id: 79b5d8a6-2636-480c-8e1c-a3ab2e58ffb5
version: -1
name: Detonate File - VMRay
description: Detonates a file with VMRay.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: c1de2f2b-64cb-4df5-8490-07c49e7255b6
    type: start
    task:
      id: c1de2f2b-64cb-4df5-8490-07c49e7255b6
      version: -1
      name: ""
      description: start
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 7421a2fc-d22a-41f9-8876-e7735d25ea6b
    type: playbook
    task:
      id: 7421a2fc-d22a-41f9-8876-e7735d25ea6b
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Ids:
        simple: ${VMRay.Submission.SubmissionID}
      Interval:
        simple: ${inputs.interval}
      PollingCommandArgName:
        simple: submission_id
      PollingCommandName:
        simple: vmray-get-submission
      Timeout:
        simple: ${inputs.timeout}
      dt:
        simple: VMRay.Submission(val.IsFinished == false).SubmissionID
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 087ea815-c0b4-4604-8b43-099927639fa9
    type: condition
    task:
      id: 087ea815-c0b4-4604-8b43-099927639fa9
      version: -1
      name: Is there any file to detonate?
      description: Check if file exist
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.File
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 46c971ef-9691-4b18-888b-a8fccf7b8c7c
    type: regular
    task:
      id: 46c971ef-9691-4b18-888b-a8fccf7b8c7c
      version: -1
      name: Send file to VMRay
      description: Submit sample to VMRay
      script: '|||vmray-upload-sample'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      entry_id:
        simple: ${inputs.File.EntryID}
      file_id:
        simple: ${File.EntryID}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: b5eb756b-903d-4f8e-8b09-f8bcad28627c
    type: title
    task:
      id: b5eb756b-903d-4f8e-8b09-f8bcad28627c
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 130,
          "y": 2760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 2a0709fc-42f1-4ac8-80ef-aa53b3b65576
    type: regular
    task:
      id: 2a0709fc-42f1-4ac8-80ef-aa53b3b65576
      version: -1
      name: Get sample
      description: get sample by sample id
      script: '|||vmray-get-sample'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      sample_id:
        complex:
          root: VMRay.Submission
          accessor: SampleID
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: ca3caa5c-0828-41e1-8b12-77771fdaf140
    type: regular
    task:
      id: ca3caa5c-0828-41e1-8b12-77771fdaf140
      version: -1
      name: Get submission
      description: Gets a submission result
      script: '|||vmray-get-submission'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      submission_id:
        complex:
          root: VMRay.Submission
          accessor: SubmissionID
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 1735cc5d-e223-47ea-8905-51616bed94f1
    type: regular
    task:
      id: 1735cc5d-e223-47ea-8905-51616bed94f1
      version: -1
      name: Get analysis
      description: Retrieves all analysis details for a specified sample.
      script: '|||vmray-get-analysis-by-sample'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      sample_id:
        complex:
          root: VMRay
          accessor: Sample.SampleID
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: d9177a3a-b705-45af-8b42-7ee487c17eda
    type: condition
    task:
      id: d9177a3a-b705-45af-8b42-7ee487c17eda
      version: -1
      name: Is sample suspicious or malicious?
      description: check term
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: VMRay.Sample
                accessor: Verdict
            iscontext: true
          right:
            value: {}
        - operator: isExists
          left:
            value:
              complex:
                root: VMRay.Sample
                accessor: Verdict
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: c935d709-7974-4075-85a5-13e24aa25cdd
    type: regular
    task:
      id: c935d709-7974-4075-85a5-13e24aa25cdd
      version: -1
      name: Get IOCs
      description: Retrieves Indicators of Compromise for a specified sample.
      script: '|||vmray-get-iocs'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      sample_id:
        complex:
          root: VMRay
          accessor: Analysis.SampleID
          transformers:
          - operator: uniq
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: ${VMRay.Sample.SampleID}
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 542.5,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 1ed93841-acec-451d-8c9b-ef42d1f75548
    type: regular
    task:
      id: 1ed93841-acec-451d-8c9b-ef42d1f75548
      version: -1
      name: Get Threat Indicators
      description: Retrieves threat indicators (VTI).
      script: '|||vmray-get-threat-indicators'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      sample_id:
        complex:
          root: VMRay
          accessor: Analysis.SampleID
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: ${VMRay.Sample.SampleID}
                iscontext: true
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 542.5,
          "y": 1760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: e01bcec4-aae2-4845-823c-82ef27b884d7
    type: condition
    task:
      id: e01bcec4-aae2-4845-823c-82ef27b884d7
      version: -1
      name: Is there an active VMRay instance?
      description: Returns 'yes' if integration brand is available. Otherwise returns
        'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "4"
    scriptarguments:
      brandname:
        simple: vmray
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 9ad67e3a-c815-4e79-842c-ea509d293e1e
    type: condition
    task:
      id: 9ad67e3a-c815-4e79-842c-ea509d293e1e
      version: -1
      name: Is there a child submission?
      description: Returns "yes" if a child submission is available
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "17"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: VMRay.Sample.ChildSampleIDs
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 542.5,
          "y": 1960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 33703a1b-05f4-40fa-8131-2393fda81444
    type: regular
    task:
      id: 33703a1b-05f4-40fa-8131-2393fda81444
      version: -1
      name: Get Child IOCs
      description: Retrieves Indicators of Compromise for a specified sample.
      script: '|||vmray-get-iocs'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      sample_id:
        simple: ${VMRay.Sample.ChildSampleIDs}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 780,
          "y": 2170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: b66f9103-83bf-4795-8fec-f050c3f88f0d
    type: regular
    task:
      id: b66f9103-83bf-4795-8fec-f050c3f88f0d
      version: -1
      name: Get Child VTIs
      description: Retrieves Threat Indicators (VTI).
      script: '|||vmray-get-threat-indicators'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      sample_id:
        simple: ${VMRay.Sample.ChildSampleIDs}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 780,
          "y": 2330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "4_6_yes": 0.89
    },
    "paper": {
      "dimensions": {
        "height": 2775,
        "width": 1110,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    simple: ${File}
  required: false
  description: The file to detonate.
  playbookInputQuery: null
- key: interval
  value:
    simple: "1"
  required: false
  description: The frequency in which to poll for results (minutes).
  playbookInputQuery: null
- key: timeout
  value:
    simple: "10"
  required: false
  description: The amount of time to wait before giving up waiting for results (minutes).
  playbookInputQuery: null
outputs:
- contextPath: VMRay.Job.JobID
  description: The ID of a new job.
  type: number
- contextPath: VMRay.Job.SampleID
  description: The ID of sample.
  type: number
- contextPath: VMRay.Job.Created
  description: The timestamp of the created job.
  type: date
- contextPath: VMRay.Job.VMName
  description: The name of virtual machine.
  type: string
- contextPath: VMRay.Job.VMID
  description: The ID of virtual machine.
  type: number
- contextPath: VMRay.Sample.SampleID
  description: The sample ID of the task.
  type: number
- contextPath: VMRay.Sample.Created
  description: The timestamp of the created sample.
  type: date
- contextPath: VMRay.Submission.SubmissionID
  description: The submission ID.
  type: number
- contextPath: VMRay.Submission.HadErrors
  description: Whether there are any errors in the submission.
  type: boolean
- contextPath: VMRay.Submission.IsFinished
  description: The status of submission. Can be, "true" or "false".
  type: boolean
- contextPath: VMRay.Submission.MD5
  description: The MD5 hash of the sample in submission.
  type: string
- contextPath: VMRay.Submission.SHA1
  description: The SHA1 hash of the sample in submission.
  type: string
- contextPath: VMRay.Submission.SHA256
  description: The SHA256 hash of the sample in submission.
  type: string
- contextPath: VMRay.Submission.Verdict
  description: Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
  type: String
- contextPath: VMRay.Submission.VerdictReason
  description: Description of the Verdict Reason.
  type: String
- contextPath: VMRay.Submission.Severity
  description: Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted,
    Unknown). Deprecated.
  type: string
- contextPath: VMRay.Submission.SSDeep
  description: The SSDeep hash of the sample in submission.
  type: string
- contextPath: VMRay.Submission.SampleID
  description: The ID of the sample in submission.
  type: number
- contextPath: VMRay.Sample.FileName
  description: The file name of the sample.
  type: string
- contextPath: VMRay.Sample.MD5
  description: The MD5 hash of the sample.
  type: string
- contextPath: VMRay.Sample.SHA1
  description: The SHA1 hash of the sample.
  type: string
- contextPath: VMRay.Sample.SHA256
  description: The SHA256 hash of the sample.
  type: string
- contextPath: VMRay.Sample.SSDeep
  description: The SSDeep of the sample.
  type: string
- contextPath: VMRay.Sample.Verdict
  description: Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
  type: String
- contextPath: VMRay.Sample.VerdictReason
  description: Description of the Verdict Reason.
  type: String
- contextPath: VMRay.Sample.Severity
  description: Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted,
    Unknown). Deprecated.
  type: string
- contextPath: VMRay.Sample.Type
  description: The file type.
  type: string
- contextPath: VMRay.Sample.Classifications
  description: The classifications of the sample.
  type: string
- contextPath: VMRay.Sample.IOC.URL.AnalysisID
  description: The IDs of the other analyses that contain the given URL.
  type: number
- contextPath: VMRay.Sample.IOC.URL.URL
  description: The URL.
- contextPath: VMRay.Sample.IOC.URL.Operation
  description: The operation of the specified URL.
- contextPath: VMRay.Sample.IOC.URL.ID
  description: The ID of the URL.
- contextPath: VMRay.Sample.IOC.URL.Type
  description: The type of the URL.
- contextPath: VMRay.Sample.IOC.Domain.AnalysisID
  description: The IDs of the other analyses that contain the given domain.
- contextPath: VMRay.Sample.IOC.Domain.Domain
  description: The domain.
- contextPath: VMRay.Sample.IOC.Domain.ID
  description: The ID of the domain.
- contextPath: VMRay.Sample.IOC.Domain.Type
  description: The type of the domain.
- contextPath: VMRay.Sample.IOC.IP.AnalysisID
  description: The IDs of the other analyses that contain the given IP address.
- contextPath: VMRay.Sample.IOC.IP.IP
  description: The IP address.
- contextPath: VMRay.Sample.IOC.IP.Operation
  description: The operation of the given IP address.
- contextPath: VMRay.Sample.IOC.IP.ID
  description: The ID of the IP address.
- contextPath: VMRay.Sample.IOC.IP.Type
  description: The type of the IP address.
- contextPath: VMRay.Sample.IOC.Mutex.AnalysisID
  description: The IDs of other analyses that contain the given IP address.
- contextPath: VMRay.Sample.IOC.Mutex.Name
  description: The name of the mutex.
- contextPath: VMRay.Sample.IOC.Mutex.Operation
  description: The operation of the given mutex
- contextPath: VMRay.Sample.IOC.Mutex.ID
  description: The ID of the mutex.
- contextPath: VMRay.Sample.IOC.Mutex.Type
  description: The type of the mutex.
- contextPath: VMRay.Sample.IOC.File.AnalysisID
  description: The IDs of other analyses that contain the given file.
- contextPath: VMRay.Sample.IOC.File.Name
  description: The name of the file.
- contextPath: VMRay.Sample.IOC.File.Operation
  description: The operation of the given file.
- contextPath: VMRay.Sample.IOC.File.ID
  description: The ID of the file.
- contextPath: VMRay.Sample.IOC.File.Type
  description: The type of the file.
- contextPath: VMRay.Sample.IOC.File.Hashes.MD5
  description: The MD5 hash of the given file.
- contextPath: VMRay.Sample.IOC.File.Hashes.SSDeep
  description: The SSDeep hash of the given file.
- contextPath: VMRay.Sample.IOC.File.Hashes.SHA256
  description: The SHA256 hash of the given file.
- contextPath: VMRay.Sample.IOC.File.Hashes.SHA1
  description: The SHA1 hash of the given file.
- contextPath: VMRay.ThreatIndicator.AnalysisID
  description: The list of connected analysis IDs.
- contextPath: VMRay.ThreatIndicator.Category
  description: The category of threat indicators.
- contextPath: VMRay.ThreatIndicator.Classification
  description: The classifications of threat indicators.
- contextPath: VMRay.ThreatIndicator.ID
  description: The ID of the threat indicator.
- contextPath: VMRay.ThreatIndicator.Operation
  description: The operation that caused the indicators.
fromversion: 5.0.0
tests:
- VMRay-Test-File