id: Detonate File - BitDam
version: -1
name: Detonate File - BitDam
fromversion: 5.0.0
description: |-
  Detonates one or more files using BitDam integration.
  Returns verdict to the War Room and file reputations to the context data.
  Supported file types are mainly PDF & microsoft office software/
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: cf22dcbc-af9c-42fa-8963-205d412e6965
    type: start
    task:
      id: cf22dcbc-af9c-42fa-8963-205d412e6965
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
  "2":
    id: "2"
    taskid: 19ace356-7eb1-491e-8b42-9d755950312c
    type: playbook
    task:
      id: 19ace356-7eb1-491e-8b42-9d755950312c
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Ids:
        complex:
          root: BitDam
          accessor: FileScan.SHA1
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: idValue
      PollingCommandName:
        simple: bitdam-get-verdict
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: BitDam.Analysis(val.Status !== 'DONE').ID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
  "5":
    id: "5"
    taskid: aa6d7b50-e89e-4046-8245-91d4e430544d
    type: title
    task:
      id: aa6d7b50-e89e-4046-8245-91d4e430544d
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
  "6":
    id: "6"
    taskid: 840243b7-07df-471e-8cab-7dc8080ce28c
    type: condition
    task:
      id: 840243b7-07df-471e-8cab-7dc8080ce28c
      version: -1
      name: Is there a File to scan?
      description: Look for files to detonate
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.File
                accessor: EntryID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
  "7":
    id: "7"
    taskid: 03079660-b680-41d1-847d-4d667e3bc404
    type: condition
    task:
      id: 03079660-b680-41d1-847d-4d667e3bc404
      version: -1
      name: Is BitDam enabled?
      description: Check if integration instance is enabled
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: BitDam
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
  "8":
    id: "8"
    taskid: 2610cf49-d119-4065-861c-c7b3a5ffd0c8
    type: regular
    task:
      id: 2610cf49-d119-4065-861c-c7b3a5ffd0c8
      version: -1
      name: BitDam Get Verdict
      description: '-'
      script: '|||bitdam-get-verdict'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      idType: {}
      idValue:
        simple: ${BitDam.FileScan.SHA1}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
  "9":
    id: "9"
    taskid: 5f4539b9-bf85-42e5-8892-f12714a02869
    type: regular
    task:
      id: 5f4539b9-bf85-42e5-8892-f12714a02869
      version: -1
      name: Set file to context
      description: ""
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      append: {}
      key:
        simple: File
      value:
        complex:
          root: inputs.File
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
  "10":
    id: "10"
    taskid: 699619cb-33c2-4b32-88ef-ba0844c2cddf
    type: condition
    task:
      id: 699619cb-33c2-4b32-88ef-ba0844c2cddf
      version: -1
      name: Is File type supported?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                filters:
                - - operator: match
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:PDF|DOT|DOCX|DOCM|DOTX|DOTM|RTF|XLS|XLT|XLSX|XLSM|XLTX|XLTM|XLSB|XLAM|CSV|PPT|PPTX|PPTM|POTX|POTM|PPAM|PPSX|PPSM|PPS)\b
                    ignorecase: true
                  - operator: match
                    left:
                      value:
                        simple: File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:PDF|DOT|DOCX|DOCM|DOTX|DOTM|RTF|XLS|XLT|XLSX|XLSM|XLTX|XLTM|XLSB|XLAM|CSV|PPT|PPTX|PPTM|POTX|POTM|PPAM|PPSX|PPSM|PPS)\b
                    ignorecase: true
                  - operator: match
                    left:
                      value:
                        simple: File.Info
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:PDF|DOT|DOCX|DOCM|DOTX|DOTM|RTF|XLS|XLT|XLSX|XLSM|XLTX|XLTM|XLSB|XLAM|CSV|PPT|PPTX|PPTM|POTX|POTM|PPAM|PPSX|PPSM|PPS)\b
                    ignorecase: true
                accessor: EntryID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
  "12":
    id: "12"
    taskid: 5e010413-b8e7-4562-8fc6-cddc2168851f
    type: regular
    task:
      id: 5e010413-b8e7-4562-8fc6-cddc2168851f
      version: -1
      name: BItDam Upload File
      description: Upload a file sample to BitDam's service
      script: '|||bitdam-upload-file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      entryId:
        complex:
          root: inputs.File
          filters:
          - - operator: match
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: .*(?:PDF|DOT|DOCX|DOCM|DOTX|DOTM|RTF|XLS|XLT|XLSX|XLSM|XLTX|XLTM|XLSB|XLAM|CSV|PPT|PPTX|PPTM|POTX|POTM|PPAM|PPSX|PPSM|PPS)\b
              ignorecase: true
            - operator: match
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: .*(?:PDF|DOT|DOCX|DOCM|DOTX|DOTM|RTF|XLS|XLT|XLSX|XLSM|XLTX|XLTM|XLSB|XLAM|CSV|PPT|PPTX|PPTM|POTX|POTM|PPAM|PPSX|PPSM|PPS)\b
              ignorecase: true
            - operator: match
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: .*(?:PDF|DOT|DOCX|DOCM|DOTX|DOTM|RTF|XLS|XLT|XLSX|XLSM|XLTX|XLTM|XLSB|XLAM|CSV|PPT|PPTX|PPTM|POTX|POTM|PPAM|PPSX|PPSM|PPS)\b
              ignorecase: true
          accessor: EntryID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
view: |-
  {
    "linkLabelsPosition": {
      "10_12_yes": 0.89
    },
    "paper": {
      "dimensions": {
        "height": 1435,
        "width": 717.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: File object of the file to detonate. The File is taken from the context.
- key: Interval
  value:
    simple: "1"
  required: false
  description: Duration for executing the pooling (in minutes)
- key: Timeout
  value:
    simple: "10"
  required: false
  description: The duration after which to stop pooling and to resume the playbook (in minutes)
outputs:
- contextPath: BitDam.Analysis.ID
  description: Sample ID
  type: string
- contextPath: DBotScore.Vendor
  description: 'The name of the vendor: BitDam'
  type: string
- contextPath: BitDam.Analysis.Verdict
  description: Analysis Verdict
  type: string
- contextPath: BitDam.Analysis.Status
  description: Analysis Status
  type: string
- contextPath: DBotScore.Indicator
  description: The name of the sample file or URL
- contextPath: DBotScore.Type
  description: '''file'' for file samples'
  type: string
- contextPath: DBotScore.Score
  description: The actual score
  type: number
tests:
- Detonate File - BitDam Test