id: Detonate Remote File from URL - McAfee ATD version: -1 fromversion: 5.0.0 name: Detonate Remote File from URL - McAfee ATD description: Detonates a File from a URL using the McAfee Advanced Threat Defense sandbox integration. starttaskid: "0" tasks: "0": id: "0" taskid: f2c37122-75bb-4405-80c6-34e8e972d224 type: start task: id: f2c37122-75bb-4405-80c6-34e8e972d224 version: -1 name: "" description: start iscommand: false brand: "" nexttasks: '#none#': - "9" separatecontext: false view: |- { "position": { "x": 50, "y": 50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "1": id: "1" taskid: 6c62dcdb-e814-4ecb-8449-e6d02cfad409 type: regular task: id: 6c62dcdb-e814-4ecb-8449-e6d02cfad409 version: -1 name: McAfee ATD Upload a File from a URL description: Uploads the submission to McAfee ATD. script: '|||atd-file-upload' type: regular iscommand: true brand: "" nexttasks: '#none#': - "8" scriptarguments: analyzeAgain: {} dstIp: {} entryID: {} fileName: {} filePriorityQ: {} messageId: {} skipTaskId: {} srcIp: {} submitType: simple: "3" url: complex: root: inputs.URL vmProfileList: {} xMode: {} separatecontext: false view: |- { "position": { "x": 275, "y": 545 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "2": id: "2" taskid: 2af60cef-ae8f-45d0-88b6-ce81c990523c type: playbook task: id: 2af60cef-ae8f-45d0-88b6-ce81c990523c version: -1 name: GenericPolling description: |- Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete. This playbook implements polling by continuously running the command in Step \#2 until the operation completes. The remote action should have the following structure: 1. Initiate the operation. 2. Poll to check if the operation completed. 3. (optional) Get the results of the operation. playbookName: GenericPolling type: playbook iscommand: false brand: "" nexttasks: '#none#': - "10" scriptarguments: Ids: complex: root: ATD filters: - - operator: isNotEqualNumber left: value: simple: ATD.Task.taskId iscontext: true right: value: simple: "-1" accessor: Task transformers: - operator: getField args: field: value: simple: taskId Interval: complex: root: inputs.Interval PollingCommandArgName: simple: taskId PollingCommandName: simple: atd-check-status Timeout: complex: root: inputs.Timeout dt: simple: ATD.Task(val.status != 'Completed').taskId separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 162.5, "y": 895 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "3": id: "3" taskid: 61a895d1-e4d7-4c3a-8adc-83f6ee88f040 type: regular task: id: 61a895d1-e4d7-4c3a-8adc-83f6ee88f040 version: -1 name: McAfee ATD Get Report description: Retrieve the reports from McAfee ATD. script: '|||atd-get-report' type: regular iscommand: true brand: "" nexttasks: '#none#': - "6" scriptarguments: jobId: {} taskId: complex: root: ATDTask filters: - - operator: isEqualString left: value: simple: ATDTask.status iscontext: true right: value: simple: Completed transformers: - operator: getField args: field: value: simple: taskId threshold: {} type: simple: pdf separatecontext: false view: |- { "position": { "x": 162.5, "y": 1420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "5": id: "5" taskid: 06c9ca27-cfbc-41ab-805d-2091a2b9e210 type: condition task: id: 06c9ca27-cfbc-41ab-805d-2091a2b9e210 version: -1 name: Is there a URL to detonate? description: Checks that there is a URL in the playbook’s input. type: condition iscommand: false brand: "" nexttasks: '#default#': - "6" "yes": - "1" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: simple: inputs.URL iscontext: true view: |- { "position": { "x": 162.5, "y": 370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "6": id: "6" taskid: b09656f6-45b8-4a84-872b-4f5b6c727291 type: title task: id: b09656f6-45b8-4a84-872b-4f5b6c727291 version: -1 name: Done description: Done type: title iscommand: false brand: "" separatecontext: false view: |- { "position": { "x": 50, "y": 1595 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "8": id: "8" taskid: 4527bfbf-19ea-4c54-87e2-ccee19d7703d type: condition task: id: 4527bfbf-19ea-4c54-87e2-ccee19d7703d version: -1 name: Filter taskId description: Checks that valid URLs only have been sent to detonation. type: condition iscommand: false brand: "" nexttasks: '#default#': - "6" "yes": - "2" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: ATD filters: - - operator: isNotEqualNumber left: value: simple: ATD.Task.taskId iscontext: true right: value: simple: "-1" accessor: Task transformers: - operator: getField args: field: value: simple: taskId iscontext: true view: |- { "position": { "x": 275, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "9": id: "9" taskid: 0e48dfeb-7b4f-4c39-8a77-610c2cbb8345 type: condition task: id: 0e48dfeb-7b4f-4c39-8a77-610c2cbb8345 version: -1 name: Is McAfee ATD sandbox enabled? description: | Verify that there is a valid instance of McAfee ATD enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "6" "yes": - "5" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: McAfee Advanced Threat Defense - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true view: |- { "position": { "x": 50, "y": 195 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "10": id: "10" taskid: aafb15d2-bf2e-481a-8b3b-9e90f2c92d97 type: regular task: id: aafb15d2-bf2e-481a-8b3b-9e90f2c92d97 version: -1 name: atd-check-status description: Updates the status of the tasks in the context. script: '|||atd-check-status' type: regular iscommand: true brand: "" nexttasks: '#none#': - "11" scriptarguments: jobId: {} taskId: complex: root: ATD filters: - - operator: isNotEqualNumber left: value: simple: ATD.Task.taskId iscontext: true right: value: simple: "-1" accessor: Task.taskId separatecontext: false view: |- { "position": { "x": 162.5, "y": 1070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "11": id: "11" taskid: a28f0313-4932-4d47-8dbf-bcbf98c11fdc type: regular task: id: a28f0313-4932-4d47-8dbf-bcbf98c11fdc version: -1 name: Set Context description: '-' scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: append: {} key: simple: ATDTask value: complex: root: ATD filters: - - operator: isNotEqualNumber left: value: simple: ATD.Task.taskId iscontext: true right: value: simple: "-1" accessor: Task separatecontext: false view: |- { "position": { "x": 162.5, "y": 1245 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 view: |- { "linkLabelsPosition": { "8_2_yes": 0.57 }, "paper": { "dimensions": { "height": 1610, "width": 605, "x": 50, "y": 50 } } } inputs: - key: URL value: complex: root: URL accessor: Data required: false description: URL to detonate. playbookInputQuery: null - key: Interval value: simple: "1" required: false description: Polling frequency - how often the polling command should run (minutes) playbookInputQuery: null - key: Timeout value: simple: "15" required: false description: How much time to wait before a timeout occurs (minutes) playbookInputQuery: null outputs: - contextPath: ATD.Task.taskId description: The task ID of the sample uploaded type: string - contextPath: ATD.Task.jobId description: The job ID of the sample uploaded type: string - contextPath: ATD.Task.messageId description: The message Id relevant to the sample uploaded type: string - contextPath: ATD.Task.url description: The URL detonated type: string - contextPath: ATD.Task.srcIp description: Source IPv4 address type: string - contextPath: ATD.Task.destIp description: Destination IPv4 address type: string - contextPath: ATD.Task.MD5 description: MD5 of the sample uploaded type: string - contextPath: ATD.Task.SHA1 description: SHA1 of the sample uploaded type: string - contextPath: ATD.Task.SHA256 description: SHA256 of the sample uploaded type: string - contextPath: File.Name description: Filename (only in case of report type=json) type: string - contextPath: File.Type description: File type e.g. "PE" (only in case of report type=json) type: string - contextPath: File.MD5 description: MD5 hash of the file (only in case of report type=json) type: string - contextPath: File.SHA1 description: SHA1 hash of the file (only in case of report type=json) type: string - contextPath: File.SHA256 description: SHA256 hash of the file (only in case of report type=json) type: string - contextPath: File.EntryID description: The Entry ID of the sample type: string - contextPath: DBotScore.Indicator description: The indicator we tested (only in case of report type=json) type: string - contextPath: DBotScore.Type description: The type of the indicator (only in case of report type=json) type: string - contextPath: DBotScore.Vendor description: Vendor used to calculate the score (only in case of report type=json) type: string - contextPath: DBotScore.Score description: The actual score (only in case of report type=json) type: number - contextPath: IP.Address description: IP's relevant to the sample type: string - contextPath: InfoFile.EntryID description: The EntryID of the report file type: string - contextPath: InfoFile.Extension description: The extension of the report file type: string - contextPath: InfoFile.Name description: The name of the report file type: string - contextPath: InfoFile.Info description: The info of the report file type: string - contextPath: InfoFile.Size description: The size of the report file type: number - contextPath: InfoFile.Type description: The type of the report file type: string - contextPath: File description: File object type: unknown - contextPath: File.Malicious description: File Malicious object type: unknown - contextPath: DBotScore description: DBotScore object type: unknown - contextPath: InfoFile description: Report file object type: unknown - contextPath: URL.Malicious description: URL Malicious object type: unknown tests: - Test Playbook McAfee ATD - Detonate URL - Generic Test