category: Forensics & Malware Analysis provider: CheckPoint Software Technologies commonfields: id: CheckPointSandBlast version: -1 configuration: - display: Server URL name: url required: true type: 0 additionalinfo: https://te.checkpoint.com - displaypassword: Authorization - API Key name: credentials type: 9 hiddenusername: true required: false - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false - name: integrationReliability additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: C - Fairly reliable display: Source Reliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged type: 15 required: false description: "Uploads files using polling. The service supports Microsoft Office files, as well as PDF, SWF, archives, and executables. Active content will be cleaned from any documents that you upload (Microsoft Office and PDF files only). Queries on existing IOCs, file status, analysis, and reports. Downloads files from the database. Supports both appliance and cloud. Supported Threat Emulation versions are any R80x." display: Check Point Threat Emulation (SandBlast) name: CheckPointSandBlast script: commands: - name: file description: Runs reputation on files. arguments: - name: file required: true default: true description: Hash of the file to query. Supports MD5, SHA1, and SHA256. isArray: true outputs: - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.Malicious.Vendor description: The vendor that reported the file as malicious. type: String - contextPath: File.Malicious.Description description: A description explaining why the file was determined to be malicious. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - arguments: - description: Name of the file to query (recommend using). Without it, status will be "PARTIALLY_FOUND". name: file_name - description: "File hash to query. Accepted digests are: md5, sha1 and sha256. Only md5 returns FOUND status." name: file_hash required: true - auto: PREDEFINED defaultValue: All description: Features to use on the file. isArray: true name: features predefined: - Threat Emulation - Anti-Virus - Threat Extraction - All - auto: PREDEFINED defaultValue: xml, summary description: A comma-separated list of supported report formats. Note - Simultaneous requests for PDF and summary reports is not supported. isArray: true name: reports predefined: - pdf - xml - tar - summary - auto: PREDEFINED defaultValue: pdf description: Threat extraction request method. name: method predefined: - clean - pdf - auto: PREDEFINED defaultValue: Linked Objects, Macros and Code, Sensitive Hyperlinks, PDF GoToR Actions, PDF Launch Actions, PDF URI Actions, PDF Sound Actions, PDF Movie Actions, PDF JavaScript Actions, PDF Submit Form Actions, Database Queries, Embedded Objects, Fast Save Data description: A comma-separated list of fields to be cleaned in the file. Only relevant if method = clean. isArray: true name: extracted_parts predefined: - Linked Objects - Macros and Code - Sensitive Hyperlinks - PDF GoToR Actions - PDF Launch Actions - PDF URI Actions - PDF Sound Actions - PDF Movie Actions - PDF JavaScript Actions - PDF Submit Form Actions - Database Queries - Embedded Objects - Fast Save Data - Custom Properties - Statistic Properties - Summary Properties description: Use the Query API to have a client application look for either a specific file's analysis report on the Check Point Threat Prevention service databases or the status of a file, uploaded for analysis. It is recommended to add file_name. name: sandblast-query outputs: - contextPath: SandBlast.Query.Status description: The status of requested features. type: String - contextPath: SandBlast.Query.MD5 description: The file MD5. type: String - contextPath: SandBlast.Query.SHA1 description: The file SHA1. type: String - contextPath: SandBlast.Query.SHA256 description: The file SHA256. type: String - contextPath: SandBlast.Query.FileType description: The file type, can be different from the one sent in the query request (according to the type to identify). type: String - contextPath: SandBlast.Query.FileName description: The name of the file saved on the Check Point databases. type: String - contextPath: SandBlast.Query.Features description: The features used. type: String - contextPath: SandBlast.Query.AntiVirus.SignatureName description: The signature name. If the file is not detected by Anti-Virus, the signature name is empty. type: String - contextPath: SandBlast.Query.AntiVirus.MalwareFamily description: 'The ID for the malware family, if available: {0-}.' type: Number - contextPath: SandBlast.Query.AntiVirus.MalwareType description: 'The ID for the malware type, if available: {0-}.' type: Number - contextPath: SandBlast.Query.AntiVirus.Severity description: 'The severity, 0 for benign files. Minimum: 0 Maximum: 4.' type: Number - contextPath: SandBlast.Query.AntiVirus.Confidence description: 'The confidence, 0 for benign files. Minimum: 0 Maximum 5.' type: Number - contextPath: SandBlast.Query.AntiVirus.Status description: The Anti-Virus status for the requested file. type: String - contextPath: SandBlast.Query.ThreatExtraction.Method description: The method that was used. type: String - contextPath: SandBlast.Query.ThreatExtraction.ExtractResult description: "The result from the Threat Extraction engine. Default is CP_EXTRACT_RESULT_UNKNOWN (returned if the POD did not receive an answer from the Threat Extraction engine in 60 seconds). Possible values: CP_EXTRACT_RESULT_UNKNOWN, CP_EXTRACT_RESULT_SUCCESS, CP_EXTRACT_RESULT_FAILURE, CP_EXTRACT_RESULT_TIMEOUT, CP_EXTRACT_RESULT_UNSUPPORTED_FILE, CP_EXTRACT_RESULT_NOT_SCRUBBED, CP_EXTRACT_RESULT_INTERNAL_ERROR, CP_EXTRACT_RESULT_DISK_LIMIT_REACHED, CP_EXTRACT_RESULT_ENCRYPTED_FILE, CP_EXTRACT_RESULT_DOCSEC_FILE, CP_EXTRACT_RESULT_OUT_OF_MEMORY." type: String - contextPath: SandBlast.Query.ThreatExtraction.ExtractedFileDownloadId description: The download ID of the extracted file, for download request. Only sent when extract_result = CP_EXTRACT_RESULT_SUCCESS. type: String - contextPath: SandBlast.Query.ThreatExtraction.OutputFileName description: The clean file name. type: String - contextPath: SandBlast.Query.ThreatExtraction.Time description: The time for threat extraction completion. type: String - contextPath: SandBlast.Query.ThreatExtraction.ExtractContent description: The content of the extracted file. type: String - contextPath: SandBlast.Query.ThreatExtraction.TexProduct description: True if the queried file is already a Sandblast-safe copy. type: Boolean - contextPath: SandBlast.Query.ThreatExtraction.Status description: The Threat Extraction status for the requested file. type: String - contextPath: SandBlast.Upload.ThreatExtraction.ExtractionData.InputExtension description: The uploaded filename extension as sent by the client. type: String - contextPath: SandBlast.Query.ThreatExtraction.ExtractionData.InputRealExtension description: The extension as resolved by Threat Extraction. type: String - contextPath: SandBlast.Query.ThreatExtraction.ExtractionData.Message description: The status message for scrub_result. type: String - contextPath: SandBlast.Query.ThreatExtraction.ExtractionData.ProtectionName description: The potentially malicious extracted content. type: String - contextPath: SandBlast.Query.ThreatExtraction.ExtractionData.ProtectionType description: 'The protection done for scrub_method: Conversion to PDF | Content Removal.' type: String - contextPath: SandBlast.Query.ThreatExtraction.ExtractionData.ProtocolVersion description: The protocol used. type: String - contextPath: SandBlast.Query.ThreatExtraction.ExtractionData.RealExtension description: The real extension as resolved by Threat Extraction. type: String - contextPath: SandBlast.Query.ThreatExtraction.ExtractionData.Risk description: The risk of the part that was extracted from the document. type: Number - contextPath: SandBlast.Query.ThreatExtraction.ExtractionData.ScrubActivity description: The readable result from Threat Extraction. type: String - contextPath: SandBlast.Query.ThreatExtraction.ExtractionData.ScrubMethod description: 'The scrub_method: Convert to PDF | Clean Document.' type: String - contextPath: SandBlast.Query.ThreatExtraction.ExtractionData.ScrubResult description: The code result from the Threat Extraction. type: Number - contextPath: SandBlast.Query.ThreatExtraction.ExtractionData.ScrubTime description: The Threat Extraction process time. type: String - contextPath: SandBlast.Query.ThreatExtraction.ExtractionData.ScrubbedContent description: The content that was removed. type: String - contextPath: SandBlast.Query.ThreatEmulation.Trust description: The rating of the threat data and its relevance to this instance. It is recommended to block threats with confidence medium and above. type: Number - contextPath: SandBlast.Query.ThreatEmulation.Score description: The Threat Emulation score. type: Number - contextPath: SandBlast.Query.ThreatEmulation.CombinedVerdict description: The combined verdict of all the images. Benign reports are not supported for local gateways. type: String - contextPath: SandBlast.Query.ThreatEmulation.Severity description: The combined severity of threats found. If threats are not found, this field is not shown. type: Number - contextPath: SandBlast.Query.ThreatEmulation.Images description: The sandboxes used in Threat Emulation. Information about image types can be found in https://sc1.checkpoint.com/documents/TPAPI/CP_1.0_ThreatPreventionAPI_APIRefGuide/html_frameset.htm under "Query API" -> "Query Response Format" -> "Images Object Format". type: String - contextPath: SandBlast.Query.ThreatEmulation.Confidence description: Rating of the threat data and its relevance to this instance. It is recommended to block threats with confidence 2 and above. 1 - low, 2 - medium, 3 - high. type: Number - contextPath: SandBlast.Query.ThreatEmulation.Status description: The status of Threat Emulation on the requested file. type: String - arguments: - description: The interval in seconds between each poll. name: interval_in_seconds defaultValue: '60' - description: The timeout in seconds until polling ends. name: timeout_in_seconds defaultValue: '600' - description: The ID of the file to upload, which will be taken from the uploaded file to Cortex XSOAR. name: file_id required: true - description: Rename the upload file. If empty, the uploaded file will keep its original name. name: file_name - description: 'File hash to query. Accepted digests are: md5, sha1 and sha256. Only md5 returns FOUND status.' deprecated: true name: file_hash - auto: PREDEFINED defaultValue: All description: The features to use on the file. isArray: true name: features predefined: - Threat Emulation - Anti-Virus - Threat Extraction - All - auto: PREDEFINED description: 'The ID of available OS images. An image is an operating system configuration. Inputs must be of same length as image_revisions and will be paired according to position. Information about image types can be found in https://sc1.checkpoint.com/documents/TPAPI/CP_1.0_ThreatPreventionAPI_APIRefGuide/html_frameset.htm under "Query API" -> "Query Response Format" -> "Images Object Format".' isArray: true name: image_ids predefined: - e50e99f3-5963-4573-af9e-e3f4750b55e2 - 7e6fe36e-889e-4c25-8704-56378f0830df - 8d188031-1010-4466-828b-0cd13d4303ff - 5e5de275-a103-4f67-b55b-47532918fa59 - 3ff3ddae-e7fd-4969-818c-d5f1a2be336d - 6c453c9b-20f7-471a-956c-3198a868dc92 - 10b4a9c6-e414-425c-ae8b-fe4dd7b25244 - description: The revisions of available OS images. An image is an operating system configuration. Inputs must be of same length as image_ids and will be paired according to position. isArray: true name: image_revisions - auto: PREDEFINED defaultValue: xml, summary description: A comma-separated list of supported report formats. Note - Simultaneous requests for PDF and summary reports is not supported. isArray: true name: reports predefined: - pdf - xml - tar - summary - auto: PREDEFINED defaultValue: pdf description: The threat extraction request method. name: method predefined: - clean - pdf - auto: PREDEFINED defaultValue: Linked Objects, Macros and Code, Sensitive Hyperlinks, PDF GoToR Actions, PDF Launch Actions, PDF URI Actions, PDF Sound Actions, PDF Movie Actions, PDF JavaScript Actions, PDF Submit Form Actions, Database Queries, Embedded Objects, Fast Save Data description: A comma-separated list of fields to be cleaned in the file. Only relevant if method = clean. isArray: true name: extracted_parts predefined: - Linked Objects - Macros and Code - Sensitive Hyperlinks - PDF GoToR Actions - PDF Launch Actions - PDF URI Actions - PDF Sound Actions - PDF Movie Actions - PDF JavaScript Actions - PDF Submit Form Actions - Database Queries - Embedded Objects - Fast Save Data - Custom Properties - Statistic Properties - Summary Properties description: "Uses the Upload API to have a client application request for Check Point Threat Prevention modules to scan and analyze a file. When you upload a file to the service, the file is encrypted. It is un-encrypted during analysis and then deleted. This command uses polling with query. The stages of polling are 'UPLOAD_SUCCESS', 'PENDING' and ends with 'FOUND' or 'PARTIALLY_FOUND'. Once the command is done polling, it returns analyzed information about the file." name: sandblast-upload polling: true outputs: - contextPath: SandBlast.Upload.Status description: The status of requested features. type: String - contextPath: SandBlast.Upload.MD5 description: The file MD5. type: String - contextPath: SandBlast.Upload.SHA1 description: The file SHA1. type: String - contextPath: SandBlast.Upload.SHA256 description: The file SHA256. type: String - contextPath: SandBlast.Upload.FileType description: The file type can be different from the one sent in the upload request (according to the type to identify). type: String - contextPath: SandBlast.Upload.FileName description: The name of the file saved on Check Point databases. type: String - contextPath: SandBlast.Upload.Features description: The features used. type: String - contextPath: SandBlast.Upload.AntiVirus.SignatureName description: The signature name. If the file is not detected by Anti-Virus, the signature name is empty. type: String - contextPath: SandBlast.Upload.AntiVirus.MalwareFamily description: 'The ID for the malware family, if available: {0-}.' type: Number - contextPath: SandBlast.Upload.AntiVirus.MalwareType description: 'The ID for the malware type, if available: {0-}.' type: Number - contextPath: SandBlast.Upload.AntiVirus.Severity description: 'The severity, 0 for benign files. Minimum: 0 Maximum: 4.' type: Number - contextPath: SandBlast.Upload.AntiVirus.Confidence description: 'The confidence, 0 for benign files. Minimum: 0 Maximum 5.' type: Number - contextPath: SandBlast.Upload.AntiVirus.Status description: The Anti-Virus status for the requested file. type: String - contextPath: SandBlast.Upload.ThreatExtraction.Method description: The method that was used. type: String - contextPath: SandBlast.Upload.ThreatExtraction.ExtractResult description: 'The result from the Threat Extraction engine. Default is CP_EXTRACT_RESULT_UNKNOWN (returned if the POD did not receive an answer from the Threat Extraction engine in 60 seconds). Possible values: CP_EXTRACT_RESULT_UNKNOWN, CP_EXTRACT_RESULT_SUCCESS, CP_EXTRACT_RESULT_FAILURE, CP_EXTRACT_RESULT_TIMEOUT, CP_EXTRACT_RESULT_UNSUPPORTED_FILE, CP_EXTRACT_RESULT_NOT_SCRUBBED, CP_EXTRACT_RESULT_INTERNAL_ERROR, CP_EXTRACT_RESULT_DISK_LIMIT_REACHED, CP_EXTRACT_RESULT_ENCRYPTED_FILE, CP_EXTRACT_RESULT_DOCSEC_FILE, CP_EXTRACT_RESULT_OUT_OF_MEMORY.' type: String - contextPath: SandBlast.Upload.ThreatExtraction.ExtractedFileDownloadId description: The download ID of the extracted file, for download request. Only sent when extract_result = CP_EXTRACT_RESULT_SUCCESS. type: String - contextPath: SandBlast.Upload.ThreatExtraction.OutputFileName description: The clean file name. type: String - contextPath: SandBlast.Upload.ThreatExtraction.Time description: The time for threat extraction completion. type: String - contextPath: SandBlast.Upload.ThreatExtraction.ExtractContent description: The content of the extracted file. type: String - contextPath: SandBlast.Upload.ThreatExtraction.TexProduct description: True if the queried file is already a Sandblast-safe copy. type: Boolean - contextPath: SandBlast.Upload.ThreatExtraction.Status description: The status of Threat Extraction on the requested file. type: String - contextPath: SandBlast.Upload.ThreatExtraction.ExtractionData.InputExtension description: The uploaded filename-extension as sent by the client. type: String - contextPath: SandBlast.Upload.ThreatExtraction.ExtractionData.InputRealExtension description: The extension as resolved by Threat Extraction. type: String - contextPath: SandBlast.Upload.ThreatExtraction.ExtractionData.Message description: The status message for scrub_result. type: String - contextPath: SandBlast.Upload.ThreatExtraction.ExtractionData.ProtectionName description: The potentially malicious extracted content. type: String - contextPath: SandBlast.Upload.ThreatExtraction.ExtractionData.ProtectionType description: 'The protection done for scrub_method: Conversion to PDF | Content Removal.' type: String - contextPath: SandBlast.Upload.ThreatExtraction.ExtractionData.ProtocolVersion description: The protocol used. type: String - contextPath: SandBlast.Upload.ThreatExtraction.ExtractionData.RealExtension description: The real extension as resolved by Threat Extraction. type: String - contextPath: SandBlast.Upload.ThreatExtraction.ExtractionData.Risk description: The risk of the part that was extracted from the document. type: Number - contextPath: SandBlast.Upload.ThreatExtraction.ExtractionData.ScrubActivity description: The readable result from Threat Extraction. type: String - contextPath: SandBlast.Upload.ThreatExtraction.ExtractionData.ScrubMethod description: 'The scrub-method: Convert to PDF | Clean Document.' type: String - contextPath: SandBlast.Upload.ThreatExtraction.ExtractionData.ScrubResult description: The code result from Threat Extraction. type: Number - contextPath: SandBlast.Upload.ThreatExtraction.ExtractionData.ScrubTime description: The Threat Extraction process time. type: String - contextPath: SandBlast.Upload.ThreatExtraction.ExtractionData.ScrubbedContent description: The content that was removed. type: String - contextPath: SandBlast.Upload.ThreatEmulation.Trust description: The rating of the threat data and its relevance to this instance. It is recommended to block threats with confidence medium and above. type: Number - contextPath: SandBlast.Upload.ThreatEmulation.Score description: The Threat Emulation score. type: Number - contextPath: SandBlast.Upload.ThreatEmulation.CombinedVerdict description: The combined verdict of all the images. Benign reports are not supported for local gateways. type: String - contextPath: SandBlast.Upload.ThreatEmulation.Severity description: The combined severity of threats found. If threats are not found, this field is not shown. type: Number - contextPath: SandBlast.Upload.ThreatEmulation.Images description: The sandboxes used in Threat Emulation. Information about image types can be found in https://sc1.checkpoint.com/documents/TPAPI/CP_1.0_ThreatPreventionAPI_APIRefGuide/html_frameset.htm under "Query API" -> "Query Response Format" -> "Images Object Format". type: String - contextPath: SandBlast.Upload.ThreatEmulation.Status description: The status of Threat Emulation on the requested file. type: String - arguments: - description: The ID of the file to download, taken from "Extractedfiledownloadid" from the "Threat Extraction" results. name: file_id required: true description: Uses the Download API to download a scanned file from the ThreatCloud according to the file ID. name: sandblast-download outputs: - contextPath: File.Size description: The size of the file. type: Number - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.Name description: The name of the file. type: String - contextPath: File.SSDeep description: The SSDeep hash of the file. type: String - contextPath: File.EntryID description: The entry ID of the file. type: String - contextPath: File.Info description: File information. type: String - contextPath: File.Type description: The file type. type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.Extension description: The file extension. type: String - description: Uses the Quota API to have a client application get the current license and quota status of the API key used in the authorization of the other APIs. For cloud services only. name: sandblast-quota outputs: - contextPath: SandBlast.Quota.RemainQuotaHour description: The remaining quota hours. type: Number - contextPath: SandBlast.Quota.RemainQuotaMonth description: The remaining quota months. type: Number - contextPath: SandBlast.Quota.AssignedQuotaHour description: The assigned quota hours. type: Number - contextPath: SandBlast.Quota.AssignedQuotaMonth description: The assigned quota months. type: Number - contextPath: SandBlast.Quota.HourlyQuotaNextReset description: The hourly quota next reset. type: String - contextPath: SandBlast.Quota.MonthlyQuotaNextReset description: The monthly quota next reset. type: String - contextPath: SandBlast.Quota.QuotaId description: The quota ID. type: String - contextPath: SandBlast.Quota.CloudMonthlyQuotaPeriodStart description: The cloud monthly quota period start. type: String - contextPath: SandBlast.Quota.CloudMonthlyQuotaUsageForThisGw description: The cloud monthly quota usage for this GW. type: Number - contextPath: SandBlast.Quota.CloudHourlyQuotaUsageForThisGw description: The cloud hourly quota usage for this GW. type: Number - contextPath: SandBlast.Quota.CloudMonthlyQuotaUsageForQuotaId description: The cloud monthly quota usage for the Quota ID. type: Number - contextPath: SandBlast.Quota.CloudHourlyQuotaUsageForQuotaId description: The cloud hourly quota usage for the Quota ID. type: Number - contextPath: SandBlast.Quota.MonthlyExceededQuota description: The monthly exceeded quota. type: Number - contextPath: SandBlast.Quota.HourlyExceededQuota description: The hourly exceeded quota. type: Number - contextPath: SandBlast.Quota.CloudQuotaMaxAllowToExceedPercentage description: The cloud quota max allowed to exceed percentage. type: Number - contextPath: SandBlast.Quota.PodTimeGmt description: The pod time GMT. type: String - contextPath: SandBlast.Quota.QuotaExpiration description: The quota expiration. type: String - contextPath: SandBlast.Quota.Action description: The quota action. type: String dockerimage: demisto/python3:3.12.13.10116658 runonce: false script: '-' subtype: python3 type: python tests: - playbook-CheckPointSandBlast_Test fromversion: 6.5.0