Detonate File - JoeSecurity Deprecated

Deprecated. Use the joe-submit-sample command instead.

Joe Security · 9 tasks · 7 inputs · 30 outputs

Details

ID	`detonatefile_-_joesecurity`
From Version	5.0.0
Tasks	9

README

Detonates one or more files using the Joe Security - Joe Sandbox integration.
Returns relevant reports to the War Room and file reputations to the context data.
All file types are supported.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

Joe Security

Scripts

Commands

joe-analysis-info
joe-download-report
joe-analysis-submit-sample

Playbook Inputs

Name	Description	Default Value	Source	Required
File	The file object of the file to detonate. The file is taken from the context.	None	File	Optional
Interval	The duration for executing the pooling (in minutes).	1	-	Optional
Timeout	The duration after which to stop pooling and to resume the playbook (in minutes).	15	-	Optional
Systems	The operating system to run the analysis on (comma-separated). Supported values are: w7, w7x64, w7_1, w7_2, w7native, android2, android3, mac1, w7l, w7x64l, w10, android4, w7x64native, w7_3, w10native, android5native_1, w7_4, w7_5, w10x64, w7x64_hvm, android6, iphone1, w7_sec, macvm, w7_lang_packs, w7x64native_hvm, lnxubuntu1, lnxcentos1, android7_nougat.	-	-	Optional
Comments	The comments for the analysis.	-	-	Optional
InternetAccess	Whether to enable internet access (boolean). The default is “True”. “True” means there is internet access. “False” means there is no internet access.	True	-	Optional
ReportFileType	The resource type to download. The default is “HTML”. The supported values are: html, lighthtml, executive, pdf, classhtml, xml, lightxml, classxml, clusterxml, irxml, json, jsonfixed, lightjson, lightjsonfixed, irjson, irjsonfixed, shoots (screenshots), openioc, maec, misp, graphreports, memstrings, binstrings, sample, cookbook, bins (dropped files), unpackpe (unpacked PE files), unpack, ida, pcap, pcapslim, memdumps, yara.	-	-	Optional

Playbook Outputs

Path	Description	Type
DBotScore.Vendor	The vendor used to calculate the score.	string
Joe.Analysis.ID	The web ID.	string
Joe.Analysis.Status	The analysis status.	string
Joe.Analysis.Comments	The analysis comments.	string
Joe.Analysis.Time	The submitted time.	date
Joe.Analysis.Runs	The sub-analysis information.	unknown
Joe.Analysis.Result	The analysis results.	string
Joe.Analysis.Errors	The raised errors during sampling.	unknown
Joe.Analysis.Systems	The analysis OS.	unknown
Joe.Analysis.MD5	The MD5 hash of analysis sample.	string
Joe.Analysis.SHA1	The SHA1 hash of analysis sample.	string
Joe.Analysis.SHA256	The SHA256 hash of analysis sample.	string
Joe.Analysis.SampleName	The sample data. Can be, “file name” or “URL”.	string
DBotScore.Indicator	The indicator that was tested.	string
DBotScore.Type	The indicator type.	string
DBotScore.Score	The actual score.	number
DBotScore.Malicious.Vendor	The vendor used to calculate the score.	string
DBotScore.Malicious.Detections	The sub-analysis detection statuses.	string
DBotScore.Malicious.SHA1	The SHA1 hash of the file.	string
InfoFile.Name	The filename.	string
InfoFile.EntryID	The EntryID of the sample.	string
InfoFile.Size	The file size.	number
InfoFile.Type	The file type. For example, “PE”.	string
InfoFile.Info	The basic information of the file.	string
File.Extension	The file extension.	string
InfoFile	The report file object.	unknown
File	The file object.	unknown
Joe.Analysis	The Joe analysis object.	unknown
DBotScore	The DBotScore object.	unknown
DBotScore.Malicious	The DBotScore malicious object.	unknown

Playbook Image

Detonate_File_JoeSecurity

Inputs

File — File object of the file to detonate. The File is taken from the context.
Interval — Duration for executing the pooling (in minutes)
Timeout — The duration after which to stop pooling and to resume the playbook (in minutes)
Systems — Operating system to run the analysis on (comma-separated). Supported values are: w7, w7x64, w7_1, w7_2, w7native, android2, android3, mac1, w7l, w7x64l, w10, android4, w7x64native, w7_3, w10native, android5native_1, w7_4, w7_5, w10x64, w7x64_hvm, android6, iphone1, w7_sec, macvm, w7_lang_packs, w7x64native_hvm, lnxubuntu1, lnxcentos1, android7_nougat
Comments — Comments for the analysis.
InternetAccess — Enable internet access (boolean). True= internet access (default), False= no internet access.
ReportFileType — The resource type to download. Default is html. Supported values are: html, lighthtml, executive, pdf, classhtml, xml, lightxml, classxml, clusterxml, irxml, json, jsonfixed, lightjson, lightjsonfixed, irjson, irjsonfixed, shoots (screenshots), openioc, maec, misp, graphreports, memstrings, binstrings, sample, cookbook, bins (dropped files), unpackpe (unpacked PE files), unpack, ida, pcap, pcapslim, memdumps, yara

Outputs

DBotScore.Vendor — The vendor used to calculate the score.
Joe.Analysis.ID — Web ID
Joe.Analysis.Status — Analysis Status
Joe.Analysis.Comments — Analysis Comments
Joe.Analysis.Time — Submitted Time
Joe.Analysis.Runs — Sub-Analysis Information
Joe.Analysis.Result — Analysis Results
Joe.Analysis.Errors — Raised errors during sampling
Joe.Analysis.Systems — Analysis OS
Joe.Analysis.MD5 — MD5 of analysis sample
Joe.Analysis.SHA1 — SHA1 of analysis sample
Joe.Analysis.SHA256 — SHA256 of analysis sample
Joe.Analysis.SampleName — Sample Data, could be a file name or URL
DBotScore.Indicator — The indicator that was tested.
DBotScore.Type — The indicator type.
DBotScore.Score — The actual score.
DBotScore.Malicious.Vendor — The vendor used to calculate the score.
DBotScore.Malicious.Detections — The sub analysis detection statuses
DBotScore.Malicious.SHA1 — The SHA1 of the file
InfoFile.Name — FileName
InfoFile.EntryID — The EntryID of the sample
InfoFile.Size — File Size
InfoFile.Type — File type e.g. "PE"
InfoFile.Info — Basic information of the file
File.Extension — File Extension
InfoFile — Report file object
File — File object
Joe.Analysis — Joe Analysis object
DBotScore — DBotScore object
DBotScore.Malicious — DBotScore Malicious object

Commands used

joe-analysis-info joe-analysis-submit-sample joe-download-report

Flowchart

Source

playbook-Detonate_File_-_JoeSecurity.yml playbook-Detonate_File_-_JoeSecurity_V2.yml playbook-Detonate_File_-_JoeSecurity_V2_README.md

Download History Raw

id: Detonate File - JoeSecurity V2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Detonate File - JoeSecurity V2
description: The Detonate File using Joe Sandbox Process is designed to streamline and enhance the security assessment of files. This automated system accepts a user-submitted file, sends it for in-depth analysis using Joe Sandbox technology, and returns comprehensive results as attachments to the user. The process is designed to be swift, efficient, and secure, providing users with valuable insights into potential threats and vulnerabilities within their files.
tags:
- Malware
- Sandbox
- Joe Security
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 2a7c3ace-493a-4ad6-8b77-82fb6386532a
    type: start
    task:
      id: 2a7c3ace-493a-4ad6-8b77-82fb6386532a
      version: -1
      name: ""
      description: Detonates a file using JoeSecurity
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 67a2b195-eff4-4586-8b58-19df81b12b6b
    type: regular
    task:
      id: 67a2b195-eff4-4586-8b58-19df81b12b6b
      version: -1
      name: JoeSecurity Upload File
      description: Submit a sample for sandbox analysis.
      script: JoeSecurityV2|||joe-submit-sample
      type: regular
      iscommand: true
      brand: JoeSecurityV2
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      comments:
        complex:
          root: inputs.Comments
      entry_id:
        complex:
          root: inputs.File
          accessor: EntryID
      systems:
        complex:
          root: inputs.Systems
      timeout:
        complex:
          root: inputs.Timeout
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: a8c79a81-6e1b-49a4-83cf-8f2011d07267
    type: regular
    task:
      id: a8c79a81-6e1b-49a4-83cf-8f2011d07267
      version: -1
      name: JoeSecurity Get Report
      description: Download a resource belonging to a report. This can be the full report, dropped binaries, etc. See the integration README for the full list of supported report types.
      script: JoeSecurityV2|||joe-download-report
      type: regular
      iscommand: true
      brand: JoeSecurityV2
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      type:
        complex:
          root: inputs.ReportFileType
      webid:
        complex:
          root: JoeAnalysis
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: JoeAnalysis.status
                iscontext: true
              right:
                value:
                  simple: finished
              ignorecase: true
          accessor: webid
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: d718ec42-1f24-4d49-872b-0c5863ac20b0
    type: title
    task:
      id: d718ec42-1f24-4d49-872b-0c5863ac20b0
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 019840a3-d2dd-4df7-87b2-36e86a1b361a
    type: condition
    task:
      id: 019840a3-d2dd-4df7-87b2-36e86a1b361a
      version: -1
      name: Is there a File to detonate?
      description: Look for files to detonate
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.File
                accessor: EntryID
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 510,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 77b76fb8-4a98-4ce5-82ba-4d4a7815ecb6
    type: condition
    task:
      id: 77b76fb8-4a98-4ce5-82ba-4d4a7815ecb6
      version: -1
      name: Is JoeSecurity sandbox enabled?
      description: Check if integration instance is enabled
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: JoeSecurityV2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 50a9fe6b-499a-42ba-83d4-a3fb20770666
    type: regular
    task:
      id: 50a9fe6b-499a-42ba-83d4-a3fb20770666
      version: -1
      name: JoeSecurity Get Info
      description: Get information about an analysis.
      script: JoeSecurityV2|||joe-analysis-info
      type: regular
      iscommand: true
      brand: JoeSecurityV2
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      webid:
        complex:
          root: Joe.Analysis
          accessor: webid
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 875
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 483b9786-6057-48a7-85c0-4c6cf9240984
    type: regular
    task:
      id: 483b9786-6057-48a7-85c0-4c6cf9240984
      version: -1
      name: Set Context
      description: '-'
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: JoeAnalysis
      value:
        complex:
          root: Joe
          accessor: Analysis
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: ad0b0e84-9dc2-4d90-8200-938bdca36a7f
    type: condition
    task:
      id: ad0b0e84-9dc2-4d90-8200-938bdca36a7f
      version: -1
      name: Is the file type supported?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: match
          left:
            value:
              simple: inputs.File.Type
            iscontext: true
          right:
            value:
              simple: .*(?:EXE|DLL|PIF|CMD|BAT|COM|SCR|CPL|PDF|DOCX|DOC|DOCM|XLSX|XLS|XLSM|XLSB|PPT|PPX|PPTM|HWP|JTD|RFT|XPI|CRX|EML|MSG|CHM|JS|JSE|VBS|VBE|LNK|JAR|PS1|ZIP|7Z|RAR|ZLIB|ASPX|APS|PNG|JPEG|GIF|HTML|HTM|XHTML|SHTML|WORD)\b
          ignorecase: true
        - operator: match
          left:
            value:
              simple: inputs.File.Extension
            iscontext: true
          right:
            value:
              simple: .*(?:EXE|DLL|PIF|CMD|BAT|COM|SCR|CPL|PDF|DOCX|DOC|DOCM|XLSX|XLS|XLSM|XLSB|PPT|PPX|PPTM|HWP|JTD|RFT|XPI|CRX|EML|MSG|CHM|JS|JSE|VBS|VBE|LNK|JAR|PS1|ZIP|7Z|RAR|ZLIB|ASPX|APS|PNG|JPEG|GIF|HTML|HTM|XHTML|SHTML)\b
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 710,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "10_5_#default#": 0.41,
      "6_5_#default#": 0.23,
      "7_5_#default#": 0.24
    },
    "paper": {
      "dimensions": {
        "height": 1375,
        "width": 1005,
        "x": 275,
        "y": 60
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: File object of the file to detonate. The File is taken from the context.
  playbookInputQuery:
- key: Timeout
  value:
    simple: "900"
  required: false
  description: The default duration after which to stop polling and to resume the playbook (in seconds).
  playbookInputQuery:
- key: Systems
  value: {}
  required: false
  description: 'Operating system to run the analysis on (comma-separated). Supported values are: w7, w7x64, w7_1, w7_2, w7native, android2, android3, mac1, w7l, w7x64l, w10, android4, w7x64native, w7_3, w10native, android5native_1, w7_4, w7_5, w10x64, w7x64_hvm, android6, iphone1, w7_sec, macvm, w7_lang_packs, w7x64native_hvm, lnxubuntu1, lnxcentos1, android7_nougat (if no input is provided, the default is w10x64_office)'
  playbookInputQuery:
- key: Comments
  value: {}
  required: false
  description: Comments for the analysis.
  playbookInputQuery:
- key: ReportFileType
  value: {}
  required: false
  description: 'The resource type to download. Default is html. Supported values are: html, lighthtml, executive, pdf, classhtml, xml, lightxml, classxml, clusterxml, irxml, json, jsonfixed, lightjson, lightjsonfixed, irjson, irjsonfixed, shoots (screenshots), openioc, maec, misp, graphreports, memstrings, binstrings, sample, cookbook, bins (dropped files), unpackpe (unpacked PE files), unpack, ida, pcap, pcapslim, memdumps, yara'
  playbookInputQuery:
outputs:
- contextPath: DBotScore.Vendor
  description: The vendor used to calculate the score.
  type: string
- contextPath: Joe.Analysis.ID
  description: Web ID.
  type: string
- contextPath: Joe.Analysis.Status
  description: Analysis Status.
  type: string
- contextPath: Joe.Analysis.Comments
  description: Analysis Comments.
  type: string
- contextPath: Joe.Analysis.Time
  description: Submitted Time.
  type: date
- contextPath: Joe.Analysis.Runs
  description: Sub-Analysis Information.
- contextPath: Joe.Analysis.Result
  description: Analysis Results.
  type: string
- contextPath: Joe.Analysis.Errors
  description: Raised errors during sampling.
- contextPath: Joe.Analysis.Systems
  description: Analysis OS.
- contextPath: Joe.Analysis.MD5
  description: MD5 of analysis sample.
  type: string
- contextPath: Joe.Analysis.SHA1
  description: SHA1 of analysis sample.
  type: string
- contextPath: Joe.Analysis.SHA256
  description: SHA256 of analysis sample.
  type: string
- contextPath: Joe.Analysis.SampleName
  description: Sample Data, could be a file name or URL.
  type: string
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
  type: string
- contextPath: DBotScore.Type
  description: The indicator type.
  type: string
- contextPath: DBotScore.Score
  description: The actual score.
  type: number
- contextPath: DBotScore.Malicious.Vendor
  description: The vendor used to calculate the score.
  type: string
- contextPath: DBotScore.Malicious.Detections
  description: The sub analysis detection statuses.
  type: string
- contextPath: DBotScore.Malicious.SHA1
  description: The SHA1 of the file.
  type: string
- contextPath: InfoFile.Name
  description: FileName.
  type: string
- contextPath: InfoFile.EntryID
  description: The EntryID of the sample.
  type: string
- contextPath: InfoFile.Size
  description: File Size.
  type: number
- contextPath: InfoFile.Type
  description: File type e.g. "PE".
  type: string
- contextPath: InfoFile.Info
  description: Basic information of the file.
  type: string
- contextPath: File.Extension
  description: File Extension.
  type: string
- contextPath: InfoFile
  description: Report file object.
  type: unknown
- contextPath: File
  description: File object.
  type: unknown
- contextPath: Joe.Analysis
  description: Joe Analysis object.
  type: unknown
- contextPath: DBotScore
  description: DBotScore object.
  type: unknown
- contextPath: DBotScore.Malicious
  description: DBotScore Malicious object.
  type: unknown
- contextPath: File.MD5
  description: The MD5 hash of the file.
- contextPath: File.Name
  description: The full file name.
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
- contextPath: File.SHA256
  description: The SHA256 hash of the file.
tests:
- No tests (auto formatted)
fromversion: 6.8.0