id: Detonate URL - ThreatGrid v2
version: -1
name: Detonate URL - ThreatGrid v2
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a40217c5-eb07-4e3b-885d-36424a2c5a85
    type: start
    task:
      id: a40217c5-eb07-4e3b-885d-36424a2c5a85
      description: start
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 180c1045-80de-4ba7-8b95-a6f038647bc0
    type: regular
    task:
      id: 180c1045-80de-4ba7-8b95-a6f038647bc0
      version: -1
      name: ThreatGrid Upload URL
      description: Submits a sample to threat grid for analysis. URL or file, not both.
      script: '|||threat-grid-sample-upload'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      interval_in_seconds:
        complex:
          root: inputs.interval
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.interval
                iscontext: true
      timeout_in_seconds:
        complex:
          root: inputs.timeout
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.timeout
                iscontext: true
      url:
        complex:
          root: inputs.URL
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 280,
          "y": 550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 1e5d0366-d6ce-4020-8870-277914fc2ca3
    type: condition
    task:
      id: 1e5d0366-d6ce-4020-8870-277914fc2ca3
      description: Verify that there is a valid ThreatGrid instance enabled.
      version: -1
      name: Is ThreatGrid enabled?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: ThreatGridv2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
          right:
            value: {}
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 805f6930-a82e-438d-88ef-c30ae9d8f3c8
    type: title
    task:
      id: 805f6930-a82e-438d-88ef-c30ae9d8f3c8
      description: title
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 67c20c58-de92-41a6-8418-8eac9bb52eb4
    type: condition
    task:
      id: 67c20c58-de92-41a6-8418-8eac9bb52eb4
      description: Verify that there is a URL to detonate.
      version: -1
      name: Is there a URL to detonate?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "4_3_#default#": 0.61
    },
    "paper": {
      "dimensions": {
        "height": 735,
        "width": 610,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: false
  description: URL of the sites to detonate.
  playbookInputQuery:
- key: timeout
  value:
    simple: "60"
  required: false
  description: Indicates the time in seconds until the polling sequence times out. Default is 60.
  playbookInputQuery:
- key: interval
  value:
    simple: "10"
  required: false
  description: Indicates the time in seconds to wait between command execution when 'polling' argument is true. Minimum value is 10 seconds. Default is 10.
  playbookInputQuery:
outputs:
- contextPath: ThreatGrid.Sample.id
  description: The sample id
  type: string
- contextPath: ThreatGrid.Sample.filename
  description: The sample filename
  type: string
- contextPath: ThreatGrid.Sample.state
  description: The state of the sample, one of a stable set of strings "wait, prep, run, proc, succ, fail"
  type: string
- contextPath: ThreatGrid.Sample.status
  description: The sample status
  type: string
- contextPath: ThreatGrid.Sample.md5
  description: The sample md5
  type: string
- contextPath: ThreatGrid.Sample.sha1
  description: The sample sha1
  type: string
- contextPath: ThreatGrid.Sample.sha256
  description: The sample sha256
  type: string
- contextPath: ThreatGrid.Sample.os
  description: The sample os
  type: string
- contextPath: ThreatGrid.Sample.submitted_at
  description: The sample submission time
  type: string
fromversion: 5.0.0
description: Detonate one or more URLs using the ThreatGrid integration.
tests:
- Detonate URL - Generic Test
contentitemexportablefields:
  contentitemfields:
    propagationLabels:
    - all