id: File Enrichment - Generic version: -1 name: File Enrichment - Generic fromversion: 5.0.0 description: |- Deprecated. Use "File Enrichment - Generic v2" playbook instead. Enrich a file using one or more integrations. File enrichment includes: * File history * Threat information * File reputation starttaskid: "0" hidden: true tasks: "0": id: "0" taskid: 6fa65b00-15dc-4cab-8b4e-7ab8e2720215 type: start task: id: 6fa65b00-15dc-4cab-8b4e-7ab8e2720215 version: -1 name: "" description: "" iscommand: false brand: "" nexttasks: '#none#': - "24" - "31" reputationcalc: 0 separatecontext: false view: |- { "position": { "x": 480, "y": 50 } } note: false timertriggers: [] "7": id: "7" taskid: d2deb7de-75cc-4f33-8ba3-6f83370096f8 type: title task: id: d2deb7de-75cc-4f33-8ba3-6f83370096f8 version: -1 name: Done description: "" type: title iscommand: false brand: "" reputationcalc: 0 separatecontext: false view: |- { "position": { "x": 275, "y": 1010 } } note: false timertriggers: [] "24": id: "24" taskid: 9b849bc8-3a9b-46c5-802e-2fc25b7b1761 type: title task: id: 9b849bc8-3a9b-46c5-802e-2fc25b7b1761 version: -1 name: Threat information description: "" type: title iscommand: false brand: "" nexttasks: '#none#': - "25" - "29" reputationcalc: 0 separatecontext: false view: |- { "position": { "x": 265, "y": 195 } } note: false timertriggers: [] "25": id: "25" taskid: 803cab60-a177-4bca-8890-267658a8e037 type: condition task: id: 803cab60-a177-4bca-8890-267658a8e037 version: -1 name: Is there a SHA-256 hash? description: Check if there is a SHA-256 hash in context. type: condition iscommand: false brand: "" nexttasks: '#default#': - "7" "yes": - "26" scriptarguments: value: simple: ${File.SHA256} reputationcalc: 0 separatecontext: false conditions: - label: "yes" condition: - - operator: general.isExists left: value: complex: root: inputs.SHA256 iscontext: true view: |- { "position": { "x": 50, "y": 340 } } note: false timertriggers: [] "26": id: "26" taskid: 977beaa5-2d82-4d11-815d-16c6b502b5af type: title task: id: 977beaa5-2d82-4d11-815d-16c6b502b5af version: -1 name: Get threat info from Cylance Protect v2 description: "" type: title iscommand: false brand: "" nexttasks: '#none#': - "27" reputationcalc: 0 separatecontext: false view: |- { "position": { "x": 162.5, "y": 515 } } note: false timertriggers: [] "27": id: "27" taskid: a385675b-4d5d-40c4-8ea3-f9658e14ef91 type: condition task: id: a385675b-4d5d-40c4-8ea3-f9658e14ef91 version: -1 name: Is Cylance Protect v2 enabled? description: Checks if there is an active instance of Cylance Protect v2. type: condition iscommand: false brand: "" nexttasks: '#default#': - "7" "yes": - "28" reputationcalc: 0 separatecontext: false conditions: - label: "yes" condition: - - operator: general.isExists left: value: complex: root: modules filters: - - operator: string.isEqual left: value: simple: modules.brand iscontext: true right: value: simple: Cylance Protect v2 ignorecase: true - - operator: string.isEqual left: value: simple: modules.state iscontext: true right: value: simple: active ignorecase: true accessor: brand iscontext: true view: |- { "position": { "x": 162.5, "y": 660 } } note: false timertriggers: [] "28": id: "28" taskid: 5d1b9cb9-80ad-485a-80ba-e52f2bc9d2f0 type: regular task: id: 5d1b9cb9-80ad-485a-80ba-e52f2bc9d2f0 version: -1 name: Get threat information from Cylance Protect v2 description: Get threat information from the Cylance Protect v2 integration. script: Cylance Protect v2|||cylance-protect-get-threat type: regular iscommand: true brand: Cylance Protect v2 nexttasks: '#none#': - "7" scriptarguments: sha256: complex: root: inputs.SHA256 reputationcalc: 0 continueonerror: true separatecontext: false view: |- { "position": { "x": 275, "y": 835 } } note: false timertriggers: [] "29": id: "29" taskid: 0357cc1e-4fed-4d34-8672-c44dde656382 type: playbook task: id: 0357cc1e-4fed-4d34-8672-c44dde656382 version: -1 name: File Enrichment - Virus Total private API description: Get file reputation using one or more integrations playbookName: File Enrichment - Virus Total Private API type: playbook iscommand: false brand: "" nexttasks: '#none#': - "7" scriptarguments: MD5: complex: root: inputs.MD5 SHA1: complex: root: inputs.SHA1 SHA256: complex: root: inputs.SHA256 reputationcalc: 0 separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 view: |- { "position": { "x": 705, "y": 835 } } note: false timertriggers: [] "30": id: "30" taskid: 52857fb4-234a-41b3-863e-acedeb1b02b3 type: playbook task: id: 52857fb4-234a-41b3-863e-acedeb1b02b3 version: -1 name: File Enrichment - File reputation description: Get file reputation using one or more integrations playbookName: File Enrichment - File reputation type: playbook iscommand: false brand: "" nexttasks: '#none#': - "7" scriptarguments: MD5: complex: root: inputs.MD5 SHA1: complex: root: inputs.SHA1 SHA256: complex: root: inputs.SHA256 reputationcalc: 0 separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 view: |- { "position": { "x": 1135, "y": 835 } } note: false timertriggers: [] "31": id: "31" taskid: e14e2725-8611-4089-8947-4db090c13347 type: title task: id: e14e2725-8611-4089-8947-4db090c13347 version: -1 name: File reputation description: "" type: title iscommand: false brand: "" nexttasks: '#none#': - "30" reputationcalc: 0 separatecontext: false view: |- { "position": { "x": 1135, "y": 675 } } note: false timertriggers: [] view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 1025, "width": 1465, "x": 50, "y": 50 } } } inputs: - key: MD5 value: complex: root: File accessor: MD5 required: false description: File MD5 hash to enrich. - key: SHA256 value: complex: root: File accessor: SHA256 required: false description: File SHA-256 hash to enrich. - key: SHA1 value: complex: root: File accessor: SHA1 required: false description: File SHA-1 hash to enrich. outputs: - contextPath: DBotScore.Indicator description: The tested indicator type: string - contextPath: DBotScore.Type description: The type of the indicator type: string - contextPath: File.SHA1 description: SHA1 hash of the file type: string - contextPath: File.SHA256 description: SHA256 hash of the file type: string - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision type: string - contextPath: File.MD5 description: MD5 hash of the file type: string - contextPath: DBotScore description: The DBotScore's object type: unknown - contextPath: File description: The file's object type: unknown - contextPath: DBotScore.Vendor description: Vendor used to calculate the score type: string - contextPath: DBotScore.Score description: The actual score type: number - contextPath: File.VirusTotal.Scans description: the scan object type: unknown - contextPath: File.VirusTotal.Scans.Source description: Scan vendor for this hash - contextPath: File.VirusTotal.Scans.Detected description: Scan detection for this hash (True,False) - contextPath: File.VirusTotal.Scans.Result description: Scan result for this hash - signature, etc. tests: - no test (new v2 playbook has an updated test) deprecated: true