id: Detonate file - CrowdStrike Falcon Sandbox v2 version: -1 contentitemexportablefields: contentitemfields: {} name: Detonate file - CrowdStrike Falcon Sandbox v2 description: Detonates a File using CrowdStrike Falcon sandbox. starttaskid: "0" tasks: "0": id: "0" taskid: 29dcbc1e-0bb0-45f1-82ed-eb65b6ce039d type: start task: id: 29dcbc1e-0bb0-45f1-82ed-eb65b6ce039d version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "5" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 60 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: 553ea426-6542-4c8f-8799-341b1784d528 type: condition task: id: 553ea426-6542-4c8f-8799-341b1784d528 version: -1 name: Is CrowdStrike Falcon Sandbox V2 enabled? description: | Verify that there is a valid instance of CrowdStrike enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "6" "yes": - "14" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: CrowdStrike Falcon Sandbox V2 ignorecase: true - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active ignorecase: true accessor: brand iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 50, "y": 195 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: e6a670a6-eff4-4b16-883b-f08e7d7e7bd3 type: title task: id: e6a670a6-eff4-4b16-883b-f08e7d7e7bd3 version: -1 name: Done description: Done type: title iscommand: false brand: "" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 1240 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: 97fec2dc-7fc7-49c6-80e4-e8a96e9adc4a type: regular task: id: 97fec2dc-7fc7-49c6-80e4-e8a96e9adc4a version: -1 name: Initiate sandbox scan description: Retrieve summary information for an MD5, SHA1, or SHA256 and view all reports generated for any environment ID. script: '|||cs-falcon-sandbox-scan' type: regular iscommand: true brand: "" nexttasks: '#none#': - "6" scriptarguments: JobID: complex: root: CrowdStrike.Submit accessor: job_id file: complex: root: File.SHA256 polling: simple: "true" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 490, "y": 1065 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: 8377ba6f-c57d-4cd1-8a1f-5989f89978ac type: regular task: id: 8377ba6f-c57d-4cd1-8a1f-5989f89978ac version: -1 name: Set file to context description: Sets the file object into context. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "15" scriptarguments: key: simple: File value: complex: root: inputs.File separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 290, "y": 570 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: 772fa274-bfa4-4feb-8d0f-41591b65fb01 type: regular task: id: 772fa274-bfa4-4feb-8d0f-41591b65fb01 version: -1 name: Upload the sample to Falcon description: Submits a file from the investigation to the analysis server. script: '|||cs-falcon-sandbox-submit-sample' type: regular iscommand: true brand: "" nexttasks: '#none#': - "8" scriptarguments: entryId: complex: root: File.EntryID environmentID: complex: root: inputs.EnvironmentID separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 490, "y": 900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: a15cdef0-f6bd-48e3-8198-3f7c20e668fe type: condition task: id: a15cdef0-f6bd-48e3-8198-3f7c20e668fe version: -1 name: Is there a file to detonate? description: Asserts there's a file to detonate. type: condition iscommand: false brand: "" nexttasks: '#default#': - "6" "yes": - "11" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: simple: inputs.File iscontext: true continueonerrortype: "" view: |- { "position": { "x": 290, "y": 380 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: a0565f2c-c720-4196-84d2-21e057c23637 type: condition task: id: a0565f2c-c720-4196-84d2-21e057c23637 version: -1 name: Is the file type supported? description: Asserts the file type is supported. type: condition iscommand: false brand: "" nexttasks: '#default#': - "6" "yes": - "13" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: File filters: - - operator: match left: value: simple: File.Type iscontext: true right: value: simple: .*(?:PE32|EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b ignorecase: true - operator: match left: value: simple: File.Info iscontext: true right: value: simple: .*(?:PE32|EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b ignorecase: true - operator: match left: value: simple: File.Extension iscontext: true right: value: simple: .*(?:PE32|EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b ignorecase: true iscontext: true continueonerrortype: "" view: |- { "position": { "x": 290, "y": 730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "14_6_#default#": 0.13, "15_6_#default#": 0.25, "5_6_#default#": 0.12 }, "paper": { "dimensions": { "height": 1245, "width": 820, "x": 50, "y": 60 } } } inputs: - key: File value: complex: root: File required: false description: The file object of the file to detonate. playbookInputQuery: - key: EnvironmentID value: simple: "100" required: false description: The environment ID where the file should be submitted. To retrieve all available IDs, please execute the crowdstrike-get-environments command. playbookInputQuery: outputs: - contextPath: File.SHA256 description: The SHA256 hash of the file. type: string - contextPath: File.Malicious description: The file malicious description. type: unknown - contextPath: File.Type description: The file type, for example "PE". type: string - contextPath: File.Size description: The file size. type: number - contextPath: File.MD5 description: The MD5 hash of the file. type: string - contextPath: File.Name description: The file name. type: string - contextPath: File.SHA1 description: The SHA1 hash of the file. type: string - contextPath: File description: The file object. type: unknown - contextPath: File.Malicious.Vendor description: The vendor that decided the file was malicious. type: string - contextPath: DBotScore description: The DBotScore object. type: unknown - contextPath: DBotScore.Indicator description: The tested indicator. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number tests: - No tests (auto formatted) fromversion: 6.9.0