC.File.Name | The name of the file. | string | | VMRay.Sample.IOC.File.Operation | The operation of the given file. | string | | VMRay.Sample.IOC.File.ID | The ID of the file. | string | | VMRay.Sample.IOC.File.Type | The type of the file. | string | | VMRay.Sample.IOC.File.Hashes.MD5 | The MD5 hash of the given file. | string | | VMRay.Sample.IOC.File.Hashes.SSDeep | The SSDeep hash of the given file. | string | | VMRay.Sample.IOC.File.Hashes.SHA256 | The SHA256 hash of the given file. | string | | VMRay.Sample.IOC.File.Hashes.SHA1 | The SHA1 hash of the given file. | string | | VMRay.ThreatIndicator.AnalysisID | The list of connected analysis IDs. | string | | VMRay.ThreatIndicator.Category | The category of threat indicators. | string | | VMRay.ThreatIndicator.Classification | The classifications of threat indicators. | string | | VMRay.ThreatIndicator.ID | The ID of the threat indicator. | string | | VMRay.ThreatIndicator.Operation | The operation that caused the indicators. | string | | ThreatStream.Analysis.ReportID | The report ID submitted to the sandbox. | string | | ThreatStream.Analysis.Status | The analysis status. | string | | ThreatStream.Analysis.Platform | The platform of the submission submitted to the sandbox. | string | | ThreatStream.Analysis.Category | The report category. | string | | ThreatStream.Analysis.Started | The detonation start time. | string | | ThreatStream.Analysis.Completed | The detonation completion time. | string | | ThreatStream.Analysis.Duration | The duration of the detonation \(in seconds\). | string | | ThreatStream.Analysis.VmName | The VM name. | string | | ThreatStream.Analysis.VmID | The VM ID. | string | | ThreatStream.Analysis.Verdict | The verdict of the sandbox detonation. | string | | ThreatStream.Analysis.Network.UdpSource | The UDP source. | string | | ThreatStream.Analysis.Network.UdpDestination | The UDP destination. | string | | ThreatStream.Analysis.Network.UdpPort | The UDP port. | number | | ThreatStream.Analysis.Network.IcmpSource | The ICMP source. | string | | ThreatStream.Analysis.Network.IcmpDestination | The ICMP destination. | string | | ThreatStream.Analysis.Network.IcmpPort | The ICMP port. | number | | ThreatStream.Analysis.Network.TcpSource | The TCP source. | string | | ThreatStream.Analysis.Network.TcpDestination | The TCP destination. | string | | ThreatStream.Analysis.Network.TcpPort | The TCP port. | number | | ThreatStream.Analysis.Network.HttpSource | The source of the HTTP address. | string | | ThreatStream.Analysis.Network.HttpDestinaton | The destination of the HTTP address. | string | | ThreatStream.Analysis.Network.HttpPort | The port of the HTTP address. | string | | ThreatStream.Analysis.Network.HttpsSource | The source of the HTTPS address. | string | | ThreatStream.Analysis.Network.HttpsDestinaton | The destination of the HTTPS address. | string | | ThreatStream.Analysis.Network.HttpsPort | The port of the HTTPS address. | string | | ThreatStream.Analysis.Network.Hosts | The network analysis hosts. | string | | FireEyeAX.Submissions.URL.Key | The submission key. | string | | FireEyeAX.Submissions.Severity | The severity level of the file. | string | | FireEyeAX.Submissions.InfoLevel | The info level of the report. | string | | Triage.sample-summaries.completed | Date the sample analysis was completed. | date | | Triage.sample-summaries.created | Date the analysis report was created. | date | | Triage.sample-summaries.custom | Custom sample analysis. | string | | Triage.sample-summaries.owner | Owner of the sample analysis. | string | | Triage.sample-summaries.sample | Unique identifier of the sample,. | string | | Triage.sample-summaries.score | Score of the sample on a scale of 0 to 10. | number | | Triage.sample-summaries.sha256 | SHA256 hash of the sample. | string | | Triage.sample-summaries.status | Status of the analysis. | string | | Triage.sample-summaries.target | Target for the analysis. | string | | Triage.sample-summaries.tasks | Tasks performed in the analysis. | string | | SecneurXAnalysis.Report.SHA256 | SHA256 value of the analyzed sample. | string | | SecneurXAnalysis.Report.Platform | Platform of the analyzed sample. | String | | SecneurXAnalysis.Report.Verdict | Summary result of the analyzed sample. | string | | SecneurXAnalysis.Report.Tags | More details of the analyzed sample. | string | | SecneurXAnalysis.Report.DnsRequests | List of DNS data observed in the analyzed sample. | string | | SecneurXAnalysis.Report.HttpRequests | List of HTTP data observed in the analyzed sample. | string | | SecneurXAnalysis.Report.JA3Digests | List of JA3 data observed in the analyzed sample. | string | | SecneurXAnalysis.Report.ProcessCreated | Process behaviour data observed in the analyzed sample. | string | | SecneurXAnalysis.Report.RegistrySet | List of Registry creations observed in the analyzed sample. | string | | SecneurXAnalysis.Report.RegistryDeleted | List of Registry deletions observed in the analyzed sample. | string | | SecneurXAnalysis.Report.FileCreated | List of File creations observed in the analyzed sample. | string | | SecneurXAnalysis.Report.FileDropped | List of File drops observed in the analyzed sample. | string | | SecneurXAnalysis.Report.FileDeleted | List of File deletions observed in the analyzed sample. | string | | SecneurXAnalysis.Report.FileModified | List of File changes observed in the analyzed sample. | string | | SecneurXAnalysis.Report.IOC | List of IOC's observed in the analyzed sample. | string | | SecneurXAnalysis.Report.Status | Analysis queued sample state. | String | | csfalconx.resource.id | Analysis ID. | String | | csfalconx.resource.verdict | Analysis verdict. | String | | csfalconx.resource.created_timestamp | Analysis start time. | String | | csfalconx.resource.environment_id | Environment ID. | String | | csfalconx.resource.environment_description | Environment description. | String | | csfalconx.resource.threat_score | Score of the threat. | Int | | csfalconx.resource.submit_url | URL submitted for analysis. | String | | csfalconx.resource.submission_type | Type of submitted artifact, for example file, URL, etc. | String | | csfalconx.resource.sha256 | SHA256 hash of the submitted file. | String | | csfalconx.resource.ioc_report_strict_csv_artifact_id | ID of the IOC pack to download \(CSV\). | String | | csfalconx.resource.ioc_report_broad_csv_artifact_id | ID of the IOC pack to download \(CSV\). | String | | csfalconx.resource.ioc_report_strict_json_artifact_id | ID of the IOC pack to download \(JSON\). | Int | | csfalconx.resource.ioc_report_broad_json_artifact_id | ID of the IOC pack to download \(JSON\). | String | | csfalconx.resource.ioc_report_strict_stix_artifact_id | ID of the IOC pack to download \(STIX\). | String | | csfalconx.resource.ioc_report_broad_stix_artifact_id | ID of the IOC pack to download \(STIX\). | Int | | csfalconx.resource.ioc_report_strict_maec_artifact_id | ID of the IOC pack to download \(MAEC\). | String | | csfalconx.resource.ioc_report_broad_maec_artifact_id | ID of the IOC pack to download \(MAEC\). | String | | OPSWAT.Filescan.Submission.flow_id | The flow ID. | string | | OPSWAT.Filescan.Analysis.finalVerdict.verdict | The final verdict. | string | | OPSWAT.Filescan.Analysis.allTags | All tags. | string | | OPSWAT.Filescan.Analysis.overallState | Overall state of the scan. | string | | OPSWAT.Filescan.Analysis.subtaskReferences | Status of scan subtasks. | string | | OPSWAT.Filescan.Analysis.allSignalGroups | All signal groups. | string | | OPSWAT.Filescan.Analysis.resources | Resources. | string | | OPSWAT.Filescan.Analysis.taskReference.name | Name of the main scan task. | string | | OPSWAT.Filescan.Analysis.taskReference.additionalInfo | Additional informations about the main scan task. | string | | OPSWAT.Filescan.Analysis.taskReference.ID | ID of the main scan task. | string | | OPSWAT.Filescan.Analysis.taskReference.state | State of the main scan task. | string | | OPSWAT.Filescan.Analysis.taskReference.resourceReference | Resource reference of the main scan task. | string | | OPSWAT.Filescan.Analysis.taskReference.opcount | Counter. | string | | OPSWAT.Filescan.Analysis.taskReference.processTime | processTime. | string | | OPSWAT.Filescan.Analysis.file.name | The name of the file. | string | | OPSWAT.Filescan.Analysis.file.hash | The SHA256 of the file. | string | | OPSWAT.Filescan.Analysis.file.type | The type of the submission. | string | | ANYRUN.SandboxAnalysis.mitre.name | String | MITRE Technic text description. | | ANYRUN.SandboxAnalysis.mitre.phases | String | MITRE Technic phases. | | ANYRUN.SandboxAnalysis.mitre.id | String | MITRE Technic identifier. | | ANYRUN.SandboxAnalysis.debugStrings | Unknown | Analysis debug information. | | ANYRUN.SandboxAnalysis.incidents.process | String | Analysis process. | | ANYRUN.SandboxAnalysis.incidents.events.time | Date | Event time. | | ANYRUN.SandboxAnalysis.incidents.events.cmdline | String | Event command line. | | ANYRUN.SandboxAnalysis.incidents.events.image | String | Event image. | | ANYRUN.SandboxAnalysis.incidents.mitre.v | String | MITRE version. | | ANYRUN.SandboxAnalysis.incidents.mitre.sid | String | SID. | | ANYRUN.SandboxAnalysis.incidents.mitre.tid | String | TID. | | ANYRUN.SandboxAnalysis.incidents.count | String | Count of related incidents. | | ANYRUN.SandboxAnalysis.incidents.firstSeen | Date | Incident first seen date. | | ANYRUN.SandboxAnalysis.incidents.source | String | Incident source. | | ANYRUN.SandboxAnalysis.incidents.desc | String | Incident description. | | ANYRUN.SandboxAnalysis.incidents.title | String | Incident title. | | ANYRUN.SandboxAnalysis.incidents.threatLevel | String | Incident threat level. | | ANYRUN.SandboxAnalysis.incidents.events.typeValue | String | Event type value. | | ANYRUN.SandboxAnalysis.incidents.events.key | String | Event key. | | ANYRUN.SandboxAnalysis.incidents.events.value | String | Event value. | | ANYRUN.SandboxAnalysis.incidents.events.name | String | Event name. | | ANYRUN.SandboxAnalysis.incidents.events.operation | String | Even operation. | | ANYRUN.SandboxAnalysis.incidents.events.cmdParent | String | Event parent cmd. | | ANYRUN.SandboxAnalysis.incidents.events.cmdChild | String | Event child cmd. | | ANYRUN.SandboxAnalysis.modified.registry.time | Date | Registry time. | | ANYRUN.SandboxAnalysis.modified.registry.process | String | Registry process. | | ANYRUN.SandboxAnalysis.modified.registry.operation | String | Registry operation. | | ANYRUN.SandboxAnalysis.modified.registry.value | String | Registry value. | | ANYRUN.SandboxAnalysis.modified.registry.name | String | Registry name. | | ANYRUN.SandboxAnalysis.modified.registry.key | String | Registry key. | | ANYRUN.SandboxAnalysis.modified.files.process | String | File process. | | ANYRUN.SandboxAnalysis.modified.files.size | String | File size. | | ANYRUN.SandboxAnalysis.modified.files.filename | String | Filename. | | ANYRUN.SandboxAnalysis.modified.files.time | Date | File creating time. | | ANYRUN.SandboxAnalysis.modified.files.info.mime | String | File MIME type. | | ANYRUN.SandboxAnalysis.modified.files.info.file | String | File content. | | ANYRUN.SandboxAnalysis.modified.files.permanentUrl | String | File url. | | ANYRUN.SandboxAnalysis.modified.files.hashes.ssdeep | String | File SSDeep. | | ANYRUN.SandboxAnalysis.modified.files.hashes.sha256 | String | File sha256 hash. | | ANYRUN.SandboxAnalysis.modified.files.hashes.sha1 | String | File sha1 hash. | | ANYRUN.SandboxAnalysis.modified.files.hashes.md5 | String | File md5 hash. | | ANYRUN.SandboxAnalysis.modified.files.threatLevel | String | File threat level. | | ANYRUN.SandboxAnalysis.modified.files.type | String | File type. | | ANYRUN.SandboxAnalysis.network.threats | Unknown | Analysis network threats. | | ANYRUN.SandboxAnalysis.network.connections.reputation | String | Network connection reputation. | | ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3SFullstring | String | Network connection ja3S. | | ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3S | String | Network connection ja3S. | | ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3Fullstring | String | Network connection ja3F. | | ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3 | String | Network connection ja3F. | | ANYRUN.SandboxAnalysis.network.connections.time | Date | Network connection time. | | ANYRUN.SandboxAnalysis.network.connections.asn | String | Network connection ASN. | | ANYRUN.SandboxAnalysis.network.connections.country | String | Network connection country. | | ANYRUN.SandboxAnalysis.network.connections.protocol | String | Network connection protocol. | | ANYRUN.SandboxAnalysis.network.connections.port | String | Network connection port. | | ANYRUN.SandboxAnalysis.network.connections.ip | String | Network connection ip. | | ANYRUN.SandboxAnalysis.network.connections.process | String | Network connection processes. | | ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.jarm | String | Network connection jarm. | | ANYRUN.SandboxAnalysis.network.httpRequests.country | String | HTTP Request country. | | ANYRUN.SandboxAnalysis.network.httpRequests.reputation | String | HTTP Request reputation. | | ANYRUN.SandboxAnalysis.network.httpRequests.process | String | HTTP Request related process. | | ANYRUN.SandboxAnalysis.network.httpRequests.httpCode | String | HTTP Request status code. | | ANYRUN.SandboxAnalysis.network.httpRequests.status | String | HTTP Request status. | | ANYRUN.SandboxAnalysis.network.httpRequests.user-agent | String | HTTP Request User-Agent header value. | | ANYRUN.SandboxAnalysis.network.httpRequests.proxyDetected | String | HTTP Request is proxy detected. | | ANYRUN.SandboxAnalysis.network.httpRequests.port | String | HTTP Request port. | | ANYRUN.SandboxAnalysis.network.httpRequests.ip | String | HTTP Request ip. | | ANYRUN.SandboxAnalysis.network.httpRequests.url | String | HTTP Request url. | | ANYRUN.SandboxAnalysis.network.httpRequests.host | String | HTTP Request host. | | ANYRUN.SandboxAnalysis.network.httpRequests.method | String | HTTP Request method. | | ANYRUN.SandboxAnalysis.network.httpRequests.time | Date | HTTP Request time estimate. | | ANYRUN.SandboxAnalysis.network.dnsRequests.reputationNumber | String | DNS Request reputation number. | | ANYRUN.SandboxAnalysis.network.dnsRequests.reputation | String | DNS Request reputation. | | ANYRUN.SandboxAnalysis.network.dnsRequests.ips | String | DNS Request IPs. | | ANYRUN.SandboxAnalysis.network.dnsRequests.domain | String | DNS Request domain. | | ANYRUN.SandboxAnalysis.network.dnsRequests.time | Date | DNS Request time estimate. | | ANYRUN.SandboxAnalysis.malconf | Unknown | Analysis malconf. | | ANYRUN.SandboxAnalysis.processes.synchronization | Unknown | Analysis processes synchronization. | | ANYRUN.SandboxAnalysis.processes.modules | Unknown | Analysis processes modules. | | ANYRUN.SandboxAnalysis.processes.hasMalwareConfig | String | Process has malware config. | | ANYRUN.SandboxAnalysis.processes.parentUUID | String | Process parent UUID. | | ANYRUN.SandboxAnalysis.processes.status | String | Process status. | | ANYRUN.SandboxAnalysis.processes.scores.specs.malwareConfig | String | Process malware config. | | ANYRUN.SandboxAnalysis.processes.scores.specs.privEscalation | String | Process priv escalation. | | ANYRUN.SandboxAnalysis.processes.scores.specs.stealing | String | Process stealing. | | ANYRUN.SandboxAnalysis.processes.scores.specs.networkLoader | String | Process network loader. | | ANYRUN.SandboxAnalysis.processes.scores.specs.network | String | Process network. | | ANYRUN.SandboxAnalysis.processes.scores.specs.lowAccess | String | Process low access. | | ANYRUN.SandboxAnalysis.processes.scores.specs.knownThreat | String | Process known threat. | | ANYRUN.SandboxAnalysis.processes.scores.specs.injects | String | Process inject. | | ANYRUN.SandboxAnalysis.processes.scores.specs.exploitable | String | Process exploitable. | | ANYRUN.SandboxAnalysis.processes.scores.specs.executableDropped | String | Process executable dropped. | | ANYRUN.SandboxAnalysis.processes.scores.specs.debugOutput | String | Process debug output. | | ANYRUN.SandboxAnalysis.processes.scores.specs.crashedApps | String | Process crashed apps. | | ANYRUN.SandboxAnalysis.processes.scores.specs.autoStart | String | Process auto start. | | ANYRUN.SandboxAnalysis.processes.scores.loadsSusp | String | Process loads susp. | | ANYRUN.SandboxAnalysis.processes.scores.injected | String | Process injected. | | ANYRUN.SandboxAnalysis.processes.scores.dropped | String | Process dropped. | | ANYRUN.SandboxAnalysis.processes.scores.verdict.threatLevelText | String | Process threat level text. | | ANYRUN.SandboxAnalysis.processes.scores.verdict.threatLevel | String | Process threat level. | | ANYRUN.SandboxAnalysis.processes.scores.verdict.score | String | Process score. | | ANYRUN.SandboxAnalysis.processes.context.userName | String | Process context username. | | ANYRUN.SandboxAnalysis.processes.context.integrityLevel | String | Process context integrity level. | | ANYRUN.SandboxAnalysis.processes.context.rebootNumber | String | Process context reboot number. | | ANYRUN.SandboxAnalysis.processes.versionInfo.version | String | Process version. | | ANYRUN.SandboxAnalysis.processes.versionInfo.description | String | Process description. | | ANYRUN.SandboxAnalysis.processes.versionInfo.company | String | Process company. | | ANYRUN.SandboxAnalysis.processes.mainProcess | String | Process main process. | | ANYRUN.SandboxAnalysis.processes.fileType | String | Process file type. | | ANYRUN.SandboxAnalysis.processes.fileName | String | Process filename. | | ANYRUN.SandboxAnalysis.processes.commandLine | String | Process cmd. | | ANYRUN.SandboxAnalysis.processes.image | String | Process image. | | ANYRUN.SandboxAnalysis.processes.uuid | String | Process uuid. | | ANYRUN.SandboxAnalysis.processes.ppid | String | Process PPID. | | ANYRUN.SandboxAnalysis.processes.important | String | Process important. | | ANYRUN.SandboxAnalysis.processes.pid | String | Process PID. | | ANYRUN.SandboxAnalysis.processes.exitCode | String | Process exit code. | | ANYRUN.SandboxAnalysis.processes.times.terminate | Date | Process time terminate. | | ANYRUN.SandboxAnalysis.processes.times.start | Date | Process time start. | | ANYRUN.SandboxAnalysis.processes.resolvedCOM.title | String | Process resolved COM title. | | ANYRUN.SandboxAnalysis.processes.synchronization.operation | String | Process sync operation. | | ANYRUN.SandboxAnalysis.processes.synchronization.type | String | Process sync type. | | ANYRUN.SandboxAnalysis.processes.synchronization.name | String | Process sync name. | | ANYRUN.SandboxAnalysis.processes.synchronization.time | Date | Process sync time. | | ANYRUN.SandboxAnalysis.processes.modules.image | String | Process module image. | | ANYRUN.SandboxAnalysis.processes.modules.time | Date | Process module time. | | ANYRUN.SandboxAnalysis.processes.scores.monitoringReason | String | Process monitoring reason. | | ANYRUN.SandboxAnalysis.processes.times.monitoringSince | Date | Process monitoring since. | | ANYRUN.SandboxAnalysis.counters.synchronization.type.event | String | Process sync event. | | ANYRUN.SandboxAnalysis.counters.synchronization.type.mutex | String | Process sync mutex. | | ANYRUN.SandboxAnalysis.counters.synchronization.operation.create | String | Process sync operation create. | | ANYRUN.SandboxAnalysis.counters.synchronization.operation.open | String | Process sync operation open. | | ANYRUN.SandboxAnalysis.counters.synchronization.total | String | Process sync total. | | ANYRUN.SandboxAnalysis.counters.registry.delete | String | Registry delete. | | ANYRUN.SandboxAnalysis.counters.registry.write | String | Registry write. | | ANYRUN.SandboxAnalysis.counters.registry.read | String | Registry reed. | | ANYRUN.SandboxAnalysis.counters.registry.total | String | Registry total. | | ANYRUN.SandboxAnalysis.counters.files.malicious | String | File malicious count. | | ANYRUN.SandboxAnalysis.counters.files.suspicious | String | File suspicious count. | | ANYRUN.SandboxAnalysis.counters.files.text | String | File text. | | ANYRUN.SandboxAnalysis.counters.files.unknown | String | File unknown count. | | ANYRUN.SandboxAnalysis.counters.network.threats | String | Network threats count. | | ANYRUN.SandboxAnalysis.counters.network.dns | String | Network dns count. | | ANYRUN.SandboxAnalysis.counters.network.connections | String | Network connections count. | | ANYRUN.SandboxAnalysis.counters.network.http | String | Network networks count. | | ANYRUN.SandboxAnalysis.counters.processes.malicious | String | Malicious processes count. | | ANYRUN.SandboxAnalysis.counters.processes.suspicious | String | Suspicious processes count. | | ANYRUN.SandboxAnalysis.counters.processes.monitored | String | Monitored processes count. | | ANYRUN.SandboxAnalysis.counters.processes.total | String | Total processes count. | | ANYRUN.SandboxAnalysis.environments.hotfixes.title | String | Environment hotfixes title. | | ANYRUN.SandboxAnalysis.environments.software.version | String | Environment software version. | | ANYRUN.SandboxAnalysis.environments.software.title | String | Environment software title. | | ANYRUN.SandboxAnalysis.environments.internetExplorer.kbnum | String | Environment Internet Explorer KBNUM. | | ANYRUN.SandboxAnalysis.environments.internetExplorer.version | String | Environment Internet Explorer version. | | ANYRUN.SandboxAnalysis.environments.os.bitness | String | Environment OS version. | | ANYRUN.SandboxAnalysis.environments.os.softSet | String | Environment OS software set. | | ANYRUN.SandboxAnalysis.environments.os.servicePack | String | Environment OS service pack. | | ANYRUN.SandboxAnalysis.environments.os.major | String | Environment OS major version. | | ANYRUN.SandboxAnalysis.environments.os.productType | String | Environment OS product type. | | ANYRUN.SandboxAnalysis.environments.os.variant | String | Environment OS variant. | | ANYRUN.SandboxAnalysis.environments.os.product | String | Environment OS product. | | ANYRUN.SandboxAnalysis.environments.os.build | String | Environment OS build. | | ANYRUN.SandboxAnalysis.environments.os.title | String | Environment OS title. | | ANYRUN.SandboxAnalysis.analysis.content.dumps | Unknown | Content dumps. | | ANYRUN.SandboxAnalysis.analysis.content.screenshots.thumbnailUrl | String | Screenshots thumbnail url. | | ANYRUN.SandboxAnalysis.analysis.content.screenshots.permanentUrl | String | Screenshots permanent url. | | ANYRUN.SandboxAnalysis.analysis.content.screenshots.time | String | Screenshots time. | | ANYRUN.SandboxAnalysis.analysis.content.screenshots.uuid | String | Screenshots uuid. | | ANYRUN.SandboxAnalysis.analysis.content.sslkeys.present | String | SSL keys present. | | ANYRUN.SandboxAnalysis.analysis.content.pcap.permanentUrl | String | Pcap dump permanent url. | | ANYRUN.SandboxAnalysis.analysis.content.pcap.present | String | Pcap present. | | ANYRUN.SandboxAnalysis.analysis.content.video.permanentUrl | String | Video permanent url. | | ANYRUN.SandboxAnalysis.analysis.content.video.present | String | Video present. | | ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.ssdeep | String | Main object ssdeep. | | ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.sha256 | String | Main object sha256. | | ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.sha1 | String | Main object sha1. | | ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.md5 | String | Main object md5. | | ANYRUN.SandboxAnalysis.analysis.content.mainObject.url | String | Main object url. | | ANYRUN.SandboxAnalysis.analysis.content.mainObject.type | String | Main object type. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.knownThreat | String | Specs known threat. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.malwareConfig | String | Specs malware Config. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.notStarted | String | Specs not started. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.privEscalation | String | Specs priv escalation. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.torUsed | String | Specs TOR used. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.suspStruct | String | Specs susp structure. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.stealing | String | Specs stealing. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.staticDetections | String | Specs static detections. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.spam | String | Specs spam. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.serviceLauncher | String | Specs service launcher. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.rebooted | String | Specs rebooted. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.networkThreats | String | Specs network threats. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.networkLoader | String | Specs network loader. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.multiprocessing | String | Specs multiprocessing. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.memOverrun | String | Specs memory overrun. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.lowAccess | String | Specs low access. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.exploitable | String | Specs exploitable. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.executableDropped | String | Specs executable dropped. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.debugOutput | String | Specs debug output. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.crashedTask | String | Specs crashed task. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.crashedApps | String | Specs crashed apps. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.cpuOverrun | String | Specs CPU overrun. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.autoStart | String | Specs suto start. | | ANYRUN.SandboxAnalysis.analysis.scores.specs.injects | String | Specs injects. | | ANYRUN.SandboxAnalysis.analysis.scores.verdict.threatLevelText | String | Verdict threat level text. | | ANYRUN.SandboxAnalysis.analysis.scores.verdict.threatLevel | String | Verdict threat level. | | ANYRUN.SandboxAnalysis.analysis.scores.verdict.score | String | Verdict score. | | ANYRUN.SandboxAnalysis.analysis.options.automatization.uac | String | Options automatization UAC. | | ANYRUN.SandboxAnalysis.analysis.options.privateSample | String | Options private sample. | | ANYRUN.SandboxAnalysis.analysis.options.privacy | String | Options privacy. | | ANYRUN.SandboxAnalysis.analysis.options.network | String | Options network. | | ANYRUN.SandboxAnalysis.analysis.options.hideSource | String | Options hide source. | | ANYRUN.SandboxAnalysis.analysis.options.video | String | Options video. | | ANYRUN.SandboxAnalysis.analysis.options.presentation | String | Options presentation. | | ANYRUN.SandboxAnalysis.analysis.options.tor.used | String | Options tor used. | | ANYRUN.SandboxAnalysis.analysis.options.mitm | String | Options MITM proxy. | | ANYRUN.SandboxAnalysis.analysis.options.heavyEvasion | String | Options kernel heavy evasion. | | ANYRUN.SandboxAnalysis.analysis.options.fakeNet | String | Options fake network. | | ANYRUN.SandboxAnalysis.analysis.options.additionalTime | String | Options additions time. | | ANYRUN.SandboxAnalysis.analysis.options.timeout | String | Options timeout. | | ANYRUN.SandboxAnalysis.analysis.tags | Unknown | Analysis tags. | | ANYRUN.SandboxAnalysis.analysis.stopExecText | Date | Analysis stopExecText. | | ANYRUN.SandboxAnalysis.analysis.stopExec | Date | Analysis creation stopExec. | | ANYRUN.SandboxAnalysis.analysis.creationText | Date | Analysis creation creation text. | | ANYRUN.SandboxAnalysis.analysis.creation | Date | Analysis creation date. | | ANYRUN.SandboxAnalysis.analysis.duration | String | Analysis duration. | | ANYRUN.SandboxAnalysis.analysis.sandbox.plan.name | String | Analysis sandbox user plan name. | | ANYRUN.SandboxAnalysis.analysis.sandbox.name | String | Analysis sandbox name. | | ANYRUN.SandboxAnalysis.analysis.reports.graph | String | Analysis reports graph. | | ANYRUN.SandboxAnalysis.analysis.reports.STIX | String | Analysis STIX report url. | | ANYRUN.SandboxAnalysis.analysis.reports.HTML | String | Analysis HTML report url. | | ANYRUN.SandboxAnalysis.analysis.reports.MISP | String | Analysis MISP report url. | | ANYRUN.SandboxAnalysis.analysis.reports.IOC | String | Analysis IOC report url. | | ANYRUN.SandboxAnalysis.analysis.permanentUrl | String | Analysis permanent url. | | ANYRUN.SandboxAnalysis.analysis.uuid | String | Analysis uuid. | | ANYRUN.SandboxAnalysis.status | String | Analysis status. | | ANYRUN.SandboxAnalysisReportVerdict | String | The analysis verdict. | | ANYRUN_DetonateUrlAndroid.TaskID | String | Task UUID. | | ANYRUN_DetonateUrlLinux.TaskID | String | Task UUID. | | ANYRUN_DetonateUrlWindows.TaskID | String | Task UUID. | ## Playbook Image --- 