id: Convert file hash to corresponding hashes
version: -1
fromversion: 5.0.0
name: Convert file hash to corresponding hashes
description: |
  The playbook enables you to get all of the corresponding file hashes for a file even if there is only one hash type available.
  For example, if we have only the SHA256 hash, the playbook will get the SHA1 and MD5 hashes as long as the
  original searched hash is recognized by any our the threat intelligence integrations.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f3d44d02-1482-4dd0-8055-34128346e4ec
    type: start
    task:
      id: f3d44d02-1482-4dd0-8055-34128346e4ec
      version: -1
      name: ""
      description: Start
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
      - "36"
      - "37"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 520,
          "y": -100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: d0c581d2-789c-4a12-8940-37f17a47b4f6
    type: title
    task:
      id: d0c581d2-789c-4a12-8940-37f17a47b4f6
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 530,
          "y": 950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: b797fdc7-1704-442a-8605-ee06bfb0bf54
    type: condition
    task:
      id: b797fdc7-1704-442a-8605-ee06bfb0bf54
      version: -1
      name: Does SHA256 hash exist?
      description: Does SHA256 hash exist?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "44"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1080,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: f7142eb2-9483-4546-8d07-a828d636d0ad
    type: condition
    task:
      id: f7142eb2-9483-4546-8d07-a828d636d0ad
      version: -1
      name: Does MD5 hash exist?
      description: Does MD5 hash exist?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "46"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.MD5
            iscontext: true
    view: |-
      {
        "position": {
          "x": -40,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: eff5d9b7-ea36-4310-8650-5e26fa38209e
    type: condition
    task:
      id: eff5d9b7-ea36-4310-8650-5e26fa38209e
      version: -1
      name: Does SHA1 hash exist?
      description: Does SHA1 hash exist?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "45"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SHA1
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 520,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 65ff1c51-6bc1-4171-8bde-eb6ecb862f4e
    type: regular
    task:
      id: 65ff1c51-6bc1-4171-8bde-eb6ecb862f4e
      version: -1
      name: Get hashes by SHA1
      description: Uses the SHA1 hash as a reference to check for other corresponding hashes of the same file.
      script: '|||file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      file:
        complex:
          root: inputs.SHA1
    reputationcalc: 2
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 300,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 9e3c8b51-dbc6-464a-8af7-f5d43b663bd4
    type: regular
    task:
      id: 9e3c8b51-dbc6-464a-8af7-f5d43b663bd4
      version: -1
      name: Get hashes by MD5
      description: Uses the MD5 hash as a reference to check for other corresponding hashes of the same file.
      script: '|||file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      confidenceThreshold: {}
      file:
        complex:
          root: inputs.MD5
    reputationcalc: 2
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -550,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 29ef7703-de75-4ff3-844c-a852e333bdbe
    type: regular
    task:
      id: 29ef7703-de75-4ff3-844c-a852e333bdbe
      version: -1
      name: Get Hashes by SHA256
      description: Uses the SHA256 hash as a reference to check for other corresponding hashes of the same file.
      script: '|||file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      confidenceThreshold: {}
      file:
        complex:
          root: inputs.SHA256
    reputationcalc: 2
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1180,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: fdfd1cd9-3095-455b-8481-072b140ee5de
    type: title
    task:
      id: fdfd1cd9-3095-455b-8481-072b140ee5de
      version: -1
      name: MD5
      description: MD5
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -40,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: a75bc19c-d514-44ab-885d-fb6664dd0b29
    type: title
    task:
      id: a75bc19c-d514-44ab-885d-fb6664dd0b29
      version: -1
      name: SHA1
      description: SHA1
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 520,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: a2d56e80-d468-46a0-891d-3792a6bf0bd9
    type: title
    task:
      id: a2d56e80-d468-46a0-891d-3792a6bf0bd9
      version: -1
      name: SHA256
      description: SHA256
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1080,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 336d7e69-334b-490c-81c4-4b48788a56be
    type: condition
    task:
      id: 336d7e69-334b-490c-81c4-4b48788a56be
      version: -1
      name: Have the hashes been retrieved?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "18"
      "yes":
      - "40"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: foundIndicators.value
            iscontext: true
          right:
            value: {}
      - - operator: stringHasLength
          left:
            value:
              complex:
                root: foundIndicators
                accessor: value
            iscontext: true
          right:
            value:
              simple: "64"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1350,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 4cbe3c2a-dc3d-46fc-8b6a-b589accfdba3
    type: regular
    task:
      id: 4cbe3c2a-dc3d-46fc-8b6a-b589accfdba3
      version: -1
      name: Enrich indicators
      description: commands.local.cmd.enrich.indicators
      script: Builtin|||enrichIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      indicatorsValues:
        complex:
          root: foundIndicators
          accessor: value
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1600,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: b27dc11a-1b9f-4056-8288-776eaa57bd63
    type: regular
    task:
      id: b27dc11a-1b9f-4056-8288-776eaa57bd63
      version: -1
      name: Search indicators
      description: |-
        Searches Cortex XSOAR indicators.

        Searches for Cortex XSOAR indicators and returns the id, indicator_type, value, and score/verdict.

        You can add additional fields from the indicators using the add_field_to_context argument.
      scriptName: SearchIndicator
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    scriptarguments:
      query:
        simple: value:${inputs.SHA256}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1350,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: 1b49a035-86f4-4e1d-81ac-add593725d88
    type: regular
    task:
      id: 1b49a035-86f4-4e1d-81ac-add593725d88
      version: -1
      name: Search indicators
      description: |-
        Searches Cortex XSOAR indicators.

        Searches for Cortex XSOAR Indicators and returns the id, indicator_type, value, and score/verdict.

        You can add additional fields from the indicators using the add_field_to_context argument.
      scriptName: SearchIndicator
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "47"
    scriptarguments:
      query:
        simple: value:${inputs.SHA1}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 520,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: f9974076-074f-4bf4-82a5-0c804fb7875b
    type: regular
    task:
      id: f9974076-074f-4bf4-82a5-0c804fb7875b
      version: -1
      name: Search indicators
      description: |-
        Searches Cortex XSOAR indicators.

        Searches for Cortex XSOAR Indicators and returns the id, indicator_type, value, and score/verdict.

        You can add additional fields from the indicators using the add_field_to_context argument.
      scriptName: SearchIndicator
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      query:
        simple: value:${inputs.MD5}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: 0161e3d5-ca7c-4e0e-86d4-f767f1c7b64c
    type: condition
    task:
      id: 0161e3d5-ca7c-4e0e-86d4-f767f1c7b64c
      version: -1
      name: Have the hashes been retrieved?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "15"
      "yes":
      - "49"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: foundIndicators.value
            iscontext: true
          right:
            value: {}
      - - operator: stringHasLength
          left:
            value:
              complex:
                root: foundIndicators
                accessor: value
            iscontext: true
          right:
            value:
              simple: "40"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 520,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: 9fb9988f-d614-4a30-8eb9-09c8a05ad461
    type: condition
    task:
      id: 9fb9988f-d614-4a30-8eb9-09c8a05ad461
      version: -1
      name: Have the hashes been retrieved?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "16"
      "yes":
      - "50"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: foundIndicators.value
            iscontext: true
          right:
            value: {}
      - - operator: stringHasLength
          left:
            value:
              complex:
                root: foundIndicators
                accessor: value
            iscontext: true
          right:
            value:
              simple: "32"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: 620476dc-83d3-40fe-8d2f-8f978fcdfa23
    type: regular
    task:
      id: 620476dc-83d3-40fe-8d2f-8f978fcdfa23
      version: -1
      name: Enrich indicators
      description: commands.local.cmd.enrich.indicators
      script: Builtin|||enrichIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      indicatorsValues:
        complex:
          root: foundIndicators
          accessor: value
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 750,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: e4213b2e-29ba-40d3-8ae3-6deec5436549
    type: regular
    task:
      id: e4213b2e-29ba-40d3-8ae3-6deec5436549
      version: -1
      name: Enrich indicators
      description: commands.local.cmd.enrich.indicators
      script: Builtin|||enrichIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      indicatorsValues:
        complex:
          root: foundIndicators
          accessor: value
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -120,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "10_2_#default#": 0.39,
      "10_45_yes": 0.46,
      "47_15_#default#": 0.44,
      "47_49_yes": 0.41,
      "48_16_#default#": 0.57,
      "48_50_yes": 0.61,
      "4_2_#default#": 0.15,
      "9_2_#default#": 0.19,
      "9_46_yes": 0.51
    },
    "paper": {
      "dimensions": {
        "height": 1115,
        "width": 2530,
        "x": -550,
        "y": -100
      }
    }
  }
inputs:
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
  required: false
  description: The SHA256 hash on which to search.
  playbookInputQuery:
- key: SHA1
  value:
    complex:
      root: File
      accessor: SHA1
  required: false
  description: The SHA1 hash on which to search.
  playbookInputQuery:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: The MD5 hash on which to search.
  playbookInputQuery:
outputs:
- contextPath: File.SHA256
  description: Output for detected SHA256 hash.
  type: string
- contextPath: File.SHA1
  description: Output for detected SHA1 hash.
  type: string
- contextPath: File.MD5
  description: Output for detected MD5 hash.
  type: string
- contextPath: Indicators.Value
  description: Output for detected hashes.
tests:
- Test Convert file hash to corresponding hashes