Detonate URL - ThreatGrid Deprecated

Deprecated. Use Detonate URL - ThreatGrid v2 instead.

Cisco Secure Malware Analytics · 7 tasks · 9 inputs · 16 outputs

Details

IDdetonate_url_-_threatgrid
From Version5.0.0
Tasks7

README

Detonates one or more URLs using the ThreatGrid integration. This playbook returns relevant reports to the War Room and URL reputations to the context data.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

  • Threat Grid

Scripts

This playbook does not use any scripts.

Commands

  • threat-grid-url-to-file
  • threat-grid-get-samples-state
  • threat-grid-upload-sample

Playbook Inputs

Name Description Default Value Source Required
URL The URL of the sites to detonate. Data URL Optional
FileName The name of the file to detonate. file-detonated-via-demisto - Optional
VM The VM to use (string). - - Optional
Playbook The name of the Threat Grid playbook to apply to this sample run. default - Optional
Private The sample is marked private if this is present. If it is set to any other value then it will not be private. - - Optional
Source The string used for identifying the source of the detonation (user defined). - - Optional
Tags A comma-separated list of tags applied to the sample. - - Optional
Interval The polling frequency. How often the polling command should run (in minutes). 1 - Optional
Timeout How much time to wait before a timeout occurs (in minutes). 15 - Optional

Playbook Outputs

Path Description Type
File.SHA256 The SHA256 hash of the file. string
File.Malicious The File malicious description unknown
File.Type The file type. For example, “PE”. string
File.Size THe file size. number
File.MD5 The MD5 hash of the file. string
File.Name The filename. string
File.SHA1 The SHA1 hash of the file. string
File The file object. unknown
File.Malicious.Vendor The vendor that made the decision that the file is malicious. string
DBotScore The DBotScore object. unknown
DBotScore.Indicator The indicator that was tested. string
DBotScore.Type The type of the indicator. string
DBotScore.Vendor The vendor used to calculate the score. string
DBotScore.Score The actual score. number
Sample.State The sample state. unknown
Sample.ID The sample ID. unknown

Playbook Image

Detonate_URL_ThreatGrid

Inputs

  • URL — URL of the sites to detonate.
  • FileName — Name of the file to detonate.
  • VM — The VM to use (string)
  • Playbook — Name of the Threat Grid playbook to apply to this sample run
  • Private — The sample is marked private if this is present, and set to any value other than false. private
  • Source — a string used for identifying the source of the detonation (user defined)
  • Tags — A comma-separated list of tags applied to the sample.
  • Interval — Polling frequency - how often the polling command should run (minutes)
  • Timeout — How much time to wait before a timeout occurs (minutes)

Outputs

  • File.SHA256 — SHA256 hash of the file
  • File.Malicious — The File malicious description
  • File.Type — File type e.g. "PE"
  • File.Size — File size
  • File.MD5 — MD5 hash of the file
  • File.Name — Filename
  • File.SHA1 — SHA1 hash of the file
  • File — The File object
  • File.Malicious.Vendor — For malicious files, the vendor that made the decision
  • DBotScore — The DBotScore object
  • DBotScore.Indicator — The indicator we tested
  • DBotScore.Type — The type of the indicator
  • DBotScore.Vendor — Vendor used to calculate the score
  • DBotScore.Score — The actual score
  • ThreatGrid.Sample.State — The sample state
  • ThreatGrid.Sample.ID — The sample ID

Commands used

threat-grid-get-samples-state threat-grid-upload-sample threat-grid-url-to-file

Flowchart

yes Start Start Is ThreatGrid enabled? Is ThreatGrid enabled? Done Done ThreatGrid Get Samples State - threat-grid-get-samples-state ThreatGrid Get Samples State threat-grid-get-samples-state GenericPolling - GenericPolling GenericPolling GenericPolling ThreatGrid Upload File - threat-grid-upload-sample ThreatGrid Upload File threat-grid-upload-sample URL to File - threat-grid-url-to-file URL to File threat-grid-url-to-file

Source

playbook-Detonate_URL_-_ThreatGrid.yml playbook-Detonate_URL_-_ThreatGrid_v2.yml playbook-Detonate_URL_-_ThreatGrid_v2_README.md
Download History Raw 
Detonate one or more URLs using the ThreatGrid integration.

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

This playbook does not use any sub-playbooks.

### Integrations

* ThreatGridv2

### Scripts

This playbook does not use any scripts.

### Commands

* threat-grid-sample-upload

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| URL | URL of the sites to detonate. | URL.Data | Optional |
| timeout | Indicates the time in seconds until the polling sequence times out. Default is 60. | 60 | Optional |
| interval | Indicates the time in seconds to wait between command execution when 'polling' argument is true. Minimum value is 10 seconds. Default is 10. | 10 | Optional |

## Playbook Outputs

---

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| ThreatGrid.Sample.id | The sample id | string |
| ThreatGrid.Sample.filename | The sample filename | string |
| ThreatGrid.Sample.state | The state of the sample, one of a stable set of strings "wait, prep, run, proc, succ, fail" | string |
| ThreatGrid.Sample.status | The sample status | string |
| ThreatGrid.Sample.md5 | The sample md5 | string |
| ThreatGrid.Sample.sha1 | The sample sha1 | string |
| ThreatGrid.Sample.sha256 | The sample sha256 | string |
| ThreatGrid.Sample.os | The sample os | string |
| ThreatGrid.Sample.submitted_at | The sample submission time | string |

## Playbook Image

---

![Detonate URL - ThreatGrid v2](../doc_files/Detonate_URL_-_ThreatGrid_v2.png)