id: Intezer - Analyze File and URL version: -1 fromversion: 6.5.0 name: Intezer - Analyze File and URL description: Analyze Files and URLs on Intezer Analyze tags: - Phishing - Malware starttaskid: "0" tasks: "0": id: "0" taskid: 05110b05-c809-4429-86a5-921ba0de27b8 type: start task: id: 05110b05-c809-4429-86a5-921ba0de27b8 version: -1 name: "" description: start iscommand: false brand: "" nexttasks: '#none#': - "14" - "18" separatecontext: false view: |- { "position": { "x": 160, "y": -50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "13": id: "13" taskid: b5a2677b-25b2-4a8f-8ca2-7fdf75e33219 type: regular task: id: b5a2677b-25b2-4a8f-8ca2-7fdf75e33219 version: -1 name: Intezer - Analyze URL description: Checks reputation of an Url script: Intezer v2|||intezer-analyze-url type: regular iscommand: true brand: Intezer v2 nexttasks: '#none#': - "26" scriptarguments: url: simple: ${inputs.URL.Data} interval: complex: root: inputs.Interval transformers: - operator: multiply args: by: value: simple: "60" timeout: complex: root: inputs.Timeout transformers: - operator: multiply args: by: value: simple: "60" wait_for_result: simple: "true" separatecontext: false view: |- { "position": { "x": 420, "y": 910 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "14": id: "14" taskid: 377bf6c2-e9ae-4b02-86cf-450cd1cdcf90 type: condition task: id: 377bf6c2-e9ae-4b02-86cf-450cd1cdcf90 version: -1 name: Is there a url to analyze? description: Checks if there is a url to analyze. type: condition iscommand: false brand: "" nexttasks: '#default#': - "26" "yes": - "13" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: ${inputs.URL accessor: Data} iscontext: true right: value: {} view: |- { "position": { "x": 410, "y": 330 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "18": id: "18" taskid: 536757a7-2039-4733-8eec-3184fe8e261c type: condition task: id: 536757a7-2039-4733-8eec-3184fe8e261c version: -1 name: Is there a file to analyze? description: Check if the file exists in Intezer genome database type: condition iscommand: false brand: "" nexttasks: '#default#': - "26" "yes": - "23" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.File filters: - - operator: isNotEmpty left: value: simple: inputs.File.EntryID iscontext: true iscontext: true right: value: {} view: |- { "position": { "x": -80, "y": 340 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "19": id: "19" taskid: 03a3628d-957e-4fc1-8e01-218c1a5a20e2 type: regular task: id: 03a3628d-957e-4fc1-8e01-218c1a5a20e2 version: -1 name: Intezer - Analyze attachment description: Checks file reputation for uploaded file (up to 150MB) script: Intezer v2|||intezer-analyze-by-file type: regular iscommand: true brand: Intezer v2 nexttasks: '#none#': - "26" scriptarguments: file_entry_id: simple: ${inputs.File.EntryID} interval: complex: root: inputs.Interval transformers: - operator: multiply args: by: value: simple: "60" timeout: complex: root: inputs.Timeout transformers: - operator: multiply args: by: value: simple: "60" wait_for_result: simple: "true" separatecontext: false view: |- { "position": { "x": -80, "y": 1230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "23": id: "23" taskid: d3361114-69db-4e36-88cc-0e7e764cbd4c type: regular task: id: d3361114-69db-4e36-88cc-0e7e764cbd4c version: -1 name: Get File Analysis description: Checks file reputation of the given hash, supports SHA256, SHA1 and MD5 by looking at the latest available report script: Intezer v2|||intezer-get-latest-report type: regular iscommand: true brand: Intezer v2 nexttasks: '#none#': - "24" scriptarguments: file_hash: simple: ${inputs.File.SHA256} raise_exception_if_latest_not_found: simple: "false" separatecontext: false continueonerror: true view: |- { "position": { "x": -80, "y": 680 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: errorPath "24": id: "24" taskid: eb7e3ca2-fd0c-406c-8fd6-c1658f80f7a6 type: condition task: id: eb7e3ca2-fd0c-406c-8fd6-c1658f80f7a6 version: -1 name: Check If the Analysis exists description: Check if the analysis exists in Intezer genome database type: condition iscommand: false brand: "" nexttasks: '#default#': - "19" "yes": - "26" separatecontext: false conditions: - label: "yes" condition: - - operator: isTrue left: value: simple: File.ExistsInIntezer iscontext: true right: value: {} view: |- { "position": { "x": -80, "y": 910 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "26": id: "26" taskid: a4f52bed-6b29-48aa-86e0-0985cb03ce4b type: title task: id: a4f52bed-6b29-48aa-86e0-0985cb03ce4b version: -1 name: Done description: Done type: title iscommand: false brand: "" separatecontext: false view: |- { "position": { "x": 200, "y": 1470 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" view: |- { "linkLabelsPosition": { "18_26_#default#": 0.9 }, "paper": { "dimensions": { "height": 1585, "width": 880, "x": -80, "y": -50 } } } inputs: - key: Interval value: simple: "1" required: true description: How often the polling command should run (in minutes). playbookInputQuery: - key: Timeout value: simple: "15" required: true description: Amount of time to wait before a timeout occurs (in minutes). playbookInputQuery: - key: File value: simple: ${File} required: false description: "" playbookInputQuery: - key: URL value: simple: ${URL} required: false description: "" playbookInputQuery: outputs: - contextPath: URL.Data description: The submitted Url type: string - contextPath: URL.Malicious.Vendor description: For malicious Url, the vendor that made the decision type: string - contextPath: URL.Metadata description: Metadata returned from Intezer analysis. type: Unknown - contextPath: URL.ExistsInIntezer description: Does the url exists on Intezer type: Boolean - contextPath: DBotScore description: The DBotScore object. type: unknown - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: Vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: File description: File Context. type: unknown tests: - No tests (auto formatted)