id: File Enrichment - Generic v2 version: -1 name: File Enrichment - Generic v2 description: |- Enrich a file using one or more integrations. - Provide threat information - Determine file reputation using the !file command starttaskid: "0" tasks: "0": id: "0" taskid: 90f7ce25-c27c-4ca9-8fe6-2168349b0702 type: start task: id: 90f7ce25-c27c-4ca9-8fe6-2168349b0702 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: "#none#": - "31" separatecontext: false view: |- { "position": { "x": 470, "y": -150 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "7": id: "7" taskid: be10b4ea-fb5e-478c-8614-ae684debb82f type: title task: id: be10b4ea-fb5e-478c-8614-ae684debb82f version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 470, "y": 900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "25": id: "25" taskid: 049989d4-fe3f-4a96-8f17-ad155ed74362 type: condition task: id: 049989d4-fe3f-4a96-8f17-ad155ed74362 version: -1 name: Is there a SHA256 hash? description: Verify whether there is a SHA256 hash to enrich. type: condition iscommand: false brand: "" nexttasks: "#default#": - "7" yes: - "27" scriptarguments: value: simple: ${File.SHA256} separatecontext: false conditions: - label: yes condition: - - operator: isExists left: value: complex: root: inputs.SHA256 iscontext: true right: value: {} view: |- { "position": { "x": 720, "y": 300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "27": id: "27" taskid: 27539369-ccb3-441c-89d9-001a4fc03093 type: condition task: id: 27539369-ccb3-441c-89d9-001a4fc03093 version: -1 name: Is Cylance Protect v2 enabled? description: Checks if there is an active instance of the Cylance Protect v2 integration enabled. type: condition iscommand: false brand: "" nexttasks: "#default#": - "7" yes: - "28" separatecontext: false conditions: - label: yes condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Cylance Protect v2 ignorecase: true - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active ignorecase: true accessor: brand iscontext: true view: |- { "position": { "x": 720, "y": 510 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "28": id: "28" taskid: 6721f439-f2ce-4dec-8bff-5eedf90921c9 type: regular task: id: 6721f439-f2ce-4dec-8bff-5eedf90921c9 version: -1 name: Get threat information from Cylance Protect v2 description: Requests threat details for a specific threat. script: '|||cylance-protect-get-threat' type: regular iscommand: true brand: "" nexttasks: "#none#": - "7" scriptarguments: sha256: complex: root: inputs.SHA256 transformers: - operator: uniq reputationcalc: 1 separatecontext: false view: |- { "position": { "x": 720, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "30": id: "30" taskid: f5488926-c247-4181-8824-1c81eac47049 type: playbook task: id: f5488926-c247-4181-8824-1c81eac47049 version: -1 name: File Enrichment - Virus Total (API v3) description: Get file information using the Virus Total API integration. type: playbook iscommand: false brand: "" playbookName: File Enrichment - Virus Total (API v3) nexttasks: "#none#": - "7" scriptarguments: FileHash: complex: root: inputs.SHA256 transformers: - operator: append args: item: value: simple: inputs.SHA1 iscontext: true - operator: append args: item: value: simple: inputs.MD5 iscontext: true separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -200, "y": 300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "31": id: "31" taskid: de42fb75-e635-43b3-8696-a867fe55e70b type: condition task: id: de42fb75-e635-43b3-8696-a867fe55e70b version: -1 name: Is there a file hash? description: Ensure that there are file hashes to enrich. type: condition iscommand: false brand: "" nexttasks: "#default#": - "7" yes: - "36" - "32" - "35" scriptarguments: value: simple: ${File.SHA256} separatecontext: false conditions: - label: yes condition: - - operator: isExists left: value: complex: root: inputs.SHA256 iscontext: true right: value: {} - operator: isExists left: value: complex: root: inputs.SHA1 iscontext: true - operator: isExists left: value: complex: root: inputs.MD5 iscontext: true view: |- { "position": { "x": 470, "y": -20 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "32": continueonerrortype: "" id: "32" ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - "33" - "7" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" id: aa3b5462-64fd-4033-8812-9d952347a79d iscommand: false name: Check Reputation Using All Available Integrations type: title version: -1 description: '' taskid: aa3b5462-64fd-4033-8812-9d952347a79d timertriggers: [] type: title view: |- { "position": { "x": 220, "y": 150 } } "33": conditions: - condition: - - ignorecase: true left: iscontext: true value: complex: root: inputs.UseReputationCommand operator: isEqualString right: value: simple: "True" label: "yes" continueonerrortype: "" id: "33" ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#default#': - "7" "yes": - "34" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" id: 331e3147-e6bc-4db8-8fe9-5a1d56cd4e3a iscommand: false name: Should use !file command? description: Check whether the file reputation command should be run. type: condition version: -1 taskid: 331e3147-e6bc-4db8-8fe9-5a1d56cd4e3a timertriggers: [] type: condition view: |- { "position": { "x": 220, "y": 300 } } "34": continueonerrortype: "" id: "34" ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - "7" note: false quietmode: 0 scriptarguments: file: complex: root: inputs.SHA256 transformers: - args: item: iscontext: true value: simple: inputs.MD5 operator: append - args: item: iscontext: true value: simple: inputs.SHA1 operator: append - operator: uniq separatecontext: false skipunavailable: true task: brand: "" description: Checks the file reputation of the specified hash. id: 0e956788-b597-4a77-8ffd-01b39d718d17 iscommand: true name: Check Reputation script: '|||file' type: regular version: -1 taskid: 0e956788-b597-4a77-8ffd-01b39d718d17 timertriggers: [] type: regular view: |- { "position": { "x": 220, "y": 510 } } "35": continueonerrortype: "" id: "35" ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - "30" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" id: 4d022016-e7a4-454b-85d5-fad65548649c iscommand: false name: Virus Total enrichment type: title version: -1 description: '' taskid: 4d022016-e7a4-454b-85d5-fad65548649c timertriggers: [] type: title view: |- { "position": { "x": -200, "y": 150 } } "36": continueonerrortype: "" id: "36" ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - "25" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" id: 601042e3-6757-4e60-8293-6c026caba2d1 iscommand: false name: Cylance Protect enrichment type: title version: -1 description: '' taskid: 601042e3-6757-4e60-8293-6c026caba2d1 timertriggers: [] type: title view: |- { "position": { "x": 720, "y": 150 } } view: |- { "linkLabelsPosition": { "25_27_yes": 0.59, "25_7_#default#": 0.25, "27_28_yes": 0.57, "27_7_#default#": 0.36, "31_7_#default#": 0.13, "33_7_#default#": 0.25 }, "paper": { "dimensions": { "height": 1115, "width": 1300, "x": -200, "y": -150 } } } inputs: - key: MD5 value: complex: root: File transformers: - operator: uniq accessor: MD5 required: false description: File MD5 hash to enrich. playbookInputQuery: - key: SHA256 value: complex: root: File transformers: - operator: uniq accessor: SHA256 required: false description: The file SHA256 hash to enrich. playbookInputQuery: - key: SHA1 value: complex: root: File transformers: - operator: uniq accessor: SHA1 required: false description: The file SHA1 hash to enrich. playbookInputQuery: - description: |- Define if you would like to use the !file command. Note: This input should be used whenever there is no auto-extract enabled in the investigation flow. Possible values: True / False. key: UseReputationCommand playbookInputQuery: required: true value: simple: "False" outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: File.SHA1 description: SHA1 hash of the file. type: string - contextPath: File.SHA256 description: SHA256 hash of the file. type: string - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: string - contextPath: File.MD5 description: MD5 hash of the file. type: string - contextPath: DBotScore description: The DBotScore object. type: unknown - contextPath: File description: The file object type: unknown - contextPath: DBotScore.Vendor description: Vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: File.Malicious.Description description: The reason the vendor decided the file was malicious. type: string - contextPath: File.Name description: The name of the threat. type: string - contextPath: File.MalwareFamily description: The file family classification. type: string - contextPath: File.AutoRun description: Indicates if the file is set to automatically run on system startup. type: string - contextPath: File.AvIndustry description: The score provided by the Anti-Virus industry. type: string - contextPath: File.CertIssuer description: The ID for the certificate issuer. type: string - contextPath: File.CertPublisher description: The ID for the certificate publisher. type: string - contextPath: File.CertTimestamp description: The date and time (in UTC) when the file was signed using the certificate. type: string - contextPath: File.Classification description: The threat classification for the threat. type: string - contextPath: File.CylanceScore description: The Cylance Score assigned to the threat. type: string - contextPath: File.DetectedBy description: The name of the Cylance module that detected the threat. type: string - contextPath: File.FileSize description: The size of the file. type: string - contextPath: File.GlobalQuarantine description: Identifies if the threat is on the Global Quarantine list. type: string - contextPath: File.Running description: Identifies if the threat is executing, or another executable loaded or called it. type: string - contextPath: File.Safelisted description: Identifies if the threat is on the Safe List. type: string - contextPath: File.Signed description: Identifies the file as signed or not signed. type: string - contextPath: File.SubClassification description: The threat sub-classification for the threat. type: string - contextPath: File.UniqueToCylance description: Whether the threat was identified by Cylance, and not by other anti-virus sources. type: string - contextPath: File.Relationships.EntityA description: The source of the relationship. type: String - contextPath: File.Relationships.EntityB description: The destination of the relationship. type: String - contextPath: File.Relationships.Relationship description: The name of the relationship. type: String - contextPath: File.Relationships.EntityAtype description: The type of the source of the relationship. type: String - contextPath: File.Relationships.EntityBtype description: The type of the destination of the relationship. type: String - contextPath: File.Malicious.TotalEngines description: For malicious files, the total number of engines that checked the file hash. type: Unknown - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: VirusTotal.File.attributes.type_description description: description of the type of the file. type: String - contextPath: VirusTotal.File.attributes.tlsh description: The locality-sensitive hashing. type: String - contextPath: VirusTotal.File.attributes.names description: Names of the file. type: String - contextPath: VirusTotal.File.attributes.last_modification_date description: The last modification date in epoch format. type: Number - contextPath: VirusTotal.File.attributes.type_tag description: Tag of the type. type: String - contextPath: VirusTotal.File.attributes.size description: Size of the file. type: Number - contextPath: VirusTotal.File.attributes.times_submitted description: Number of times the file was submitted. type: Number - contextPath: VirusTotal.File.attributes.last_submission_date description: Last submission date in epoch format. type: Number - contextPath: VirusTotal.File.attributes.downloadable description: Whether the file is downloadable. type: Boolean - contextPath: VirusTotal.File.attributes.sha256 description: SHA-256 hash of the file. type: String - contextPath: VirusTotal.File.attributes.type_extension description: Extension of the type. type: String - contextPath: VirusTotal.File.attributes.tags description: File tags. type: String - contextPath: VirusTotal.File.attributes.last_analysis_date description: Last analysis date in epoch format. type: Number - contextPath: VirusTotal.File.attributes.unique_sources description: Unique sources. type: Number - contextPath: VirusTotal.File.attributes.first_submission_date description: First submission date in epoch format. type: Number - contextPath: VirusTotal.File.attributes.ssdeep description: SSDeep hash of the file. type: String - contextPath: VirusTotal.File.attributes.md5 description: MD5 hash of the file. type: String - contextPath: VirusTotal.File.attributes.sha1 description: SHA-1 hash of the file. type: String - contextPath: VirusTotal.File.attributes.magic description: Identification of file by the magic number. type: String - contextPath: VirusTotal.File.attributes.meaningful_name description: Meaningful name of the file. type: String - contextPath: VirusTotal.File.attributes.reputation description: The reputation of the file. type: Number - contextPath: VirusTotal.File.attributes.exiftool.MIMEtype description: MIME type of the file. type: String - contextPath: VirusTotal.File.attributes.exiftool.Filetype description: The file type. type: String - contextPath: VirusTotal.File.attributes.exiftool.WordCount description: Total number of words in the file. type: String - contextPath: VirusTotal.File.attributes.exiftool.LineCount description: Total number of lines in file. type: String - contextPath: VirusTotal.File.attributes.exiftool.MIMEEncoding description: The MIME encoding. type: String - contextPath: VirusTotal.File.attributes.exiftool.FiletypeExtension description: The file type extension. type: String - contextPath: VirusTotal.File.attributes.exiftool.Newlines description: Number of newlines signs. type: String - contextPath: VirusTotal.File.attributes.javascript_info.tags description: Tags of the JavaScript. type: String - contextPath: VirusTotal.File.attributes.crowdsourced_ids_stats.info description: Number of IDS that marked the file as "info". type: Number - contextPath: VirusTotal.File.attributes.crowdsourced_ids_stats.high description: Number of IDS that marked the file as "high". type: Number - contextPath: VirusTotal.File.attributes.crowdsourced_ids_stats.medium description: Number of IDS that marked the file as "medium". type: Number - contextPath: VirusTotal.File.attributes.crowdsourced_ids_stats.low description: Number of IDS that marked the file as "low". type: Number - contextPath: VirusTotal.File.attributes.sigma_analysis_stats.critical description: Number of Sigma analysis that marked the file as "critical". type: Number - contextPath: VirusTotal.File.attributes.sigma_analysis_stats.high description: Number of Sigma analysis that marked the file as "high". type: Number - contextPath: VirusTotal.File.attributes.sigma_analysis_stats.medium description: Number of Sigma analysis that marked the file as "medium". type: Number - contextPath: VirusTotal.File.attributes.sigma_analysis_stats.low description: Number of Sigma analysis that marked the file as "low". type: Number - contextPath: VirusTotal.File.attributes.trid.file_type description: The TrID file type. type: String - contextPath: VirusTotal.File.attributes.trid.probability description: The TrID probability. type: Number - contextPath: VirusTotal.File.attributes.crowdsourced_yara_results.description description: description of the YARA rule. type: String - contextPath: VirusTotal.File.attributes.crowdsourced_yara_results.source description: Source of the YARA rule. type: String - contextPath: VirusTotal.File.attributes.crowdsourced_yara_results.author description: Author of the YARA rule. type: String - contextPath: VirusTotal.File.attributes.crowdsourced_yara_results.ruleset_name description: Rule set name of the YARA rule. type: String - contextPath: VirusTotal.File.attributes.crowdsourced_yara_results.rule_name description: Name of the YARA rule. type: String - contextPath: VirusTotal.File.attributes.crowdsourced_yara_results.ruleset_id description: ID of the YARA rule. type: String - contextPath: VirusTotal.File.attributes.total_votes.harmless description: Total number of harmless votes. type: Number - contextPath: VirusTotal.File.attributes.total_votes.malicious description: Total number of malicious votes. type: Number - contextPath: VirusTotal.File.attributes.popular_threat_classification.suggested_threat_label description: Suggested thread label. type: String - contextPath: VirusTotal.File.attributes.popular_threat_classification.popular_threat_name description: The popular thread name. type: Number - contextPath: VirusTotal.File.attributes.last_analysis_stats.harmless description: The number of engines that found the indicator to be harmless. type: Number - contextPath: VirusTotal.File.attributes.last_analysis_stats.type-unsupported description: The number of engines that found the indicator to be of type unsupported. type: Number - contextPath: VirusTotal.File.attributes.last_analysis_stats.suspicious description: The number of engines that found the indicator to be suspicious. type: Number - contextPath: VirusTotal.File.attributes.last_analysis_stats.confirmed-timeout description: The number of engines that confirmed the timeout of the indicator. type: Number - contextPath: VirusTotal.File.attributes.last_analysis_stats.timeout description: The number of engines that timed out for the indicator. type: Number - contextPath: VirusTotal.File.attributes.last_analysis_stats.failure description: The number of failed analysis engines. type: Number - contextPath: VirusTotal.File.attributes.last_analysis_stats.malicious description: The number of engines that found the indicator to be malicious. type: Number - contextPath: VirusTotal.File.attributes.last_analysis_stats.undetected description: The number of engines that could not detect the indicator. type: Number - contextPath: VirusTotal.File.type description: type of the indicator (file). type: String - contextPath: VirusTotal.File.id description: type ID of the indicator. type: String - contextPath: VirusTotal.File.links.self description: Link to the response. type: Unknown fromversion: 5.0.0 tests: - File Enrichment - Generic v2 - Test contentitemexportablefields: contentitemfields: {} system: true marketplaces: - xsoar - marketplacev2 - platform