category: Forensics & Malware Analysis provider: Polygon Labs sectionorder: - Connect - Collect commonfields: id: Group-IB TDS Polygon version: -1 configuration: - defaultvalue: https://huntbox.group-ib.com display: Server URL (e.g., https://huntbox.group-ib.com) name: server required: true type: 0 section: Connect - display: API Key name: api_key required: true type: 4 section: Connect - defaultvalue: english display: Default reports language name: report_language options: - english - russian required: true type: 15 section: Connect - defaultvalue: 'false' display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: B - Usually reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged type: 15 required: false section: Collect - defaultvalue: indicatorType name: feedExpirationPolicy display: '' options: - never - interval - indicatorType - suddenDeath type: 17 required: false section: Collect - defaultvalue: '20160' name: feedExpirationInterval display: '' type: 1 required: false section: Collect description: THF Polygon is a Malware Detonation & Research platform designed for deep dynamic analysis and enhanced indicators extraction. THF Polygon analyzes submitted files and urls and extracts deep IOCs that appear when malicious code is triggered and executed. Polygon could be used either for application-level tasks (like smtp-based mail filtering) and analytical purposes (files/urls analysis for verdict, report and indicators). display: Group-IB THF Polygon name: Group-IB TDS Polygon script: commands: - name: polygon-upload-file arguments: - name: file_id required: true description: File ID in Demisto. - name: password description: Password for analyzed archive. outputs: - contextPath: Polygon.Analysis.ID description: Analysis ID in THF. type: string - contextPath: Polygon.Analysis.EntryID description: File id in Demisto. type: string - contextPath: Polygon.Analysis.FileName description: Original file name. type: string - contextPath: Polygon.Analysis.Status description: The analysis status. type: string description: Upload file for analysis. - name: polygon-upload-url arguments: - name: url required: true description: URL for analysis. outputs: - contextPath: Polygon.Analysis.ID description: Analysis ID in THF. type: string - contextPath: Polygon.Analysis.URL description: URL analyzed. type: string - contextPath: Polygon.Analysis.Status description: The analysis status. type: string description: Upload URL for analysis. - name: polygon-analysis-info arguments: - name: tds_analysis_id required: true description: Analysis ID in THF. Comma separated values. isArray: true outputs: - contextPath: File.Name description: The full file name (including file extension). type: string - contextPath: File.MD5 description: The MD5 hash of the file. type: string - contextPath: File.SHA1 description: The SHA1 hash of the file. type: string - contextPath: File.SHA256 description: The SHA256 hash of the file. type: string - contextPath: File.Type description: File type. type: string - contextPath: File.Malicious.Vendor description: The vendor that reported the file as malicious. type: string - contextPath: File.Malicious.Description description: A description explaining why the file was determined to be malicious. type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: IP.Address description: IP address. type: String - contextPath: Domain.Name description: The Domain name. type: String - contextPath: Domain.DNS description: A list of IP objects resolved by DNS. type: String - contextPath: URL.Data description: The URL. type: String - contextPath: URL.Malicious.Vendor description: The vendor that reported the url as malicious. type: string - contextPath: URL.Malicious.Description description: A description explaining why the url was determined to be malicious. type: string - contextPath: RegistryKey.Path description: The path to the registry key. type: String - contextPath: RegistryKey.Value description: The value at the given RegistryKey. type: String - contextPath: Process.Name description: Process name. type: String - contextPath: Process.PID description: Process PID. type: String - contextPath: Process.CommandLine description: Process Command Line. type: String - contextPath: Process.Path description: Process path. type: String - contextPath: Process.StartTime description: Process start time. type: date - contextPath: Process.EndTime description: Process end time. type: date - contextPath: Polygon.Analysis.ID description: THF File ID. type: string - contextPath: Polygon.Analysis.Name description: File Name. type: string - contextPath: Polygon.Analysis.Size description: File Size. type: number - contextPath: Polygon.Analysis.Started description: Analysis start timestamp. type: date - contextPath: Polygon.Analysis.Analyzed description: Analysis finish timestamp. type: date - contextPath: Polygon.Analysis.MD5 description: Analyzed file MD5 hash. type: string - contextPath: Polygon.Analysis.SHA1 description: Analyzed file SHA1 hash. type: string - contextPath: Polygon.Analysis.SHA256 description: Analyzed file SHA256. type: string - contextPath: Polygon.Analysis.Result description: Analysis verdict. type: boolean - contextPath: Polygon.Analysis.Status description: Analysis status. type: string - contextPath: Polygon.Analysis.Verdict description: Analysis verdict. type: string - contextPath: Polygon.Analysis.Probability description: Verdict probability. type: string - contextPath: Polygon.Analysis.Families description: Malware families. type: string - contextPath: Polygon.Analysis.Score description: Polygon score. type: number - contextPath: Polygon.Analysis.Internet-connection description: Internet availability. type: string - contextPath: Polygon.Analysis.Type description: File type. type: string - contextPath: Polygon.Analysis.DumpExists description: Network activity dump exists. type: boolean - contextPath: Polygon.Analysis.File description: The information about files in analysis. - contextPath: Polygon.Analysis.URL description: The information about URL indicators. - contextPath: Polygon.Analysis.IP description: The information about IP indicators. - contextPath: Polygon.Analysis.Domain description: The information about Domain indicators. - contextPath: Polygon.Analysis.RegistryKey description: The information about registry keys which were modified during the analysis. - contextPath: Polygon.Analysis.Process description: The information about processes started during the analysis. description: Get THF Polygon analysis info. - name: polygon-export-report arguments: - name: tds_analysis_id required: true description: Analysis ID in THF. outputs: - contextPath: File.Name description: The report file name. type: string - contextPath: File.EntryID description: Report file ID in Demisto. type: string - contextPath: File.Size description: The report size. type: number - contextPath: File.Type description: The report file type. type: string - contextPath: File.Info description: The report file info. type: string description: Export an archive with THF Polygon report to War Room. - name: polygon-export-pcap arguments: - name: tds_analysis_id required: true description: Analysis ID in THF. outputs: - contextPath: File.Name description: The dump file name. type: string - contextPath: File.EntryID description: The dump file ID in Demisto. type: string - contextPath: File.Size description: The dump file size. type: number - contextPath: File.Type description: The dump file type. type: string - contextPath: File.Info description: The dump file info. description: The command allows you to download a network activity dump in case the file/link is malicious. - name: polygon-export-video arguments: - name: tds_analysis_id required: true description: Analysis ID in THF. outputs: - contextPath: File.Name description: The video file name. type: string - contextPath: File.EntryID description: The video file ID in Demisto. type: string - contextPath: File.Size description: The video file size. type: number - contextPath: File.Type description: The video file type. type: string - contextPath: File.Info description: The video file info. type: string description: The command allows you to download a screen activity video in case the file/link is malicious. - name: file arguments: - name: file required: true description: File hash (MD5, SHA1, SHA256). isArray: true default: true outputs: - contextPath: File.MD5 description: The MD5 hash of the file. type: string - contextPath: File.SHA1 description: The SHA1 hash of the file. type: string - contextPath: File.SHA256 description: The SHA256 hash of the file. type: string - contextPath: File.Malicious.Vendor description: The vendor that reported the file as malicious. type: string - contextPath: File.Malicious.Description description: A description explaining why the file was determined to be malicious. type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: Polygon.Analysis.Score description: Malware score in Polygon. type: number - contextPath: Polygon.Analysis.MD5 description: The MD5 hash of the file. type: string - contextPath: Polygon.Analysis.SHA1 description: The SHA1 hash of the file. type: string - contextPath: Polygon.Analysis.SHA256 description: The SHA256 hash of the file. type: string - contextPath: Polygon.Analysis.Found description: File was found in cloud or not. type: bool - contextPath: Polygon.Analysis.Verdict description: Polygon verdict for file. type: bool - contextPath: Polygon.Analysis.Malware-families description: Malware families. type: string description: Check file reputation. dockerimage: demisto/python3:3.12.13.10116658 runonce: false script: '-' subtype: python3 type: python fromversion: 5.0.0 tests: - No tests (auto formatted)