id: WildFire - Detonate file
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: WildFire - Detonate file
description: |-
  Deprecated. Use WildFire - Detonate file v2 instead.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: ff6c3afb-1f37-491b-8569-f2f9d6a79ff3
    type: start
    task:
      id: ff6c3afb-1f37-491b-8569-f2f9d6a79ff3
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 57.5,
          "y": -20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: d89662d0-dedb-49ff-8cba-4855a985cc38
    type: playbook
    task:
      id: d89662d0-dedb-49ff-8cba-4855a985cc38
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      Ids:
        complex:
          root: WildFire
          accessor: Report.SHA256
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: hash
      PollingCommandName:
        simple: wildfire-report
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: WildFire.Report(val.Status != 'Success').SHA256
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 4d801593-76c0-45bc-880c-46572315ab6d
    type: regular
    task:
      id: 4d801593-76c0-45bc-880c-46572315ab6d
      version: -1
      name: WildFire Get Report
      description: Retrieve results for a file hash using WildFire.
      script: '|||wildfire-report'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      format:
        complex:
          root: inputs.ReportFileType
      hash:
        complex:
          root: WildFire
          accessor: Report.SHA256
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 7cb53d1d-e613-47cd-847e-c1908e384d53
    type: title
    task:
      id: 7cb53d1d-e613-47cd-847e-c1908e384d53
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 57.5,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 55af7034-b0cf-40c7-86a5-f7efd9d31e9b
    type: condition
    task:
      id: 55af7034-b0cf-40c7-86a5-f7efd9d31e9b
      version: -1
      name: Is WildFire sandbox enabled?
      description: Check if integration instance is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: WildFire
                  - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: WildFire-v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 57.5,
          "y": 115
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 8cee3949-c005-4291-8152-14691d22614b
    type: title
    task:
      id: 8cee3949-c005-4291-8152-14691d22614b
      version: -1
      name: Filter only supported files
      description: Check if file type is supported.
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: d6b386f8-698e-42d5-8944-bc6317356f61
    type: regular
    task:
      id: d6b386f8-698e-42d5-8944-bc6317356f61
      version: -1
      name: WildFire Upload File
      description: Uploads a file to WildFire for analysis.
      script: '|||wildfire-upload'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      upload:
        complex:
          root: SupportedFilesToUpload
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: d1c6a572-54e7-4233-8228-daa0f7dcb176
    type: condition
    task:
      id: d1c6a572-54e7-4233-8228-daa0f7dcb176
      version: -1
      name: Did the upload finish successfully?
      description: Checks if the upload was successfully finished.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: WildFire
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: WildFire.Report.Status
                      iscontext: true
                    right:
                      value:
                        simple: Pending
                accessor: Report.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 480,
          "y": 990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: c9040900-138b-4e2d-89d5-a424d4cd7ff4
    type: regular
    task:
      id: c9040900-138b-4e2d-89d5-a424d4cd7ff4
      version: -1
      name: Set ASCII file types
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: SupportedFilesToUpload
      value:
        complex:
          root: inputs.File
          filters:
          - - operator: inList
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: js,hta,vbs,ps1,pl,sh,py
              ignorecase: true
          accessor: EntryID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 690,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 04e9fcb8-1770-4f8e-80c3-34d5d9f2bdfc
    type: regular
    task:
      id: 04e9fcb8-1770-4f8e-80c3-34d5d9f2bdfc
      version: -1
      name: Set Non ASCII file types
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: SupportedFilesToUpload
      value:
        complex:
          root: inputs.File
          filters:
          - - operator: inList
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: APK,JAR,DOC,DOCX,XLS,XLSX,PPT,PPTX,OOXML,PE32,PE,PDF,DMG,PKG,RAR,7Z,ELF,DLL,MSI,RTF,LNK
              ignorecase: true
          - - operator: notContainsString
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: ASCII text
              ignorecase: true
          accessor: EntryID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 280,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 4ef96e35-bb0b-4a27-8f95-f98fda94c98e
    type: condition
    task:
      id: 4ef96e35-bb0b-4a27-8f95-f98fda94c98e
      version: -1
      name: Are there any supported files to detonate?
      description: Check if there are any supported files to upload to wildfire for detonation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: SupportedFilesToUpload
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "13_2_yes": 0.55,
      "13_5_#default#": 0.35,
      "16_12_yes": 0.58,
      "16_5_#default#": 0.25,
      "7_5_#default#": 0.26
    },
    "paper": {
      "dimensions": {
        "height": 1620,
        "width": 1012.5,
        "x": 57.5,
        "y": -20
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: File object of the file to detonate. The file is taken from the context.
  playbookInputQuery:
- key: Interval
  value:
    simple: "1"
  required: false
  description: The duration for executing the polling (in minutes).
  playbookInputQuery:
- key: Timeout
  value:
    simple: "15"
  required: false
  description: The duration after which to stop polling and to resume the playbook. (in minutes)
  playbookInputQuery:
- key: ReportFileType
  value: {}
  required: false
  description: The resource type to download.
  playbookInputQuery:
outputs:
- contextPath: DBotScore.Score
  description: The actual score.
  type: string
- contextPath: DBotScore.Type
  description: The type of the indicator.
  type: string
- contextPath: File.Type
  description: The file type, e.g. "PE".
  type: string
- contextPath: File.Size
  description: The file size.
  type: number
- contextPath: File.MD5
  description: The MD5 hash of the file.
  type: string
- contextPath: File.Name
  description: The filename.
  type: string
- contextPath: File.SHA1
  description: The SHA1 hash of the file.
  type: string
- contextPath: File
  description: The file object.
  type: unknown
- contextPath: File.SHA256
  description: TheSHA256 hash of the file.
  type: string
- contextPath: File.Malicious
  description: The malicious object.
  type: unknown
- contextPath: File.Malicious.Vendor
  description: The vendor that made the decision that the file is malicious.
  type: string
- contextPath: DBotScore
  description: The DBot object.
  type: unknown
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
  type: string
- contextPath: DBotScore.Vendor
  description: The vendor used to calculate the score.
  type: string
- contextPath: WildFire.Report
  description: The submission object.
  type: unknown
- contextPath: WildFire.Report.Status
  description: The status of the submission.
  type: string
- contextPath: WildFire.Report.SHA256
  description: The SHA256 hash of the submission.
  type: string
- contextPath: InfoFile
  description: The report file object.
  type: unknown
- contextPath: InfoFile.EntryID
  description: The EntryID of the report file.
  type: string
- contextPath: InfoFile.Extension
  description: The extension of the report file.
  type: string
- contextPath: InfoFile.Name
  description: The name of the report file.
  type: string
- contextPath: InfoFile.Info
  description: The info of the report file.
  type: string
- contextPath: InfoFile.Size
  description: The size of the report file.
  type: number
- contextPath: InfoFile.Type
  description: The type of the report file.
  type: string
- contextPath: WildFire.Report.MD5
  description: The MD5 hash of the submission.
  type: string
- contextPath: WildFire.Report.FileType
  description: The type of the submission.
  type: string
- contextPath: WildFire.Report.Size
  description: The size of the submission.
  type: number
tests:
- No tests (deprecated)
fromversion: 5.0.0
deprecated: true
supportedModules:
- agentix
- xsiam