id: Detonate URL - ThreatStream version: -1 name: Detonate URL - ThreatStream fromversion: 5.0.0 description: |- Detonates one or more URLs using the Anomali ThreatStream sandbox integration. Returns relevant reports to the War Room and URL reputations to the context data. starttaskid: "0" tasks: "0": id: "0" taskid: 8de349d2-da6c-44b0-80fa-9ba905fae572 type: start task: id: 8de349d2-da6c-44b0-80fa-9ba905fae572 version: -1 name: "" description: Start iscommand: false brand: "" nexttasks: '#none#': - "7" separatecontext: false view: |- { "position": { "x": 50, "y": 50 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "1": id: "1" taskid: 80a68b3e-8a7e-43bb-8215-918ecde338b6 type: regular task: id: 80a68b3e-8a7e-43bb-8215-918ecde338b6 version: -1 name: ThreatStream Submit URL for Analysis description: Submits a file or URL to the ThreatStream-hosted Sandbox for detonation. script: '|||threatstream-submit-to-sandbox' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: detail: complex: root: inputs.Tags premium_sandbox: complex: root: inputs.PremiumSandbox report_platform: complex: root: inputs.VM submission_classification: complex: root: inputs.SubmissionClassification submission_type: simple: url submission_value: complex: root: inputs.URL transformers: - operator: uniq separatecontext: false view: |- { "position": { "x": 275, "y": 545 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: 40f7fd76-4554-43f3-8517-7ddb79b601d8 type: playbook task: id: 40f7fd76-4554-43f3-8517-7ddb79b601d8 version: -1 name: GenericPolling description: |- Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete. This playbook implements polling by continuously running the command in Step \#2 until the operation completes. The remote action should have the following structure: 1. Initiate the operation. 2. Poll to check if the operation completed. 3. (optional) Get the results of the operation. playbookName: GenericPolling type: playbook iscommand: false brand: "" nexttasks: '#none#': - "8" scriptarguments: Ids: complex: root: ThreatStream accessor: Analysis.ReportID Interval: complex: root: inputs.Interval PollingCommandArgName: simple: report_id PollingCommandName: simple: threatstream-get-analysis-status Timeout: complex: root: inputs.Timeout dt: simple: ThreatStream.Analysis(val.Status=='processing').ReportID separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 275, "y": 720 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: 4cd6fbcd-1b55-40ed-8dfd-c54be310bccf type: title task: id: 4cd6fbcd-1b55-40ed-8dfd-c54be310bccf version: -1 name: Done description: Done type: title iscommand: false brand: "" separatecontext: false view: |- { "position": { "x": 50, "y": 1070 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: 6788a219-1746-44bf-8dfe-6b5c0ef9f311 type: condition task: id: 6788a219-1746-44bf-8dfe-6b5c0ef9f311 version: -1 name: Is there a URL to detonate? description: Checks if there is at least one URL to detonate. type: condition iscommand: false brand: "" nexttasks: '#default#': - "5" "yes": - "1" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: inputs.URL iscontext: true view: |- { "position": { "x": 160, "y": 370 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: 7fbe1c8e-6a43-4d15-84f1-8ea2b45e0090 type: condition task: id: 7fbe1c8e-6a43-4d15-84f1-8ea2b45e0090 version: -1 name: Is Anomali ThreatStream v2 or v3 enabled? description: Checks if there is an active instance of the Anomali ThreatStream integration enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "5" "yes": - "6" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Anomali ThreatStream v2 - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true right: value: {} - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Anomali ThreatStream v3 - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true view: |- { "position": { "x": 50, "y": 195 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: 253118c5-9d67-4913-861f-04cf558fe1d9 type: regular task: id: 253118c5-9d67-4913-861f-04cf558fe1d9 version: -1 name: ThreatStream Get Report description: Returns a report of the file or URL that was submitted to the sandbox. script: '|||threatstream-analysis-report' type: regular iscommand: true brand: "" nexttasks: '#none#': - "5" scriptarguments: report_id: complex: root: ThreatStream.Analysis accessor: ReportID separatecontext: false view: |- { "position": { "x": 275, "y": 895 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 1085, "width": 605, "x": 50, "y": 50 } } } inputs: - key: URL value: complex: root: URL accessor: Data transformers: - operator: uniq required: false description: URL to detonate. playbookInputQuery: - key: Interval value: simple: "5" required: false description: How often to execute polling (in minutes). playbookInputQuery: - key: Timeout value: simple: "120" required: false description: The duration after which to stop polling and to resume the playbook (in minutes). playbookInputQuery: - key: VM value: {} required: false description: The VM to use (string) playbookInputQuery: - key: SubmissionClassification value: {} required: false description: Classification of the sandbox submission. playbookInputQuery: - key: PremiumSandbox value: {} required: false description: Specifies if the premium sandbox should be used for detonation. playbookInputQuery: - key: Tags value: {} required: false description: A CSV list of tags applied to this sample. playbookInputQuery: outputs: - contextPath: ThreatStream.Analysis.ReportID description: The report ID submitted to the sandbox. type: string - contextPath: ThreatStream.Analysis.Status description: The analysis status. type: string - contextPath: ThreatStream.Analysis.Platform description: The platform of the submission submitted to the sandbox. type: string - contextPath: ThreatStream.Analysis.Category description: The report category. type: string - contextPath: ThreatStream.Analysis.Started description: The detonation start time. type: string - contextPath: ThreatStream.Analysis.Completed description: The detonation completion time. type: string - contextPath: ThreatStream.Analysis.Duration description: The duration of the detonation (in seconds). type: string - contextPath: ThreatStream.Analysis.VmName description: The VM name. type: string - contextPath: ThreatStream.Analysis.VmID description: The VM ID. type: string - contextPath: ThreatStream.Analysis.Verdict description: The verdict of the sandbox detonation. type: string - contextPath: ThreatStream.Analysis.Network.UdpSource description: The UDP source. type: string - contextPath: ThreatStream.Analysis.Network.UdpDestination description: The UDP destination. type: string - contextPath: ThreatStream.Analysis.Network.UdpPort description: The UDP port. type: number - contextPath: ThreatStream.Analysis.Network.IcmpSource description: The ICMP source. type: string - contextPath: ThreatStream.Analysis.Network.IcmpDestination description: The ICMP destination. type: string - contextPath: ThreatStream.Analysis.Network.IcmpPort description: The ICMP port. type: number - contextPath: ThreatStream.Analysis.Network.TcpSource description: The TCP source. type: string - contextPath: ThreatStream.Analysis.Network.TcpDestination description: The TCP destination. type: number - contextPath: ThreatStream.Analysis.Network.TcpPort description: The TCP port. type: number - contextPath: ThreatStream.Analysis.Network.HttpSource description: The source of the HTTP address. type: string - contextPath: ThreatStream.Analysis.Network.HttpDestinaton description: The destination of the HTTP address. type: string - contextPath: ThreatStream.Analysis.Network.HttpPort description: The port of the HTTP address. type: string - contextPath: ThreatStream.Analysis.Network.HttpsSource description: The source of the HTTPS address. type: string - contextPath: ThreatStream.Analysis.Network.HttpsDestinaton description: The destination of the HTTPS address. type: string - contextPath: ThreatStream.Analysis.Network.HttpsPort description: The port of the HTTPS address. type: string - contextPath: ThreatStream.Analysis.Network.Hosts description: The network analysis hosts. type: string tests: - No tests (auto formatted) contentitemexportablefields: contentitemfields: {}