Extract Indicators From File - Generic Deprecated Hidden

Deprecated. Use the "Extract Indicators From File - Generic v2" playbook instead.\ \ Extracts indicators from a file. Supported file types: - PDF - TXT - HTM, HTML - DOC, DOCX

Deprecated Content (Deprecated) · 12 tasks · 1 input · 17 outputs

Details

IDextract_indicators_from_file_-_generic
From Version5.0.0
Tasks12

README

Deprecated. Use the “Extract Indicators From File - Generic v2” playbook instead.
Extracts indicators from a file.
Supported file types:

  • PDF
  • TXT
  • HTM, HTML
  • DOC, DOCX

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

  • ExtractIndicatorsFromTextFile
  • ExtractIndicatorsFromWordFile
  • ReadPDFFile
  • Set

Commands

This playbook does not use any commands.

Playbook Inputs

Name Description Default Value Required
File The file to extract indicators from. File Optional

Playbook Outputs

Path Description Type
Domain.Name Extracted domains unknown
Account.Email.Address Extracted emails unknown
File.MD5 Extracted MD5 unknown
File.SHA1 Extracted SHA1 unknown
File.SHA256 Extracted SHA256 unknown
IP.Address Extracted IPs unknown
File.Text The PDF File extracted text unknown
File.Producer The PDF File producer unknown
File.Title The PDF File Title unknown
File.xap The PDF File xap unknown
File.Author The PDF File Author unknown
File.dc The PDF File dc unknown
File.xapmm The PDF File xapmm unknown
File.ModDate The PDF File ModDate unknown
File.CreationDate The PDF File CreationDate unknown
File.Pages Number of pages in PDF file unknown
URL.Data List of URLs that were extracted from the PDF file unknown

Playbook Image

Extract_Indicators_From_File_Generic

Inputs

  • File — The file to extract indicators from.

Outputs

  • Domain.Name — Extracted domains
  • Account.Email.Address — Extracted emails
  • File.MD5 — Extracted MD5
  • File.SHA1 — Extracted SHA1
  • File.SHA256 — Extracted SHA256
  • IP.Address — Extracted IPs
  • File.Text — The PDF File extracted text
  • File.Producer — The PDF File producer
  • File.Title — The PDF File Title
  • File.xap — The PDF File xap
  • File.Author — The PDF File Author
  • File.dc — The PDF File dc
  • File.xapmm — The PDF File xapmm
  • File.ModDate — The PDF File ModDate
  • File.CreationDate — The PDF File CreationDate
  • File.Pages — Number of pages in PDF file
  • URL.Data — List of URLs that were extracted from the PDF file

Flowchart

yes yes yes yes Start Start Is there a file? Is there a file? Set file to local context - Set Set file to local context Set Done Done Extract Indicators from file Extract Indicators from file Is there a text-based file? Is there a text-based file? Extract indicators from text-based file - ExtractIndicatorsFromTextFile Extract indicators from t... ExtractIndicatorsFromTextFile Is there a PDF file? Is there a PDF file? Extract indicators from PDF file - ReadPDFFile Extract indicators from P... ReadPDFFile Is there a Word file? Is there a Word file? No File To Parse No File To Parse Extract indicators from Word file - ExtractIndicatorsFromWordFile Extract indicators from W... ExtractIndicatorsFromWordFile

Source

playbook-Extract_Indicators_From_File_-_Generic.yml
Download History Raw 
id: extract_indicators_from_file_-_generic
version: -1
name: Extract Indicators From File - Generic
fromversion: 5.0.0
description: |-
  Deprecated. Use the "Extract Indicators From File - Generic v2" playbook instead.\
  \ Extracts indicators from a file.
  Supported file types:
  - PDF
  - TXT
  - HTM, HTML
  - DOC, DOCX
starttaskid: "0"
hidden: true
tasks:
  "0":
    id: "0"
    taskid: 7c475fe8-ef6f-4203-8649-88c8ee1355a4
    type: start
    task:
      id: 7c475fe8-ef6f-4203-8649-88c8ee1355a4
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": -20
        }
      }
    note: false
    timertriggers: []
  "1":
    id: "1"
    taskid: 7d301230-7301-4a9c-879f-2e3b4366a3d7
    type: condition
    task:
      id: 7d301230-7301-4a9c-879f-2e3b4366a3d7
      version: -1
      name: Is there a file?
      description: |
        Checks if there is a file in the playbook input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.File
                accessor: EntryID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 265,
          "y": 115
        }
      }
    note: false
    timertriggers: []
  "2":
    id: "2"
    taskid: 864c6f5e-7214-4a36-8c37-80f7057bd36e
    type: regular
    task:
      id: 864c6f5e-7214-4a36-8c37-80f7057bd36e
      version: -1
      name: Set file to local context
      description: Set the input file into local context.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      append: {}
      key:
        simple: File
      value:
        complex:
          root: inputs.File
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 510,
          "y": 350
        }
      }
    note: false
    timertriggers: []
  "3":
    id: "3"
    taskid: cc0c7ac6-f764-47df-8f1e-cfbdcbd25c4e
    type: title
    task:
      id: cc0c7ac6-f764-47df-8f1e-cfbdcbd25c4e
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 420,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
  "4":
    id: "4"
    taskid: a3d79b72-2b6b-498f-887a-d406249d18e8
    type: title
    task:
      id: a3d79b72-2b6b-498f-887a-d406249d18e8
      version: -1
      name: Extract Indicators from file
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
      - "7"
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 510,
          "y": 535
        }
      }
    note: false
    timertriggers: []
  "5":
    id: "5"
    taskid: 5e2997db-65a5-49a7-8f9a-87892701e8fe
    type: condition
    task:
      id: 5e2997db-65a5-49a7-8f9a-87892701e8fe
      version: -1
      name: Is there a text-based file?
      description: Checks if there is a text-based file in context. Skips MSG and EML files.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                    right:
                      value:
                        simple: ASCII text
                    ignorecase: true
                - - operator: notContainsString
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                    right:
                      value:
                        simple: news or mail
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: File.Info
                      iscontext: true
                    right:
                      value:
                        simple: eml
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: File.Info
                      iscontext: true
                    right:
                      value:
                        simple: msg
                - - operator: notContainsString
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                    right:
                      value:
                        simple: Composite Document File V2 Document, No summary info
                - - operator: notContainsString
                    left:
                      value:
                        simple: File.Info
                      iscontext: true
                    right:
                      value:
                        simple: message/rfc822
                accessor: EntryID
                transformers:
                - operator: uniq
            iscontext: true
    view: |-
      {
        "position": {
          "x": 92.5,
          "y": 700
        }
      }
    note: false
    timertriggers: []
  "6":
    id: "6"
    taskid: e077b5e8-a546-4da5-86ea-fb327ead5a2e
    type: regular
    task:
      id: e077b5e8-a546-4da5-86ea-fb327ead5a2e
      version: -1
      name: Extract indicators from text-based file
      description: Extracts indicators from text-based files.
      scriptName: ExtractIndicatorsFromTextFile
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      entryID:
        complex:
          root: File
          filters:
          - - operator: containsString
              left:
                value:
                  simple: File.Type
                iscontext: true
              right:
                value:
                  simple: ASCII text
              ignorecase: true
          - - operator: notContainsString
              left:
                value:
                  simple: File.Type
                iscontext: true
              right:
                value:
                  simple: news or mail
          - - operator: isNotEqualString
              left:
                value:
                  simple: File.Info
                iscontext: true
              right:
                value:
                  simple: eml
          - - operator: isNotEqualString
              left:
                value:
                  simple: File.Info
                iscontext: true
              right:
                value:
                  simple: msg
          - - operator: notContainsString
              left:
                value:
                  simple: File.Type
                iscontext: true
              right:
                value:
                  simple: Composite Document File V2 Document, No summary info
          - - operator: notContainsString
              left:
                value:
                  simple: File.Info
                iscontext: true
              right:
                value:
                  simple: message/rfc822
          accessor: EntryID
          transformers:
          - operator: uniq
      maxFileSize: {}
    reputationcalc: 2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 92.5,
          "y": 990
        }
      }
    note: false
    timertriggers: []
  "7":
    id: "7"
    taskid: 542f7e7a-6978-480e-8356-cc7cda51a6d7
    type: condition
    task:
      id: 542f7e7a-6978-480e-8356-cc7cda51a6d7
      version: -1
      name: Is there a PDF file?
      description: Checks if there is a PDF file in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                    right:
                      value:
                        simple: pdf
                    ignorecase: true
                - - operator: containsString
                    left:
                      value:
                        simple: File.Info
                      iscontext: true
                    right:
                      value:
                        simple: pdf
                accessor: EntryID
                transformers:
                - operator: uniq
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 510,
          "y": 700
        }
      }
    note: false
    timertriggers: []
  "8":
    id: "8"
    taskid: 34c98942-d6e9-4db6-81e9-a04339cdf58c
    type: regular
    task:
      id: 34c98942-d6e9-4db6-81e9-a04339cdf58c
      version: -1
      name: Extract indicators from PDF file
      description: Extracts indicators from PDF files.
      scriptName: ReadPDFFile
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      entryID:
        complex:
          root: File
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: File.Type
                iscontext: true
              right:
                value:
                  simple: application/pdf
            - operator: containsString
              left:
                value:
                  simple: File.Info
                iscontext: true
              right:
                value:
                  simple: application/pdf
              ignorecase: true
          accessor: EntryID
          transformers:
          - operator: uniq
      maxFileSize: {}
    reputationcalc: 2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 510,
          "y": 990
        }
      }
    note: false
    timertriggers: []
  "9":
    id: "9"
    taskid: 9ba76882-583c-4eb1-8d44-6c28ddd44d13
    type: condition
    task:
      id: 9ba76882-583c-4eb1-8d44-6c28ddd44d13
      version: -1
      name: Is there a Word file?
      description: Checks if there is a Word file (DOC, DOCX) in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                    right:
                      value:
                        simple: Composite Document File V2 Document
                  - operator: containsString
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                    right:
                      value:
                        simple: Microsoft Word
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: File.Info
                      iscontext: true
                    right:
                      value:
                        simple: msg
                    ignorecase: true
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: File.Info
                      iscontext: true
                    right:
                      value:
                        simple: eml
                    ignorecase: true
                - - operator: isNotExists
                    left:
                      value:
                        simple: File.Extension
                      iscontext: true
                  - operator: isNotEqualString
                    left:
                      value:
                        simple: File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: xls
                    ignorecase: true
                - - operator: isNotExists
                    left:
                      value:
                        simple: File.Extension
                      iscontext: true
                  - operator: isNotEqualString
                    left:
                      value:
                        simple: File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: xlsx
                    ignorecase: true
                - - operator: isNotExists
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                  - operator: notContainsString
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                    right:
                      value:
                        simple: Excel
                    ignorecase: true
                accessor: EntryID
                transformers:
                - operator: uniq
            iscontext: true
    view: |-
      {
        "position": {
          "x": 920,
          "y": 700
        }
      }
    note: false
    timertriggers: []
  "10":
    id: "10"
    taskid: c552720b-f6fc-49be-8c2a-1beb7178c737
    type: title
    task:
      id: c552720b-f6fc-49be-8c2a-1beb7178c737
      version: -1
      name: No File To Parse
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -530,
          "y": 890
        }
      }
    note: false
    timertriggers: []
  "11":
    id: "11"
    taskid: cf8a2830-ba83-43b2-802a-1b4e3281e834
    type: regular
    task:
      id: cf8a2830-ba83-43b2-802a-1b4e3281e834
      version: -1
      name: Extract indicators from Word file
      description: Extracts indicators from word files (DOC, DOCX).
      scriptName: ExtractIndicatorsFromWordFile
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      entryID:
        complex:
          root: File
          filters:
          - - operator: containsString
              left:
                value:
                  simple: File.Type
                iscontext: true
              right:
                value:
                  simple: Composite Document File V2 Document
            - operator: containsString
              left:
                value:
                  simple: File.Type
                iscontext: true
              right:
                value:
                  simple: Microsoft Word
          - - operator: isNotEqualString
              left:
                value:
                  simple: File.Info
                iscontext: true
              right:
                value:
                  simple: msg
              ignorecase: true
          - - operator: isNotEqualString
              left:
                value:
                  simple: File.Info
                iscontext: true
              right:
                value:
                  simple: eml
              ignorecase: true
          - - operator: isNotExists
              left:
                value:
                  simple: File.Extension
                iscontext: true
            - operator: isNotEqualString
              left:
                value:
                  simple: File.Extension
                iscontext: true
              right:
                value:
                  simple: xls
          - - operator: isNotExists
              left:
                value:
                  simple: File.Extension
                iscontext: true
            - operator: isNotEqualString
              left:
                value:
                  simple: File.Extension
                iscontext: true
              right:
                value:
                  simple: xlsx
              ignorecase: true
          - - operator: isNotExists
              left:
                value:
                  simple: File.Type
                iscontext: true
            - operator: notContainsString
              left:
                value:
                  simple: File.Type
                iscontext: true
              right:
                value:
                  simple: Excel
              ignorecase: true
          accessor: EntryID
          transformers:
          - operator: uniq
    reputationcalc: 2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 920,
          "y": 990
        }
      }
    note: false
    timertriggers: []
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1325,
        "width": 1830,
        "x": -530,
        "y": -20
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: The file to extract indicators from.
outputs:
- contextPath: Domain.Name
  description: Extracted domains
- contextPath: Account.Email.Address
  description: Extracted emails
- contextPath: File.MD5
  description: Extracted MD5
- contextPath: File.SHA1
  description: Extracted SHA1
- contextPath: File.SHA256
  description: Extracted SHA256
- contextPath: IP.Address
  description: Extracted IPs
- contextPath: File.Text
  description: The PDF File extracted text
- contextPath: File.Producer
  description: The PDF File producer
- contextPath: File.Title
  description: The PDF File Title
- contextPath: File.xap
  description: The PDF File xap
- contextPath: File.Author
  description: The PDF File Author
- contextPath: File.dc
  description: The PDF File dc
- contextPath: File.xapmm
  description: The PDF File xapmm
- contextPath: File.ModDate
  description: The PDF File ModDate
- contextPath: File.CreationDate
  description: The PDF File CreationDate
- contextPath: File.Pages
  description: Number of pages in PDF file
- contextPath: URL.Data
  description: List of URLs that were extracted from the PDF file
  type: unknown
tests:
- No test - deprecated playbook
deprecated: true