id: YARA - File Scan
version: -1
name: YARA - File Scan
fromversion: 6.8.0
description: |-
  A playbook to run YARA scan against uploaded file.
  To run the playbook, provide the YARA rule content and the entry ID of the file you intend to scan.

starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: c4bd7186-7d67-4ee5-8e97-ab3e451af4e7
    type: start
    task:
      id: c4bd7186-7d67-4ee5-8e97-ab3e451af4e7
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: c3951e76-5254-4892-8711-3efd871b16c5
    type: condition
    task:
      id: c3951e76-5254-4892-8711-3efd871b16c5
      version: -1
      name: Check If Entry ID and YARA rule content exists
      description: Checks whether Entry ID and YARA rule content inputs provided
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.EntryID
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.YARA
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -105,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 172f2408-5edd-4d5c-8348-c3954013e5ac
    type: regular
    task:
      id: 172f2408-5edd-4d5c-8348-c3954013e5ac
      version: -1
      name: Run YARA scan
      description: Performs a YARA scan on the specified files.
      scriptName: YaraScan
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      entryIDs:
        complex:
          root: inputs.EntryID
          transformers:
          - operator: uniq
      yaraRule:
        complex:
          root: inputs.YARA
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -105,
          "y": 790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: ffe12c73-1999-44fe-8f58-a3d1108530b5
    type: title
    task:
      id: ffe12c73-1999-44fe-8f58-a3d1108530b5
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 10228755-d924-4afc-8059-1f7473f57e18
    type: condition
    task:
      id: 10228755-d924-4afc-8059-1f7473f57e18
      version: -1
      name: Was a query provided?
      description: Check if a query was provided by the user to use YARA Rule indicators instead of a manual input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Query
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 85d1edac-1181-447e-84c5-6f9c3e646ca0
    type: condition
    task:
      id: 85d1edac-1181-447e-84c5-6f9c3e646ca0
      version: -1
      name: YARA indicators found
      description: Check if the query returned any indicators.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "Yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: ${foundIndicators}
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 655,
          "y": 790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 1d3bd7e3-012a-441d-89eb-c81d8efe8a89
    type: regular
    task:
      id: 1d3bd7e3-012a-441d-89eb-c81d8efe8a89
      version: -1
      name: Run YARA scan
      description: Performs a YARA scan on the specified files.
      scriptName: YaraScan
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      entryIDs:
        complex:
          root: inputs.EntryID
          transformers:
          - operator: uniq
      yaraRule:
        complex:
          root: foundIndicators
          accessor: rawrule
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 655,
          "y": 1065
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 5f3b0e78-f228-4af5-849e-4a9f2da3bcc8
    type: regular
    task:
      id: 5f3b0e78-f228-4af5-849e-4a9f2da3bcc8
      version: -1
      name: Search Yara Rules Indicator
      description: |
        Searches XSOAR for the required YARA Rule Indicators to scan the files with. The search returns the "Raw Rule" field to use for the scan.
      scriptName: SearchIndicator
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      add_fields_to_context:
        simple: rawrule
      query:
        simple: ${inputs.Query}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 655,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: b8aa239a-271f-4c9f-8f29-c4b7b632f528
    type: title
    task:
      id: b8aa239a-271f-4c9f-8f29-c4b7b632f528
      version: -1
      name: Manual Rule Input
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -105,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 7dae5720-6bda-48c2-810e-cbb3a52ebd6a
    type: title
    task:
      id: 7dae5720-6bda-48c2-810e-cbb3a52ebd6a
      version: -1
      name: Using YARA Rule Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 655,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "1_2_yes": 0.73,
      "1_3_#default#": 0.54,
      "6_3_#default#": 0.5
    },
    "paper": {
      "dimensions": {
        "height": 1240,
        "width": 1140,
        "x": -105,
        "y": 70
      }
    }
  }
inputs:
- key: EntryID
  value:
    complex:
      root: File
      accessor: EntryID
      transformers:
      - operator: uniq
  required: false
  description: The entry ID of a file to scan
  playbookInputQuery:
- key: YARA
  value: {}
  required: false
  description: The YARA rule content
  playbookInputQuery:
- key: Query
  value:
    simple: 
  required: false
  description: |-
    A query to match the relevant YARA rule indicators from TIM.

    Example: type:"YARA Rule"
  playbookInputQuery:
outputs:
- contextPath: Yara
  type: unknown
  description: The Yara context path.
- contextPath: Yara.Filename
  description: The filename of the file that was scanned.
  type: string
- contextPath: Yara.HasError
  description: Whether there was an error when performing the scan.
  type: boolean
- contextPath: Yara.HasMatch
  description: Whether the file matched any of the rules.
  type: boolean
- contextPath: Yara.entryID
  description: The entry ID of the scanned file.
  type: string
- contextPath: Yara.fileID
  description: The file ID of the scanned file.
  type: string
- contextPath: Yara.MatchCount
  description: The number of rules that matched the file.
  type: number
- contextPath: Errors
  description: A list of errors that occurred during the scan.
- contextPath: Matches
  description: The matches from the YARA scan.
  type: unknown
- contextPath: Matches.Meta
  description: Metadata about the rule (as defined in the rule itself).
- contextPath: Matches.Namespace
  description: The namespace defined in the rule.
  type: string
- contextPath: Matches.RuleName
  description: The rule name that matched.
  type: string
- contextPath: Matches.Strings
  description: A list of strings that the rule matched.
  type: string
- contextPath: Matches.Tags
  description: A list of tags that are defined in the rule.
tests:
- No tests (auto formatted)
contentitemexportablefields:
  contentitemfields: {}