Detonate File - JoeSecurity Deprecated

id: detonatefile_-_joesecurity
version: -1
name: Detonate File - JoeSecurity
fromversion: 5.0.0
description: |-
  Deprecated. Use the joe-submit-sample command instead.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: d8a91f9c-40f6-48f2-8dd2-1c7e59b6abdb
    type: start
    task:
      id: d8a91f9c-40f6-48f2-8dd2-1c7e59b6abdb
      version: -1
      name: ""
      description: Detonates a file using JoeSecurity
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 96f24672-03e9-4b5f-8976-44cb1a1d273e
    type: regular
    task:
      id: 96f24672-03e9-4b5f-8976-44cb1a1d273e
      version: -1
      name: JoeSecurity Upload File
      description: ""
      script: Joe Security|||joe-analysis-submit-sample
      type: regular
      iscommand: true
      brand: Joe Security
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      comments:
        complex:
          root: inputs.Comments
      file_id:
        complex:
          root: inputs.File
          accessor: EntryID
      internet-access:
        complex:
          root: inputs.InternetAccess
      sample_url: {}
      should_wait: {}
      systems:
        complex:
          root: inputs.Systems
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: caf4db14-e5d0-40f1-8f17-e9c90d20fb3d
    type: playbook
    task:
      id: caf4db14-e5d0-40f1-8f17-e9c90d20fb3d
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Ids:
        complex:
          root: Joe.Analysis.ID
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: webid
      PollingCommandName:
        simple: joe-analysis-info
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: Joe.Analysis(val.Status != 'finished').ID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 5bcb48a2-b804-4fa2-8f07-4b36c8708668
    type: regular
    task:
      id: 5bcb48a2-b804-4fa2-8f07-4b36c8708668
      version: -1
      name: JoeSecurity Get Report
      description: ""
      script: Joe Security|||joe-download-report
      type: regular
      iscommand: true
      brand: Joe Security
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      type:
        complex:
          root: inputs.ReportFileType
      webid:
        complex:
          root: JoeAnalysis
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: JoeAnalysis.Status
                iscontext: true
              right:
                value:
                  simple: finished
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: ID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 93fac7de-168e-4b60-8172-1d0d8cc46702
    type: title
    task:
      id: 93fac7de-168e-4b60-8172-1d0d8cc46702
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: f40cdb2c-ed11-4489-8977-4f6a105304d4
    type: condition
    task:
      id: f40cdb2c-ed11-4489-8977-4f6a105304d4
      version: -1
      name: Is there a File to detonate?
      description: Look for files to detonate
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.File
                accessor: EntryID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: ce04663d-aaca-47c5-8c3a-392987e23dfa
    type: condition
    task:
      id: ce04663d-aaca-47c5-8c3a-392987e23dfa
      version: -1
      name: Is JoeSecurity sandbox enabled?
      description: Check if integration instance is enabled
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Joe Security
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 275,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: 4f2c07a5-cb21-4680-82d6-5cdacba2bd67
    type: regular
    task:
      id: 4f2c07a5-cb21-4680-82d6-5cdacba2bd67
      version: -1
      name: JoeSecurity Get Info
      description: '-'
      script: Joe Security|||joe-analysis-info
      type: regular
      iscommand: true
      brand: Joe Security
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      webid:
        complex:
          root: Joe
          accessor: Analysis.ID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 7c9693b1-3b80-4e1e-842e-a9f0bd5f48c3
    type: regular
    task:
      id: 7c9693b1-3b80-4e1e-842e-a9f0bd5f48c3
      version: -1
      name: Set Context
      description: '-'
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      append: {}
      key:
        simple: JoeAnalysis
      value:
        complex:
          root: Joe
          accessor: Analysis
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1435,
        "width": 605,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: File object of the file to detonate. The File is taken from the context.
- key: Interval
  value:
    simple: "1"
  required: false
  description: Duration for executing the pooling (in minutes)
- key: Timeout
  value:
    simple: "15"
  required: false
  description: The duration after which to stop pooling and to resume the playbook (in minutes)
- key: Systems
  value: {}
  required: false
  description: 'Operating system to run the analysis on (comma-separated). Supported values are: w7, w7x64, w7_1, w7_2, w7native, android2, android3, mac1, w7l, w7x64l, w10, android4, w7x64native, w7_3, w10native, android5native_1, w7_4, w7_5, w10x64, w7x64_hvm, android6, iphone1, w7_sec, macvm, w7_lang_packs, w7x64native_hvm, lnxubuntu1, lnxcentos1, android7_nougat'
- key: Comments
  value: {}
  required: false
  description: Comments for the analysis.
- key: InternetAccess
  value:
    simple: "True"
  required: false
  description: Enable internet access (boolean). True= internet access (default), False= no internet access.
- key: ReportFileType
  value: {}
  required: false
  description: 'The resource type to download. Default is html. Supported values are: html, lighthtml, executive, pdf, classhtml, xml, lightxml, classxml, clusterxml, irxml, json, jsonfixed, lightjson, lightjsonfixed, irjson, irjsonfixed, shoots (screenshots), openioc, maec, misp, graphreports, memstrings, binstrings, sample, cookbook, bins (dropped files), unpackpe (unpacked PE files), unpack, ida, pcap, pcapslim, memdumps, yara'
outputs:
- contextPath: DBotScore.Vendor
  description: The vendor used to calculate the score.
  type: string
- contextPath: Joe.Analysis.ID
  description: Web ID
  type: string
- contextPath: Joe.Analysis.Status
  description: Analysis Status
  type: string
- contextPath: Joe.Analysis.Comments
  description: Analysis Comments
  type: string
- contextPath: Joe.Analysis.Time
  description: Submitted Time
  type: date
- contextPath: Joe.Analysis.Runs
  description: Sub-Analysis Information
- contextPath: Joe.Analysis.Result
  description: Analysis Results
  type: string
- contextPath: Joe.Analysis.Errors
  description: Raised errors during sampling
- contextPath: Joe.Analysis.Systems
  description: Analysis OS
- contextPath: Joe.Analysis.MD5
  description: MD5 of analysis sample
  type: string
- contextPath: Joe.Analysis.SHA1
  description: SHA1 of analysis sample
  type: string
- contextPath: Joe.Analysis.SHA256
  description: SHA256 of analysis sample
  type: string
- contextPath: Joe.Analysis.SampleName
  description: Sample Data, could be a file name or URL
  type: string
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
  type: string
- contextPath: DBotScore.Type
  description: The indicator type.
  type: string
- contextPath: DBotScore.Score
  description: The actual score.
  type: number
- contextPath: DBotScore.Malicious.Vendor
  description: The vendor used to calculate the score.
  type: string
- contextPath: DBotScore.Malicious.Detections
  description: The sub analysis detection statuses
  type: string
- contextPath: DBotScore.Malicious.SHA1
  description: The SHA1 of the file
  type: string
- contextPath: InfoFile.Name
  description: FileName
  type: string
- contextPath: InfoFile.EntryID
  description: The EntryID of the sample
  type: string
- contextPath: InfoFile.Size
  description: File Size
  type: number
- contextPath: InfoFile.Type
  description: File type e.g. "PE"
  type: string
- contextPath: InfoFile.Info
  description: Basic information of the file
  type: string
- contextPath: File.Extension
  description: File Extension
  type: string
- contextPath: InfoFile
  description: Report file object
  type: unknown
- contextPath: File
  description: File object
  type: unknown
- contextPath: Joe.Analysis
  description: Joe Analysis object
  type: unknown
- contextPath: DBotScore
  description: DBotScore object
  type: unknown
- contextPath: DBotScore.Malicious
  description: DBotScore Malicious object
  type: unknown
tests:
- No test
deprecated: true