SbQuery Deprecated

Deprecated. Use Check Point Threat Emulation (SandBlast) instead. Query, upload and download data using Check Point Sandblast on cloud.

python · Check Point Sandblast Cloud Services (Deprecated)

Details

ID	`SbQuery`
Language	python
From Version	5.0.0
Docker Image	`demisto/python:2.7.18.27799`
Tags	sandblast

README

Uses the Query API to have a client application look for either the analysis report of a specific file on the Check Point Threat Prevention service databases or the status of a file, uploaded for analysis.

Script Data

Name	Description
Script Type	python
Tags	sandblast

Dependencies

This script uses the following commands and scripts.

sb-query

Inputs

Argument Name	Description
md5	The MD5 hash of the file to query.
sha1	The SHA1 hash of the file to query.
sha256	The SHA256 hash of the file to query.
file_type	The extension of the file. The service identifies the type.
features	The available features. The default is “te” and “av”.
images	The array of the objects with ID and revision of the available OS images.
reports	The array of supported report formats. Can be, “pdf”, “xml”, or “tar”.
benign_reports	By default, reports are returned only for malicious files. Mark this as true to get benign reports.
quota	Whether the response delivers the quota data (for cloud services only).
file_name	The name of the file. The service calculates the file name from the part name.

Outputs

There are no outputs for this script.

Source

SbQuery.py SbQuery.yml

Download History Raw

commonfields:
  id: SbQuery
  version: -1
name: SbQuery
script: ''
type: python
subtype: python2
tags:
- sandblast
comment: Deprecated. Use Check Point Threat Emulation (SandBlast) instead. Query, upload and download data using Check Point Sandblast on cloud.
system: true
args:
- name: md5
  description: The md5 to query
- name: sha1
  description: The sha1 to query
- name: sha256
  description: The sha256 to query
- name: file_type
  description: File extension (although the service identifies the type)
- name: features
  auto: PREDEFINED
  predefined:
  - te
  - av
  - extraction
  - all
  description: Available features - default is te and av
- name: images
  description: Array of objects with id and revision of available OS images
- name: reports
  description: Array of supported report formats of - pdf | xml | tar
- name: benign_reports
  auto: PREDEFINED
  predefined:
  - 'true'
  - 'false'
  description: By default, reports are returned only for malicious files - you can mark this as true and get benign reports
- name: quota
  auto: PREDEFINED
  predefined:
  - 'true'
  - 'false'
  description: If true, response delivers the quota data (for cloud services only)
- name: file_name
  description: File name - service calculates the file name from the part name
scripttarget: 0
timeout: 0s
dependson:
  must:
  - sandblast-query
fromversion: 5.0.0
dockerimage: demisto/python:2.7.18.27799
tests:
- No tests (deprecated)
deprecated: true