id: Detonate URL - Cuckoo
version: -1
name: Detonate URL - Cuckoo
description: Detonating URL with Cuckoo
fromversion: "5.0.0"
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: ac486e14-1500-41db-8579-c2acb8b805ef
    type: start
    task:
      id: ac486e14-1500-41db-8579-c2acb8b805ef
      version: -1
      name: ""
      description: starting test
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
  "1":
    id: "1"
    taskid: 470c6166-f089-4486-80c1-2e0ab0d650eb
    type: condition
    task:
      description: Check for active instance
      id: 470c6166-f089-4486-80c1-2e0ab0d650eb
      version: -1
      name: Is there any active Cuckoo instance?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cuckoo Sandbox
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
  "2":
    id: "2"
    taskid: 1e9c332f-bfcc-4323-899c-c29476110b53
    type: condition
    task:
      description: Check for URL
      id: 1e9c332f-bfcc-4323-899c-c29476110b53
      version: -1
      name: Is there a URL?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
  "3":
    id: "3"
    taskid: 1ee9c8d9-b62b-4e27-858f-ae9735ddb857
    type: regular
    task:
      description: create task from url
      id: 1ee9c8d9-b62b-4e27-858f-ae9735ddb857
      version: -1
      name: Send URL to Cuckoo
      script: '|||cuckoo-create-task-from-url'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      url:
        simple: ${inputs.URL}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
  "4":
    id: "4"
    taskid: 9ad01520-9f27-44be-8a20-2caa2ce4b1c4
    type: playbook
    task:
      id: 9ad01520-9f27-44be-8a20-2caa2ce4b1c4
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      Ids:
        simple: ${Cuckoo.Task.ID}
      Interval:
        simple: ${inputs.interval}
      PollingCommandArgName:
        simple: id
      PollingCommandName:
        simple: cuckoo-view-task
      Timeout:
        simple: ${inputs.timeout}
      dt:
        simple: Cuckoo.Task(val.CompletedOn == null).ID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1070
        }
      }
    note: false
  "6":
    id: "6"
    taskid: bee9857d-c4a9-4e9f-8939-822514c68078
    type: title
    task:
      description: "-"
      id: bee9857d-c4a9-4e9f-8939-822514c68078
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1245
        }
      }
    note: false
  "7":
    id: "7"
    taskid: 244fc667-b769-4232-809c-424cf5d174f0
    type: regular
    task:
      description: get task report
      id: 244fc667-b769-4232-809c-424cf5d174f0
      version: -1
      name: Get task report
      script: '|||cuckoo-get-task-report'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      id:
        simple: ${Cuckoo.Task.ID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1245
        }
      }
    note: false
  "8":
    id: "8"
    taskid: f9d3406d-4b34-44e7-88eb-b2523f8e0897
    type: regular
    task:
      description: sleep
      id: f9d3406d-4b34-44e7-88eb-b2523f8e0897
      version: -1
      name: Sleep (let the sandbox create the task)
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      seconds:
        simple: "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
  "9":
    id: "9"
    taskid: 666d7185-d292-42cf-8d42-882e5f80c0d8
    type: regular
    task:
      description: view task
      id: 666d7185-d292-42cf-8d42-882e5f80c0d8
      version: -1
      name: View task
      script: '|||cuckoo-view-task'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      id:
        simple: ${Cuckoo.Task.ID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 895
        }
      }
    note: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1435,
        "width": 605,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: false
  description: URL to detonate
- key: interval
  value:
    simple: "1"
  required: false
  description: How often to poll for results
- key: timeout
  value:
    simple: "10"
  required: false
  description: How long to wait before giving up waiting for results
outputs:
- contextPath: Cuckoo.Task.Category
  description: Category of task
- contextPath: Cuckoo.Task.Machine
  description: Machine of task
- contextPath: Cuckoo.Task.Errors
  description: Errors of task
- contextPath: Cuckoo.Task.Traget
  description: Traget of task
- contextPath: Cuckoo.Task.Package
  description: Package of task
- contextPath: Cuckoo.Task.SampleID
  description: Sample ID of task
- contextPath: Cuckoo.Task.Guest
  description: Task guest
- contextPath: Cuckoo.Task.Custom
  description: Custom values of task
- contextPath: Cuckoo.Task.Owner
  description: Task owner
- contextPath: Cuckoo.Task.Priority
  description: Priority of task
- contextPath: Cuckoo.Task.Platform
  description: Platform of task
- contextPath: Cuckoo.Task.Options
  description: Task options
- contextPath: Cuckoo.Task.Status
  description: Task status
- contextPath: Cuckoo.Task.EnforceTimeout
  description: Is timeout of task enforced
- contextPath: Cuckoo.Task.Timeout
  description: Task timeout
- contextPath: Cuckoo.Task.Memory
  description: Task memory
- contextPath: Cuckoo.Task.Tags
  description: Task tags
- contextPath: Cuckoo.Task.ID
  description: ID of task
- contextPath: Cuckoo.Task.AddedOn
  description: Date on which the task was added
- contextPath: Cuckoo.Task.CompletedOn
  description: Date on which the task was completed
- contextPath: Cuckoo.Task.Score
  description: Reported score of the the task
- contextPath: Cuckoo.Task.Monitor
  description: Monitor of the reported task
tests:
- CuckooTest