id: Detonate File - ThreatGrid v2 version: -1 name: Detonate File - ThreatGrid v2 starttaskid: "0" tasks: "0": id: "0" taskid: f850e557-f46a-44e6-87f6-e63960e54b3c type: start task: id: f850e557-f46a-44e6-87f6-e63960e54b3c description: start version: -1 name: "" iscommand: false brand: "" nexttasks: '#none#': - "1" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "1": id: "1" taskid: 1ce459a4-b6cb-4ce1-8189-8011ab82305b type: condition task: id: 1ce459a4-b6cb-4ce1-8189-8011ab82305b description: condition version: -1 name: Is ThreatGrid enabled? type: condition iscommand: false brand: "" nexttasks: '#default#': - "3" "yes": - "2" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: containsString left: value: simple: modules.brand iscontext: true right: value: simple: ThreatGridv2 - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 50, "y": 195 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: 60aa8fdc-d576-4409-8df6-27876aa6a064 type: condition task: id: 60aa8fdc-d576-4409-8df6-27876aa6a064 description: condition version: -1 name: Is there a file to detonate? type: condition iscommand: false brand: "" nexttasks: '#default#': - "3" "yes": - "7" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: simple: inputs.File iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 162.5, "y": 370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: ce5638fa-87ef-4436-8286-910e797bce62 type: title task: id: ce5638fa-87ef-4436-8286-910e797bce62 description: title version: -1 name: Done type: title iscommand: false brand: "" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 1245 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: 0f9a53c1-0acf-4957-8722-d43505a392ec type: condition task: id: 0f9a53c1-0acf-4957-8722-d43505a392ec version: -1 name: Is the file type supported? description: Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned. type: condition iscommand: false brand: "" nexttasks: '#default#': - "3" "yes": - "8" separatecontext: false conditions: - label: "yes" condition: - - operator: match left: value: simple: File.Type iscontext: true right: value: simple: .*(?:EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b ignorecase: true - operator: match left: value: simple: File.Extension iscontext: true right: value: simple: .*(?:EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b ignorecase: true - operator: match left: value: simple: File.Info iscontext: true right: value: simple: .*(?:EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 275, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: e4859d43-1c66-4c82-8b80-928a72c6e94f type: regular task: id: e4859d43-1c66-4c82-8b80-928a72c6e94f version: -1 name: ThreatGrid Upload File description: Submits a sample to threat grid for analysis. URL or file, not both. script: '|||threat-grid-sample-upload' type: regular iscommand: true brand: "" nexttasks: '#none#': - "3" scriptarguments: file_id: simple: ${File.EntryID} interval_in_seconds: simple: ${inputs.interval} timeout_in_seconds: simple: ${inputs.timeout} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 275, "y": 1070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: e47c11b0-6f32-4b8c-85a6-ae5612f34b82 type: regular task: id: e47c11b0-6f32-4b8c-85a6-ae5612f34b82 version: -1 name: Set file to context description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "4" scriptarguments: key: simple: File value: simple: ${inputs.File} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 275, "y": 545 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: 23811c43-493a-4db8-8450-5a100168958e type: condition task: id: 23811c43-493a-4db8-8450-5a100168958e description: Check if the file size bigger than 0 version: -1 name: Is the file size bigger than 0? type: condition iscommand: false brand: "" nexttasks: '#default#': - "3" "yes": - "6" separatecontext: false conditions: - label: "yes" condition: - - operator: greaterThan left: value: simple: File.Size iscontext: true right: value: simple: "0" continueonerrortype: "" view: |- { "position": { "x": 387.5, "y": 895 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 1260, "width": 717.5, "x": 50, "y": 50 } } } inputs: - key: File value: complex: root: File required: false description: File object of the file to detonate. playbookInputQuery: null - key: timeout value: simple: "60" required: false description: Indicates the time in seconds until the polling sequence times out. Default is 60. playbookInputQuery: null - key: interval value: simple: "10" required: false description: Indicates the time in seconds to wait between command execution when 'polling' argument is true. Minimum value is 10 seconds. Default is 10. playbookInputQuery: null outputs: - contextPath: File.Type description: File type e.g. "PE" type: string - contextPath: File.Size description: File Size type: number - contextPath: File.Extension description: File Extension type: string quiet: true fromversion: 5.0.0 description: Detonate one or more files using the ThreatGrid integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM tests: - Detonate File - Generic Test contentitemexportablefields: contentitemfields: propagationLabels: - all