File Enrichment - File reputation

Get file reputation using one or more integrations

Common Playbooks · 9 tasks · 3 inputs · 10 outputs

Details

IDfile_enrichment_-_file_reputation
From Version5.0.0
Tasks9

README

Gets a file’s reputation using one or more integrations.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

  • FileReputation

Commands

This playbook does not use any commands.

Playbook Inputs

Name Description Default Value Source Required
MD5 The MD5 hash to enrich. MD5 File Optional
SHA256 The SHA256 hash to enrich. SHA256 File Optional
SHA1 The SHA1 hash to enrich. SHA1 File Optional

Playbook Outputs

Path Description Type
File The file’s object. unknown
File.MD5 The MD5 hash of the file. string
File.SHA1 The SHA1 hash of the file. string
File.SHA256 The SHA256 hash of the file. string
File.Malicious.Vendor The vendor that made the decision that the file is malicious. string
DBotScore The DBotScore’s object. unknown
DBotScore.Indicator The tested indicator. string
DBotScore.Type The type of the indicator. string
DBotScore.Vendor The vendor used to calculate the score. string
DBotScore.Score The actual score. number

Playbook Image

File_Enrichment_File_reputation

Inputs

  • MD5 — File MD5 hash to enrich.
  • SHA256 — File SHA-256 hash to enrich.
  • SHA1 — File SHA-1 hash to enrich.

Outputs

  • File — The file's object
  • File.MD5 — MD5 hash of the file
  • File.SHA1 — SHA1 hash of the file
  • File.SHA256 — SHA256 hash of the file
  • File.Malicious.Vendor — For malicious files, the vendor that made the decision
  • DBotScore — The DBotScore's object
  • DBotScore.Indicator — The tested indicator
  • DBotScore.Type — The type of the indicator
  • DBotScore.Vendor — Vendor used to calculate the score
  • DBotScore.Score — The actual score

Flowchart

yes yes yes Start Start Get file hash reputation Get file hash reputation Get MD5 reputation - FileReputation Get MD5 reputation FileReputation Done Done Is there an MD5 hash? Is there an MD5 hash? Is there a SHA-256 hash? Is there a SHA-256 hash? Get SHA-256 reputation - FileReputation Get SHA-256 reputation FileReputation Is there a SHA-1 hash? Is there a SHA-1 hash? Get SHA-1 reputation - FileReputation Get SHA-1 reputation FileReputation

Source

playbook-File_Enrichment_-_File_reputation.yml
Download History Raw 
id: file_enrichment_-_file_reputation
version: -1
name: File Enrichment - File reputation
fromversion: 5.0.0
description: Get file reputation using one or more integrations
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 214ebf34-1312-43ec-873d-41d45094ba22
    type: start
    task:
      id: 214ebf34-1312-43ec-873d-41d45094ba22
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 50
        }
      }
  "1":
    id: "1"
    taskid: 4b42764c-31bd-4097-8721-159b73534347
    type: title
    task:
      id: 4b42764c-31bd-4097-8721-159b73534347
      version: -1
      name: Get file hash reputation
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
      - "15"
      - "17"
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 195
        }
      }
  "5":
    id: "5"
    taskid: 61a4a533-980d-4b46-816e-75bbf2550d0a
    type: regular
    task:
      id: 61a4a533-980d-4b46-816e-75bbf2550d0a
      version: -1
      name: Get MD5 reputation
      description: Get the MD5 hash reputation from every integration that supports the `!file` command.
      scriptName: FileReputation
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      file:
        complex:
          root: inputs.MD5
    reputationcalc: 0
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 515
        }
      }
  "7":
    id: "7"
    taskid: 66d74bf4-438c-40a8-840f-58052c181d0f
    type: title
    task:
      id: 66d74bf4-438c-40a8-840f-58052c181d0f
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 690
        }
      }
  "14":
    id: "14"
    taskid: 63bff973-38e4-490f-830e-b9d68f2791ad
    type: condition
    task:
      id: 63bff973-38e4-490f-830e-b9d68f2791ad
      version: -1
      name: Is there an MD5 hash?
      description: Check if there is an MD5 hash in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "5"
    scriptarguments:
      value:
        simple: ${File.MD5}
    reputationcalc: 0
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: inputs.MD5
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 340
        }
      }
  "15":
    id: "15"
    taskid: 8e16c355-ee0c-4b2b-86b1-0d2f5916430f
    type: condition
    task:
      id: 8e16c355-ee0c-4b2b-86b1-0d2f5916430f
      version: -1
      name: Is there a SHA-256 hash?
      description: Check if there is a SHA-256 hash in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "16"
    scriptarguments:
      value:
        simple: ${File.SHA256}
    reputationcalc: 0
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 500,
          "y": 340
        }
      }
  "16":
    id: "16"
    taskid: 092a1e7e-b7d8-4d50-8f6e-021c31701974
    type: regular
    task:
      id: 092a1e7e-b7d8-4d50-8f6e-021c31701974
      version: -1
      name: Get SHA-256 reputation
      description: Get the SHA-256 hash reputation from every integration that supports the `!file` command.
      scriptName: FileReputation
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      file:
        complex:
          root: inputs.SHA256
    reputationcalc: 0
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 515
        }
      }
  "17":
    id: "17"
    taskid: ceddfccc-685c-4392-8955-2c116297ca5f
    type: condition
    task:
      id: ceddfccc-685c-4392-8955-2c116297ca5f
      version: -1
      name: Is there a SHA-1 hash?
      description: Check if there is a SHA-1 hash in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "18"
    scriptarguments:
      value:
        simple: ${File.SHA256}
    reputationcalc: 0
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: inputs.SHA1
            iscontext: true
    view: |-
      {
        "position": {
          "x": 950,
          "y": 340
        }
      }
  "18":
    id: "18"
    taskid: 9cd10068-c589-4c05-8a22-7ec3528b89de
    type: regular
    task:
      id: 9cd10068-c589-4c05-8a22-7ec3528b89de
      version: -1
      name: Get SHA-1 reputation
      description: Get the SHA-1 hash reputation from every integration that supports the `!file` command.
      scriptName: FileReputation
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      file:
        complex:
          root: inputs.SHA1
    reputationcalc: 0
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1062.5,
          "y": 515
        }
      }
view: |-
  {
    "linkLabelsPosition": {
      "14_7_#default#": 0.52,
      "15_7_#default#": 0.61
    },
    "paper": {
      "dimensions": {
        "height": 705,
        "width": 1392.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: File MD5 hash to enrich.
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
  required: false
  description: File SHA-256 hash to enrich.
- key: SHA1
  value:
    complex:
      root: File
      accessor: SHA1
  required: false
  description: File SHA-1 hash to enrich.
outputs:
- contextPath: File
  description: The file's object
  type: unknown
- contextPath: File.MD5
  description: MD5 hash of the file
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file
  type: string
- contextPath: File.SHA256
  description: SHA256 hash of the file
  type: string
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision
  type: string
- contextPath: DBotScore
  description: The DBotScore's object
  type: unknown
- contextPath: DBotScore.Indicator
  description: The tested indicator
  type: string
- contextPath: DBotScore.Type
  description: The type of the indicator
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score
  type: string
- contextPath: DBotScore.Score
  description: The actual score
  type: number
tests:
- No tests