id: malware_investigation-_generic_-_setup
version: -1
name: Malware Investigation - Generic - Setup
description: |-
  Deprecated. Verify file sample and hostname information for the "Malware Investigation - Generic" playbook.
  If the file sample or hostname are missing, the playbook will attempt to retrieve them using one or more integrations
fromversion: 5.0.0
starttaskid: "0"
hidden: true
tasks:
  "0":
    id: "0"
    taskid: f32e3309-cd35-442c-89bb-aedad44e51bc
    type: start
    task:
      id: f32e3309-cd35-442c-89bb-aedad44e51bc
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 50
        }
      }
  "1":
    id: "1"
    taskid: 6cb37fdd-3179-44d7-8846-a16dcc2062f6
    type: title
    task:
      id: 6cb37fdd-3179-44d7-8846-a16dcc2062f6
      version: -1
      name: Validate file sample
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 195
        }
      }
  "2":
    id: "2"
    taskid: c7670e54-f3e4-4a0d-89c9-e9340888ae6b
    type: condition
    task:
      id: c7670e54-f3e4-4a0d-89c9-e9340888ae6b
      version: -1
      name: Do we have a file sample?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: inputs.File
                filters:
                - - operator: general.isExists
                    left:
                      value:
                        simple: inputs.File.EntryID
                      iscontext: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 340
        }
      }
  "3":
    id: "3"
    taskid: 3c625815-68d5-4647-8891-11ba875c03c5
    type: title
    task:
      id: 3c625815-68d5-4647-8891-11ba875c03c5
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1527
        }
      }
  "5":
    id: "5"
    taskid: a0a3c0b4-515b-4cf6-8347-cdb7faa041f3
    type: playbook
    task:
      id: a0a3c0b4-515b-4cf6-8347-cdb7faa041f3
      version: -1
      name: Get File Sample By Hash - Generic
      description: ""
      playbookName: Get File Sample By Hash - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      MD5:
        complex:
          root: inputs.MD5
      SHA256:
        complex:
          root: inputs.SHA256
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 117.5,
          "y": 660
        }
      }
  "6":
    id: "6"
    taskid: 2b71b1fe-ddb3-482a-8166-a8967829aba1
    type: condition
    task:
      id: 2b71b1fe-ddb3-482a-8166-a8967829aba1
      version: -1
      name: Did we get a file sample?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: File
                filters:
                - - operator: general.isExists
                    left:
                      value:
                        simple: File.EntryID
                      iscontext: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": -85,
          "y": 970
        }
      }
  "7":
    id: "7"
    taskid: 496fdc1e-a8b5-421f-8d42-a29432859fd3
    type: title
    task:
      id: 496fdc1e-a8b5-421f-8d42-a29432859fd3
      version: -1
      name: File sample is missing
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -85,
          "y": 1213
        }
      }
  "8":
    id: "8"
    taskid: 06ca5c31-261e-40b2-826d-1e0b6b994130
    type: regular
    task:
      id: 06ca5c31-261e-40b2-826d-1e0b6b994130
      version: -1
      name: Manually upload file sample
      description: ""
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -85,
          "y": 1350
        }
      }
  "10":
    id: "10"
    taskid: 52be4e01-b393-484d-8462-fc518e9dc3c2
    type: title
    task:
      id: 52be4e01-b393-484d-8462-fc518e9dc3c2
      version: -1
      name: Try to get file sample
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -85,
          "y": 515
        }
      }
  "11":
    id: "11"
    taskid: bb16ce78-06ab-4251-81a9-4a3bcd31426e
    type: playbook
    task:
      id: bb16ce78-06ab-4251-81a9-4a3bcd31426e
      version: -1
      name: Get File Sample From Path - Generic
      description: ""
      playbookName: Get File Sample From Path - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      Hostname:
        complex:
          root: inputs.Hostname
      Path:
        complex:
          root: inputs.Path
      UseD2:
        simple: "no"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": -290,
          "y": 660
        }
      }
  "12":
    id: "12"
    taskid: cd33187e-1841-4fc0-82d0-92a0aff2bed1
    type: title
    task:
      id: cd33187e-1841-4fc0-82d0-92a0aff2bed1
      version: -1
      name: Validate endpoint
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 195
        }
      }
  "13":
    id: "13"
    taskid: ad325a74-79b8-49d4-8332-59488cad36d1
    type: condition
    task:
      id: ad325a74-79b8-49d4-8332-59488cad36d1
      version: -1
      name: Do we have a Hostname?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: inputs.Hostname
            iscontext: true
    view: |-
      {
        "position": {
          "x": 645,
          "y": 340
        }
      }
  "14":
    id: "14"
    taskid: 9df62264-a011-4474-8504-ec1eeeaeb32a
    type: playbook
    task:
      id: 9df62264-a011-4474-8504-ec1eeeaeb32a
      version: -1
      name: Search Endpoints By Hash - Generic
      description: Hunt using available tools
      playbookName: Search Endpoints By Hash - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      MD5Hash:
        complex:
          root: inputs.MD5
      SHA1Hash:
        complex:
          root: inputs.SHA1
      SHA256Hash:
        complex:
          root: inputs.SHA256
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 645,
          "y": 565
        }
      }
  "15":
    id: "15"
    taskid: 5afea8b2-3723-4c9b-81e5-0a8565d11903
    type: condition
    task:
      id: 5afea8b2-3723-4c9b-81e5-0a8565d11903
      version: -1
      name: Did we get a Hostname?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "16"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: Endpoint
                accessor: Hostname
            iscontext: true
    view: |-
      {
        "position": {
          "x": 645,
          "y": 755
        }
      }
  "16":
    id: "16"
    taskid: 91e8996a-4e32-4041-882d-f37d07c4c54c
    type: title
    task:
      id: 91e8996a-4e32-4041-882d-f37d07c4c54c
      version: -1
      name: Hostname is missing
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 1035
        }
      }
  "17":
    id: "17"
    taskid: 9b2ade69-a18a-4ef6-8492-24467f71b7eb
    type: regular
    task:
      id: 9b2ade69-a18a-4ef6-8492-24467f71b7eb
      version: -1
      name: Manually enter a Hostname
      description: ""
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      append: {}
      key:
        simple: Endpoint.Hostname
      value: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 1198
        }
      }
  "18":
    id: "18"
    taskid: 98cf5f35-2be9-49ab-8e2f-aa6c5ab9873b
    type: title
    task:
      id: 98cf5f35-2be9-49ab-8e2f-aa6c5ab9873b
      version: -1
      name: Check file sample results
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -85,
          "y": 825
        }
      }
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1542,
        "width": 1315,
        "x": -290,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: Malware sample to investigation
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: MD5 to investigation
- key: SHA1
  value:
    complex:
      root: File
      accessor: SHA1
  required: false
  description: SHA1 to investigation
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
  required: false
  description: SHA256 to investigation
- key: Hostname
  value:
    complex:
      root: Endpoint
      accessor: Hostname
  required: false
  description: Hostname to investigation
- key: Path
  value:
    complex:
      root: File
      accessor: Path
  required: false
  description: File path to get sample from
outputs:
- contextPath: Endpoint
  description: The endpoint
  type: unknown
- contextPath: Endpoint.Hostname
  description: Device hostname
  type: string
- contextPath: File
  description: File sample object
  type: unknown
tests:
- No test - Need to do
deprecated: true