Detonate File - JoeSecurity Deprecated

Deprecated. Use the joe-submit-sample command instead.

Joe Security · 9 tasks · 7 inputs · 30 outputs

Details

IDdetonatefile_-_joesecurity
From Version5.0.0
Tasks9

README

Detonates one or more files using the Joe Security - Joe Sandbox integration.
Returns relevant reports to the War Room and file reputations to the context data.
All file types are supported.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

  • Joe Security

Scripts

  • Set

Commands

  • joe-analysis-info
  • joe-download-report
  • joe-analysis-submit-sample

Playbook Inputs

Name Description Default Value Source Required
File The file object of the file to detonate. The file is taken from the context. None File Optional
Interval The duration for executing the pooling (in minutes). 1 - Optional
Timeout The duration after which to stop pooling and to resume the playbook (in minutes). 15 - Optional
Systems The operating system to run the analysis on (comma-separated). Supported values are: w7, w7x64, w7_1, w7_2, w7native, android2, android3, mac1, w7l, w7x64l, w10, android4, w7x64native, w7_3, w10native, android5native_1, w7_4, w7_5, w10x64, w7x64_hvm, android6, iphone1, w7_sec, macvm, w7_lang_packs, w7x64native_hvm, lnxubuntu1, lnxcentos1, android7_nougat. - - Optional
Comments The comments for the analysis. - - Optional
InternetAccess Whether to enable internet access (boolean). The default is “True”. “True” means there is internet access. “False” means there is no internet access. True - Optional
ReportFileType The resource type to download. The default is “HTML”. The supported values are: html, lighthtml, executive, pdf, classhtml, xml, lightxml, classxml, clusterxml, irxml, json, jsonfixed, lightjson, lightjsonfixed, irjson, irjsonfixed, shoots (screenshots), openioc, maec, misp, graphreports, memstrings, binstrings, sample, cookbook, bins (dropped files), unpackpe (unpacked PE files), unpack, ida, pcap, pcapslim, memdumps, yara. - - Optional

Playbook Outputs

Path Description Type
DBotScore.Vendor The vendor used to calculate the score. string
Joe.Analysis.ID The web ID. string
Joe.Analysis.Status The analysis status. string
Joe.Analysis.Comments The analysis comments. string
Joe.Analysis.Time The submitted time. date
Joe.Analysis.Runs The sub-analysis information. unknown
Joe.Analysis.Result The analysis results. string
Joe.Analysis.Errors The raised errors during sampling. unknown
Joe.Analysis.Systems The analysis OS. unknown
Joe.Analysis.MD5 The MD5 hash of analysis sample. string
Joe.Analysis.SHA1 The SHA1 hash of analysis sample. string
Joe.Analysis.SHA256 The SHA256 hash of analysis sample. string
Joe.Analysis.SampleName The sample data. Can be, “file name” or “URL”. string
DBotScore.Indicator The indicator that was tested. string
DBotScore.Type The indicator type. string
DBotScore.Score The actual score. number
DBotScore.Malicious.Vendor The vendor used to calculate the score. string
DBotScore.Malicious.Detections The sub-analysis detection statuses. string
DBotScore.Malicious.SHA1 The SHA1 hash of the file. string
InfoFile.Name The filename. string
InfoFile.EntryID The EntryID of the sample. string
InfoFile.Size The file size. number
InfoFile.Type The file type. For example, “PE”. string
InfoFile.Info The basic information of the file. string
File.Extension The file extension. string
InfoFile The report file object. unknown
File The file object. unknown
Joe.Analysis The Joe analysis object. unknown
DBotScore The DBotScore object. unknown
DBotScore.Malicious The DBotScore malicious object. unknown

Playbook Image

Detonate_File_JoeSecurity

Inputs

  • File — File object of the file to detonate. The File is taken from the context.
  • Interval — Duration for executing the pooling (in minutes)
  • Timeout — The duration after which to stop pooling and to resume the playbook (in minutes)
  • Systems — Operating system to run the analysis on (comma-separated). Supported values are: w7, w7x64, w7_1, w7_2, w7native, android2, android3, mac1, w7l, w7x64l, w10, android4, w7x64native, w7_3, w10native, android5native_1, w7_4, w7_5, w10x64, w7x64_hvm, android6, iphone1, w7_sec, macvm, w7_lang_packs, w7x64native_hvm, lnxubuntu1, lnxcentos1, android7_nougat
  • Comments — Comments for the analysis.
  • InternetAccess — Enable internet access (boolean). True= internet access (default), False= no internet access.
  • ReportFileType — The resource type to download. Default is html. Supported values are: html, lighthtml, executive, pdf, classhtml, xml, lightxml, classxml, clusterxml, irxml, json, jsonfixed, lightjson, lightjsonfixed, irjson, irjsonfixed, shoots (screenshots), openioc, maec, misp, graphreports, memstrings, binstrings, sample, cookbook, bins (dropped files), unpackpe (unpacked PE files), unpack, ida, pcap, pcapslim, memdumps, yara

Outputs

  • DBotScore.Vendor — The vendor used to calculate the score.
  • Joe.Analysis.ID — Web ID
  • Joe.Analysis.Status — Analysis Status
  • Joe.Analysis.Comments — Analysis Comments
  • Joe.Analysis.Time — Submitted Time
  • Joe.Analysis.Runs — Sub-Analysis Information
  • Joe.Analysis.Result — Analysis Results
  • Joe.Analysis.Errors — Raised errors during sampling
  • Joe.Analysis.Systems — Analysis OS
  • Joe.Analysis.MD5 — MD5 of analysis sample
  • Joe.Analysis.SHA1 — SHA1 of analysis sample
  • Joe.Analysis.SHA256 — SHA256 of analysis sample
  • Joe.Analysis.SampleName — Sample Data, could be a file name or URL
  • DBotScore.Indicator — The indicator that was tested.
  • DBotScore.Type — The indicator type.
  • DBotScore.Score — The actual score.
  • DBotScore.Malicious.Vendor — The vendor used to calculate the score.
  • DBotScore.Malicious.Detections — The sub analysis detection statuses
  • DBotScore.Malicious.SHA1 — The SHA1 of the file
  • InfoFile.Name — FileName
  • InfoFile.EntryID — The EntryID of the sample
  • InfoFile.Size — File Size
  • InfoFile.Type — File type e.g. "PE"
  • InfoFile.Info — Basic information of the file
  • File.Extension — File Extension
  • InfoFile — Report file object
  • File — File object
  • Joe.Analysis — Joe Analysis object
  • DBotScore — DBotScore object
  • DBotScore.Malicious — DBotScore Malicious object

Commands used

joe-analysis-info joe-analysis-submit-sample joe-download-report

Flowchart

yes yes Start Start JoeSecurity Upload File - joe-analysis-submit-sample JoeSecurity Upload File joe-analysis-submit-sample GenericPolling - GenericPolling GenericPolling GenericPolling JoeSecurity Get Report - joe-download-report JoeSecurity Get Report joe-download-report Done Done Is there a File to detonate? Is there a File to detonate? Is JoeSecurity sandbox enabled? Is JoeSecurity sandbox en... JoeSecurity Get Info - joe-analysis-info JoeSecurity Get Info joe-analysis-info Set Context - Set Set Context Set

Source

playbook-Detonate_File_-_JoeSecurity.yml playbook-Detonate_File_-_JoeSecurity_V2.yml playbook-Detonate_File_-_JoeSecurity_V2_README.md
Download History Raw 
The Detonate File using Joe Sandbox Process is designed to streamline and enhance the security assessment of files. This automated system accepts a user-submitted file, sends it for in-depth analysis using Joe Sandbox technology, and returns comprehensive results as attachments to the user. The process is designed to be swift, efficient, and secure, providing users with valuable insights into potential threats and vulnerabilities within their files.

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

This playbook does not use any sub-playbooks.

### Integrations

* JoeSecurityV2

### Scripts

* Set

### Commands

* joe-submit-sample
* joe-download-report
* joe-analysis-info

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| File | File object of the file to detonate. The File is taken from the context. | File | Optional |
| Timeout | The default duration after which to stop polling and to resume the playbook \(in seconds\). | 900 | Optional |
| Systems | Operating system to run the analysis on \(comma-separated\). Supported values are: w7, w7x64, w7_1, w7_2, w7native, android2, android3, mac1, w7l, w7x64l, w10, android4, w7x64native, w7_3, w10native, android5native_1, w7_4, w7_5, w10x64, w7x64_hvm, android6, iphone1, w7_sec, macvm, w7_lang_packs, w7x64native_hvm, lnxubuntu1, lnxcentos1, android7_nougat \(if no input is provided, the default is w10x64_office\) |  | Optional |
| Comments | Comments for the analysis. |  | Optional |
| ReportFileType | The resource type to download. Default is html. Supported values are: html, lighthtml, executive, pdf, classhtml, xml, lightxml, classxml, clusterxml, irxml, json, jsonfixed, lightjson, lightjsonfixed, irjson, irjsonfixed, shoots \(screenshots\), openioc, maec, misp, graphreports, memstrings, binstrings, sample, cookbook, bins \(dropped files\), unpackpe \(unpacked PE files\), unpack, ida, pcap, pcapslim, memdumps, yara |  | Optional |

## Playbook Outputs

---

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| DBotScore.Vendor | The vendor used to calculate the score. | string |
| Joe.Analysis.ID | Web ID. | string |
| Joe.Analysis.Status | Analysis Status. | string |
| Joe.Analysis.Comments | Analysis Comments. | string |
| Joe.Analysis.Time | Submitted Time. | date |
| Joe.Analysis.Runs | Sub-Analysis Information. | unknown |
| Joe.Analysis.Result | Analysis Results. | string |
| Joe.Analysis.Errors | Raised errors during sampling. | unknown |
| Joe.Analysis.Systems | Analysis OS. | unknown |
| Joe.Analysis.MD5 | MD5 of analysis sample. | string |
| Joe.Analysis.SHA1 | SHA1 of analysis sample. | string |
| Joe.Analysis.SHA256 | SHA256 of analysis sample. | string |
| Joe.Analysis.SampleName | Sample Data, could be a file name or URL. | string |
| DBotScore.Indicator | The indicator that was tested. | string |
| DBotScore.Type | The indicator type. | string |
| DBotScore.Score | The actual score. | number |
| DBotScore.Malicious.Vendor | The vendor used to calculate the score. | string |
| DBotScore.Malicious.Detections | The sub analysis detection statuses. | string |
| DBotScore.Malicious.SHA1 | The SHA1 of the file. | string |
| InfoFile.Name | FileName. | string |
| InfoFile.EntryID | The EntryID of the sample. | string |
| InfoFile.Size | File Size. | number |
| InfoFile.Type | File type e.g. "PE". | string |
| InfoFile.Info | Basic information of the file. | string |
| File.Extension | File Extension. | string |
| InfoFile | Report file object. | unknown |
| File | File object. | unknown |
| Joe.Analysis | Joe Analysis object. | unknown |
| DBotScore | DBotScore object. | unknown |
| DBotScore.Malicious | DBotScore Malicious object. | unknown |
| File.MD5 | The MD5 hash of the file. | unknown |
| File.Name | The full file name. | unknown |
| File.SHA1 | The SHA1 hash of the file. | unknown |
| File.SHA256 | The SHA256 hash of the file. | unknown |

## Playbook Image

---

![Detonate File - JoeSecurity V2](../doc_files/Detonate_File_-_JoeSecurity_V2.png)