Detonate URL - ThreatGrid

Details

ID	`detonate_url_-_threatgrid`
From Version	5.0.0
Tasks	7

README

Detonates one or more URLs using the ThreatGrid integration. This playbook returns relevant reports to the War Room and URL reputations to the context data.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

Threat Grid

Scripts

This playbook does not use any scripts.

Commands

threat-grid-url-to-file
threat-grid-get-samples-state
threat-grid-upload-sample

Playbook Inputs

Name	Description	Default Value	Source	Required
URL	The URL of the sites to detonate.	Data	URL	Optional
FileName	The name of the file to detonate.	file-detonated-via-demisto	-	Optional
VM	The VM to use (string).	-	-	Optional
Playbook	The name of the Threat Grid playbook to apply to this sample run.	default	-	Optional
Private	The sample is marked private if this is present. If it is set to any other value then it will not be private.	-	-	Optional
Source	The string used for identifying the source of the detonation (user defined).	-	-	Optional
Tags	A comma-separated list of tags applied to the sample.	-	-	Optional
Interval	The polling frequency. How often the polling command should run (in minutes).	1	-	Optional
Timeout	How much time to wait before a timeout occurs (in minutes).	15	-	Optional

Playbook Outputs

Path	Description	Type
File.SHA256	The SHA256 hash of the file.	string
File.Malicious	The File malicious description	unknown
File.Type	The file type. For example, “PE”.	string
File.Size	THe file size.	number
File.MD5	The MD5 hash of the file.	string
File.Name	The filename.	string
File.SHA1	The SHA1 hash of the file.	string
File	The file object.	unknown
File.Malicious.Vendor	The vendor that made the decision that the file is malicious.	string
DBotScore	The DBotScore object.	unknown
DBotScore.Indicator	The indicator that was tested.	string
DBotScore.Type	The type of the indicator.	string
DBotScore.Vendor	The vendor used to calculate the score.	string
DBotScore.Score	The actual score.	number
Sample.State	The sample state.	unknown
Sample.ID	The sample ID.	unknown

Playbook Image

Detonate_URL_ThreatGrid

Inputs

URL — URL of the sites to detonate.
FileName — Name of the file to detonate.
VM — The VM to use (string)
Playbook — Name of the Threat Grid playbook to apply to this sample run
Private — The sample is marked private if this is present, and set to any value other than false. private
Source — a string used for identifying the source of the detonation (user defined)
Tags — A comma-separated list of tags applied to the sample.
Interval — Polling frequency - how often the polling command should run (minutes)
Timeout — How much time to wait before a timeout occurs (minutes)

Outputs

File.SHA256 — SHA256 hash of the file
File.Malicious — The File malicious description
File.Type — File type e.g. "PE"
File.Size — File size
File.MD5 — MD5 hash of the file
File.Name — Filename
File.SHA1 — SHA1 hash of the file
File — The File object
File.Malicious.Vendor — For malicious files, the vendor that made the decision
DBotScore — The DBotScore object
DBotScore.Indicator — The indicator we tested
DBotScore.Type — The type of the indicator
DBotScore.Vendor — Vendor used to calculate the score
DBotScore.Score — The actual score
ThreatGrid.Sample.State — The sample state
ThreatGrid.Sample.ID — The sample ID

Commands used

threat-grid-get-samples-state threat-grid-upload-sample threat-grid-url-to-file

Flowchart

Source

playbook-Detonate_URL_-_ThreatGrid.yml playbook-Detonate_URL_-_ThreatGrid_v2.yml playbook-Detonate_URL_-_ThreatGrid_v2_README.md

Download History Raw

id: Detonate URL - ThreatGrid v2
version: -1
name: Detonate URL - ThreatGrid v2
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a40217c5-eb07-4e3b-885d-36424a2c5a85
    type: start
    task:
      id: a40217c5-eb07-4e3b-885d-36424a2c5a85
      description: start
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 180c1045-80de-4ba7-8b95-a6f038647bc0
    type: regular
    task:
      id: 180c1045-80de-4ba7-8b95-a6f038647bc0
      version: -1
      name: ThreatGrid Upload URL
      description: Submits a sample to threat grid for analysis. URL or file, not both.
      script: '|||threat-grid-sample-upload'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      interval_in_seconds:
        complex:
          root: inputs.interval
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.interval
                iscontext: true
      timeout_in_seconds:
        complex:
          root: inputs.timeout
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.timeout
                iscontext: true
      url:
        complex:
          root: inputs.URL
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 280,
          "y": 550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 1e5d0366-d6ce-4020-8870-277914fc2ca3
    type: condition
    task:
      id: 1e5d0366-d6ce-4020-8870-277914fc2ca3
      description: Verify that there is a valid ThreatGrid instance enabled.
      version: -1
      name: Is ThreatGrid enabled?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: ThreatGridv2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
          right:
            value: {}
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 805f6930-a82e-438d-88ef-c30ae9d8f3c8
    type: title
    task:
      id: 805f6930-a82e-438d-88ef-c30ae9d8f3c8
      description: title
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 67c20c58-de92-41a6-8418-8eac9bb52eb4
    type: condition
    task:
      id: 67c20c58-de92-41a6-8418-8eac9bb52eb4
      description: Verify that there is a URL to detonate.
      version: -1
      name: Is there a URL to detonate?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "4_3_#default#": 0.61
    },
    "paper": {
      "dimensions": {
        "height": 735,
        "width": 610,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: false
  description: URL of the sites to detonate.
  playbookInputQuery:
- key: timeout
  value:
    simple: "60"
  required: false
  description: Indicates the time in seconds until the polling sequence times out. Default is 60.
  playbookInputQuery:
- key: interval
  value:
    simple: "10"
  required: false
  description: Indicates the time in seconds to wait between command execution when 'polling' argument is true. Minimum value is 10 seconds. Default is 10.
  playbookInputQuery:
outputs:
- contextPath: ThreatGrid.Sample.id
  description: The sample id
  type: string
- contextPath: ThreatGrid.Sample.filename
  description: The sample filename
  type: string
- contextPath: ThreatGrid.Sample.state
  description: The state of the sample, one of a stable set of strings "wait, prep, run, proc, succ, fail"
  type: string
- contextPath: ThreatGrid.Sample.status
  description: The sample status
  type: string
- contextPath: ThreatGrid.Sample.md5
  description: The sample md5
  type: string
- contextPath: ThreatGrid.Sample.sha1
  description: The sample sha1
  type: string
- contextPath: ThreatGrid.Sample.sha256
  description: The sample sha256
  type: string
- contextPath: ThreatGrid.Sample.os
  description: The sample os
  type: string
- contextPath: ThreatGrid.Sample.submitted_at
  description: The sample submission time
  type: string
fromversion: 5.0.0
description: Detonate one or more URLs using the ThreatGrid integration.
tests:
- Detonate URL - Generic Test
contentitemexportablefields:
  contentitemfields:
    propagationLabels:
    - all

Detonate URL - ThreatGrid Deprecated