Detonate URL - McAfee ATD

id: detonate_url_-_mcafee_atd
version: -1
name: Detonate URL - McAfee ATD
fromversion: 5.0.0
description: Detonates a URL using the McAfee Advanced Threat Defense sandbox integration.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: d2f4d7dc-4562-4517-8d63-3539676ca81d
    type: start
    task:
      id: d2f4d7dc-4562-4517-8d63-3539676ca81d
      version: -1
      name: ""
      description: start
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 1ffe1273-53cc-4196-85ee-aeb00cdc3683
    type: regular
    task:
      id: 1ffe1273-53cc-4196-85ee-aeb00cdc3683
      version: -1
      name: McAfee ATD Upload URL
      description: Uploads the submission to McAfee ATD.
      script: '|||atd-file-upload'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      analyzeAgain: {}
      dstIp: {}
      entryID: {}
      fileName: {}
      filePriorityQ: {}
      messageId: {}
      skipTaskId: {}
      srcIp: {}
      submitType:
        simple: "1"
      url:
        complex:
          root: inputs.URL
      vmProfileList: {}
      xMode: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: d774d782-52bb-4667-8842-9401535bdf2f
    type: playbook
    task:
      id: d774d782-52bb-4667-8842-9401535bdf2f
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      Ids:
        complex:
          root: ATD
          filters:
          - - operator: isNotEqualNumber
              left:
                value:
                  simple: ATD.Task.taskId
                iscontext: true
              right:
                value:
                  simple: "-1"
          accessor: Task
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: taskId
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: taskId
      PollingCommandName:
        simple: atd-check-status
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: ATD.Task(val.status != 'Completed').taskId
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 139bb8bd-8c59-483e-8632-aa1031236b24
    type: regular
    task:
      id: 139bb8bd-8c59-483e-8632-aa1031236b24
      version: -1
      name: McAfee ATD Get Report
      description: Retrieve the reports from McAfee ATD.
      script: '|||atd-get-report'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      jobId: {}
      taskId:
        complex:
          root: ATDTask
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: ATDTask.status
                iscontext: true
              right:
                value:
                  simple: Completed
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: taskId
      threshold: {}
      type:
        simple: pdf
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 7aef66ab-1f28-4a35-89d8-173760f509c5
    type: condition
    task:
      id: 7aef66ab-1f28-4a35-89d8-173760f509c5
      version: -1
      name: Is there a URL to detonate?
      description: Checks that there is a URL in the playbook’s input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: 586f9a47-8d2a-4ff5-8ad5-788ddc8310ed
    type: title
    task:
      id: 586f9a47-8d2a-4ff5-8ad5-788ddc8310ed
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: bd6b3429-b5e0-4bf5-8aa7-5b6305b016dc
    type: condition
    task:
      id: bd6b3429-b5e0-4bf5-8aa7-5b6305b016dc
      version: -1
      name: Filter taskId
      description: Checks that valid URLs only have been sent to detonation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: ATD
                filters:
                - - operator: isNotEqualNumber
                    left:
                      value:
                        simple: ATD.Task.taskId
                      iscontext: true
                    right:
                      value:
                        simple: "-1"
                accessor: Task
                transformers:
                - operator: getField
                  args:
                    field:
                      value:
                        simple: taskId
            iscontext: true
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 35d8af19-10dd-43fa-855d-1a99e08bbf12
    type: condition
    task:
      id: 35d8af19-10dd-43fa-855d-1a99e08bbf12
      version: -1
      name: Is McAfee ATD sandbox enabled?
      description: |
        Verify that there is a valid instance of McAfee ATD enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: McAfee Advanced Threat Defense
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: d9cb6357-65d3-489e-829a-32db7a9e54f1
    type: regular
    task:
      id: d9cb6357-65d3-489e-829a-32db7a9e54f1
      version: -1
      name: atd-check-status
      description: Updates the status of the tasks in the context.
      script: '|||atd-check-status'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      jobId: {}
      taskId:
        complex:
          root: ATD
          filters:
          - - operator: isNotEqualNumber
              left:
                value:
                  simple: ATD.Task.taskId
                iscontext: true
              right:
                value:
                  simple: "-1"
          accessor: Task.taskId
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: e67fe4e6-2060-46ff-8f61-c87a4b88cf93
    type: regular
    task:
      id: e67fe4e6-2060-46ff-8f61-c87a4b88cf93
      version: -1
      name: Set Context
      description: '-'
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      append: {}
      key:
        simple: ATDTask
      value:
        complex:
          root: ATD
          filters:
          - - operator: isNotEqualNumber
              left:
                value:
                  simple: ATD.Task.taskId
                iscontext: true
              right:
                value:
                  simple: "-1"
          accessor: Task
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "8_2_yes": 0.57
    },
    "paper": {
      "dimensions": {
        "height": 1610,
        "width": 605,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: false
  description: URL to detonate.
- key: Interval
  value:
    simple: "1"
  required: false
  description: Polling frequency - how often the polling command should run (minutes)
- key: Timeout
  value:
    simple: "15"
  required: false
  description: How much time to wait before a timeout occurs (minutes)
outputs:
- contextPath: ATD.Task.taskId
  description: The task ID of the sample uploaded
  type: string
- contextPath: ATD.Task.jobId
  description: The job ID of the sample uploaded
  type: string
- contextPath: ATD.Task.messageId
  description: The message Id relevant to the sample uploaded
  type: string
- contextPath: ATD.Task.url
  description: The URL detonated
  type: string
- contextPath: ATD.Task.srcIp
  description: Source IPv4 address
  type: string
- contextPath: ATD.Task.destIp
  description: Destination IPv4 address
  type: string
- contextPath: ATD.Task.MD5
  description: MD5 of the sample uploaded
  type: string
- contextPath: ATD.Task.SHA1
  description: SHA1 of the sample uploaded
  type: string
- contextPath: ATD.Task.SHA256
  description: SHA256 of the sample uploaded
  type: string
- contextPath: File.Name
  description: Filename (only in case of report type=json)
  type: string
- contextPath: File.Type
  description: File type e.g. "PE" (only in case of report type=json)
  type: string
- contextPath: File.MD5
  description: MD5 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.SHA256
  description: SHA256 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.EntryID
  description: The Entry ID of the sample
  type: string
- contextPath: DBotScore.Indicator
  description: The indicator we tested (only in case of report type=json)
  type: string
- contextPath: DBotScore.Type
  description: The type of the indicator (only in case of report type=json)
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score (only in case of report type=json)
  type: string
- contextPath: DBotScore.Score
  description: The actual score (only in case of report type=json)
  type: number
- contextPath: IP.Address
  description: IP's relevant to the sample
  type: string
- contextPath: InfoFile.EntryID
  description: The EntryID of the report file
  type: string
- contextPath: InfoFile.Extension
  description: The extension of the report file
  type: string
- contextPath: InfoFile.Name
  description: The name of the report file
  type: string
- contextPath: InfoFile.Info
  description: The info of the report file
  type: string
- contextPath: InfoFile.Size
  description: The size of the report file
  type: number
- contextPath: InfoFile.Type
  description: The type of the report file
  type: string
- contextPath: File
  description: File object
  type: unknown
- contextPath: File.Malicious
  description: File Malicious object
  type: unknown
- contextPath: DBotScore
  description: DBotScore object
  type: unknown
- contextPath: InfoFile
  description: Report file object
  type: unknown
- contextPath: URL.Malicious
  description: URL Malicious object
  type: unknown
tests:
- Test Playbook McAfee ATD
- Detonate URL - Generic Test