id: URL Enrichment - Generic v2 version: -1 fromversion: 5.0.0 name: URL Enrichment - Generic v2 description: |- Enrich URLs using one or more integrations. URL enrichment includes: * SSL verification for URLs. * Threat information. * Providing of URL screenshots. * URL Reputation using !url. starttaskid: "0" tasks: "0": id: "0" taskid: e1a236ab-b35b-4b70-84a7-3ca08b9bbe95 type: start task: id: e1a236ab-b35b-4b70-84a7-3ca08b9bbe95 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "16" separatecontext: false view: |- { "position": { "x": 490, "y": 41 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "16": id: "16" taskid: 2e1b93fe-512d-4fba-80dd-2912bf3382f5 type: condition task: id: 2e1b93fe-512d-4fba-80dd-2912bf3382f5 version: -1 name: Is there a URL to enrich? description: Checks whether there is at least one URL to enrich. type: condition iscommand: false brand: "" nexttasks: '#default#': - "37" "yes": - "29" - "31" - "38" scriptarguments: value: simple: inputs.URL separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.URL iscontext: true right: value: {} view: |- { "position": { "x": 490, "y": 175 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: 7956570c-4a34-462b-84aa-0f8c6d01cf43 type: title task: id: 7956570c-4a34-462b-84aa-0f8c6d01cf43 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 490, "y": 1095 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: 426d5e5a-76ec-4310-8157-e3ce1795f88f type: condition task: id: 426d5e5a-76ec-4310-8157-e3ce1795f88f version: -1 name: 'Is Rasterize integration enabled? ' description: Checks if there is an active instance of the Rasterize integration enabled. scriptName: Exists type: condition iscommand: false brand: "" nexttasks: '#default#': - "24" "yes": - "26" scriptarguments: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: brand iscontext: true right: value: simple: Rasterize - - operator: isEqualString left: value: simple: state iscontext: true right: value: simple: active separatecontext: false view: |- { "position": { "x": -40, "y": 710 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: 13c4e2ea-abb5-49b0-8139-79ba102250c7 type: regular task: id: 13c4e2ea-abb5-49b0-8139-79ba102250c7 version: -1 name: Get URL screenshot description: Gets a screenshot of the URL page. tags: - url_screenshots script: Rasterize|||rasterize type: regular iscommand: true brand: Rasterize nexttasks: '#none#': - "24" scriptarguments: url: complex: root: inputs.URL transformers: - operator: uniq execution-timeout: simple: "600" reputationcalc: 1 separatecontext: false view: |- { "position": { "x": -40, "y": 920 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 71af55e1-a11a-42f9-84f6-ce3ce93e17ce type: condition task: id: 71af55e1-a11a-42f9-84f6-ce3ce93e17ce version: -1 name: Capture screenshots of the URL? description: Checks if the playbook's Rasterize input is set to "True", which determines whether screenshots of the URLs are created. type: condition iscommand: false brand: "" nexttasks: '#default#': - "24" "yes": - "25" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.Rasterize iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": -40, "y": 500 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: 7fc4755c-5a08-4f90-8bab-12c892b21df4 type: title task: id: 7fc4755c-5a08-4f90-8bab-12c892b21df4 version: -1 name: URL Screenshots type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "27" separatecontext: false view: |- { "position": { "x": -40, "y": 360 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: 11224752-fee9-4a8f-82c0-5af370081779 type: title task: id: 11224752-fee9-4a8f-82c0-5af370081779 version: -1 name: URL Verification type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "33" separatecontext: false view: |- { "position": { "x": 489.5, "y": 360 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: ab4dd806-764c-4b25-8e34-98b9a0fc87f7 type: regular task: id: ab4dd806-764c-4b25-8e34-98b9a0fc87f7 version: -1 name: Verify SSL for URLs description: Verify URL SSL certificate. scriptName: URLSSLVerification type: regular iscommand: false brand: "" nexttasks: '#none#': - "24" scriptarguments: url: complex: root: inputs.URL transformers: - operator: uniq reputationcalc: 1 separatecontext: false view: |- { "position": { "x": 490, "y": 710 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "33": id: "33" taskid: 0a60d379-a6c4-449e-87e2-4939b8d0ad13 type: condition task: id: 0a60d379-a6c4-449e-87e2-4939b8d0ad13 version: -1 name: Verify URLs? description: Checks if the playbook's VerifyURL input is set to "True", to determine whether to perform SSL verification on the URLs. type: condition iscommand: false brand: "" nexttasks: '#default#': - "24" "yes": - "32" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.VerifyURL iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 490, "y": 500 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "37": id: "37" taskid: 395ad908-d5b6-4449-8665-b085546d0d42 type: title task: id: 395ad908-d5b6-4449-8665-b085546d0d42 version: -1 name: No URLs type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "24" separatecontext: false view: |- { "position": { "x": -510, "y": 360 } } note: false timertriggers: [] ignoreworker: false continueonerrortype: "" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "38": continueonerrortype: "" id: "38" ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - "40" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" id: 704516ae-95d9-4ef5-8772-1958046fcac7 iscommand: false name: URL Reputation type: title version: -1 description: '' taskid: 704516ae-95d9-4ef5-8772-1958046fcac7 timertriggers: [] type: title view: |- { "position": { "x": 1010, "y": 360 } } "39": continueonerrortype: "" id: "39" ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - "24" note: false quietmode: 0 scriptarguments: url: complex: root: inputs.URL transformers: - operator: uniq separatecontext: false skipunavailable: true task: brand: "" description: Checks the reputation of a URL. id: 66cd353d-652e-4786-8d2e-af0fbd9c63e7 iscommand: true name: Check Reputation script: '|||url' type: regular version: -1 taskid: 66cd353d-652e-4786-8d2e-af0fbd9c63e7 timertriggers: [] type: regular view: |- { "position": { "x": 1010, "y": 710 } } "40": conditions: - condition: - - ignorecase: true left: iscontext: true value: complex: root: inputs.UseReputationCommand operator: isEqualString right: value: simple: "True" label: "yes" continueonerrortype: "" id: "40" ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#default#': - "24" "yes": - "39" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" id: e0db6ab1-2c0e-4859-84eb-e764c3fd01e5 iscommand: false name: Should use !url command? description: Check if should run URL reputation command type: condition version: -1 taskid: e0db6ab1-2c0e-4859-84eb-e764c3fd01e5 timertriggers: [] type: condition view: |- { "position": { "x": 1010, "y": 500 } } view: |- { "linkLabelsPosition": { "25_24_#default#": 0.53, "25_26_yes": 0.47, "27_25_yes": 0.5, "33_24_#default#": 0.13, "33_32_yes": 0.67, "40_24_#default#": 0.31 }, "paper": { "dimensions": { "height": 1119, "width": 1900, "x": -510, "y": 41 } } } inputs: - key: URL value: complex: root: URL accessor: Data transformers: - operator: uniq required: false description: The URLs to enrich. playbookInputQuery: - key: Rasterize value: simple: "True" required: false description: |- Define if you would like the system take safe screenshots of input URLs. Possible values: True / False. The default value is true. playbookInputQuery: - key: VerifyURL value: simple: "False" required: false description: |- Define if you would like the system perform SSL certificate verification on the URLs. Possible values: True / False. The default value is false. playbookInputQuery: - description: |- Define if you would like to use the !url command. Note: This input should be used whenever there is no auto-extract enabled in the investigation flow. Possible values: True / False. The default value is false. key: UseReputationCommand playbookInputQuery: required: true value: simple: "False" outputs: - contextPath: URL description: The URL object. type: uknown - contextPath: URL.Data description: The enriched URL. type: string - contextPath: DBotScore description: The DBotScore object. type: unknown - contextPath: URL.Malicious description: Whether the detected URL was malicious. type: unknown - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision. - contextPath: URL.Malicious.Description description: For malicious URLs, the reason that the vendor made the decision. - contextPath: DBotScore.Indicator description: The indicator. type: string - contextPath: DBotScore.Type description: The indicator's type. type: string - contextPath: DBotScore.Vendor description: The reputation vendor. type: string - contextPath: DBotScore.Score description: The reputation score. type: number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. - contextPath: URL.Relationships.EntityA description: The source of the relationship. - contextPath: URL.Relationships.EntityB description: The destination of the relationship. - contextPath: URL.Relationships.Relationship description: The name of the relationship. - contextPath: URL.Relationships.EntityAType description: The type of the source of the relationship. - contextPath: URL.Relationships.EntityBType description: The type of the destination of the relationship. - contextPath: InfoFile.EntryID description: The EntryID of the image/pdf file. - contextPath: InfoFile.Extension description: The extension of the image/pdf file. - contextPath: InfoFile.Name description: The name of the image/pdf file. - contextPath: InfoFile.Info description: The info of the image/pdf file. - contextPath: InfoFile.Size description: The size of the image/pdf file. - contextPath: InfoFile.Type description: The type of the image/pdf file. tests: - URL Enrichment - Generic v2 - Test system: true marketplaces: - xsoar - marketplacev2 - platform