mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
srv-rr-gh-researchbt
@@ -0,0 +1,750 @@
|
||||
{
|
||||
"blockly": false,
|
||||
"blockly_xml": "<xml></xml>",
|
||||
"category": "Dynamic Analysis",
|
||||
"coa": {
|
||||
"data": {
|
||||
"description": "Accepts a URL or vault_id and does reputation analysis on the objects. Generates a global report and a per observable sub-report and normalized score. The score can be customized based on a variety of factors.",
|
||||
"edges": [
|
||||
{
|
||||
"id": "port_4_to_port_7",
|
||||
"sourceNode": "4",
|
||||
"sourcePort": "4_out",
|
||||
"targetNode": "7",
|
||||
"targetPort": "7_in"
|
||||
},
|
||||
{
|
||||
"id": "port_15_to_port_21",
|
||||
"sourceNode": "15",
|
||||
"sourcePort": "15_out",
|
||||
"targetNode": "21",
|
||||
"targetPort": "21_in"
|
||||
},
|
||||
{
|
||||
"id": "port_21_to_port_23",
|
||||
"sourceNode": "21",
|
||||
"sourcePort": "21_out",
|
||||
"targetNode": "23",
|
||||
"targetPort": "23_in"
|
||||
},
|
||||
{
|
||||
"id": "port_23_to_port_1",
|
||||
"sourceNode": "23",
|
||||
"sourcePort": "23_out",
|
||||
"targetNode": "1",
|
||||
"targetPort": "1_in"
|
||||
},
|
||||
{
|
||||
"conditions": [
|
||||
{
|
||||
"index": 1
|
||||
}
|
||||
],
|
||||
"id": "port_7_to_port_28",
|
||||
"sourceNode": "7",
|
||||
"sourcePort": "7_out",
|
||||
"targetNode": "28",
|
||||
"targetPort": "28_in"
|
||||
},
|
||||
{
|
||||
"conditions": [
|
||||
{
|
||||
"index": 0
|
||||
}
|
||||
],
|
||||
"id": "port_7_to_port_29",
|
||||
"sourceNode": "7",
|
||||
"sourcePort": "7_out",
|
||||
"targetNode": "29",
|
||||
"targetPort": "29_in"
|
||||
},
|
||||
{
|
||||
"conditions": [
|
||||
{
|
||||
"index": 0
|
||||
}
|
||||
],
|
||||
"id": "port_29_to_port_15",
|
||||
"sourceNode": "29",
|
||||
"sourcePort": "29_out",
|
||||
"targetNode": "15",
|
||||
"targetPort": "15_in"
|
||||
},
|
||||
{
|
||||
"id": "port_0_to_port_30",
|
||||
"sourceNode": "0",
|
||||
"sourcePort": "0_out",
|
||||
"targetNode": "30",
|
||||
"targetPort": "30_in"
|
||||
},
|
||||
{
|
||||
"conditions": [
|
||||
{
|
||||
"index": 0
|
||||
}
|
||||
],
|
||||
"id": "port_30_to_port_4",
|
||||
"sourceNode": "30",
|
||||
"sourcePort": "30_out",
|
||||
"targetNode": "4",
|
||||
"targetPort": "4_in"
|
||||
},
|
||||
{
|
||||
"conditions": [
|
||||
{
|
||||
"index": 1
|
||||
}
|
||||
],
|
||||
"id": "port_30_to_port_5",
|
||||
"sourceNode": "30",
|
||||
"sourcePort": "30_out",
|
||||
"targetNode": "5",
|
||||
"targetPort": "5_in"
|
||||
}
|
||||
],
|
||||
"hash": "358efb4c5735fbc18d68fec373c8911273683ca1",
|
||||
"nodes": {
|
||||
"0": {
|
||||
"data": {
|
||||
"advanced": {
|
||||
"join": []
|
||||
},
|
||||
"functionName": "on_start",
|
||||
"id": "0",
|
||||
"type": "start"
|
||||
},
|
||||
"errors": {},
|
||||
"id": "0",
|
||||
"type": "start",
|
||||
"warnings": {},
|
||||
"x": 330,
|
||||
"y": 0
|
||||
},
|
||||
"1": {
|
||||
"data": {
|
||||
"advanced": {
|
||||
"join": []
|
||||
},
|
||||
"functionName": "on_finish",
|
||||
"id": "1",
|
||||
"type": "end"
|
||||
},
|
||||
"errors": {},
|
||||
"id": "1",
|
||||
"type": "end",
|
||||
"warnings": {},
|
||||
"x": 300,
|
||||
"y": 1340
|
||||
},
|
||||
"15": {
|
||||
"data": {
|
||||
"advanced": {
|
||||
"customName": "merge report",
|
||||
"customNameId": 1,
|
||||
"description": "summary report for all sandbox detonation input playbooks.",
|
||||
"join": [],
|
||||
"note": "summary report for all sandbox detonation input playbooks."
|
||||
},
|
||||
"customDatapaths": {
|
||||
"filter_1": {
|
||||
"condition_1:dispatch_detonation_playbooks:outputs:observable.reputation.confidence": {
|
||||
"contains": [],
|
||||
"isCustomDatapath": true,
|
||||
"label": "condition_1:dispatch_detonation_playbooks:outputs:observable.reputation.confidence",
|
||||
"value": "filtered-data:filter_1:condition_1:dispatch_detonation_playbooks:playbook_output:observable.reputation.confidence"
|
||||
},
|
||||
"condition_1:dispatch_detonation_playbooks:outputs:observable.reputation.score": {
|
||||
"contains": [],
|
||||
"isCustomDatapath": true,
|
||||
"label": "condition_1:dispatch_detonation_playbooks:outputs:observable.reputation.score",
|
||||
"value": "filtered-data:filter_1:condition_1:dispatch_detonation_playbooks:playbook_output:observable.reputation.score"
|
||||
},
|
||||
"condition_1:dispatch_detonation_playbooks:outputs:observable.source": {
|
||||
"contains": [],
|
||||
"isCustomDatapath": true,
|
||||
"label": "condition_1:dispatch_detonation_playbooks:outputs:observable.source",
|
||||
"value": "filtered-data:filter_1:condition_1:dispatch_detonation_playbooks:playbook_output:observable.source"
|
||||
},
|
||||
"condition_1:dispatch_detonation_playbooks:outputs:observable.value": {
|
||||
"contains": [],
|
||||
"isCustomDatapath": true,
|
||||
"label": "condition_1:dispatch_detonation_playbooks:outputs:observable.value",
|
||||
"value": "filtered-data:filter_1:condition_1:dispatch_detonation_playbooks:playbook_output:observable.value"
|
||||
}
|
||||
}
|
||||
},
|
||||
"functionId": 1,
|
||||
"functionName": "merge_report_1",
|
||||
"id": "15",
|
||||
"parameters": [
|
||||
"filtered-data:filter_dispatch_output:condition_1:dispatch_detonation_playbooks:playbook_output:observable.value",
|
||||
"filtered-data:filter_dispatch_output:condition_1:dispatch_detonation_playbooks:playbook_output:observable.reputation.score",
|
||||
"filtered-data:filter_dispatch_output:condition_1:dispatch_detonation_playbooks:playbook_output:observable.reputation.confidence",
|
||||
"filtered-data:filter_dispatch_output:condition_1:dispatch_detonation_playbooks:playbook_output:observable.source"
|
||||
],
|
||||
"template": "SOAR detonated indicators in connected sandboxes. The table below shows a summary of the information gathered.\n\n| Value | Score | Confidence | Source |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3} |\n%%",
|
||||
"type": "format"
|
||||
},
|
||||
"errors": {},
|
||||
"id": "15",
|
||||
"type": "format",
|
||||
"userCode": "\n # Write your custom code here...\n phantom.debug(phantom.format(container=container, template=template, parameters=parameters, name=\"merge_report_1\"))\n",
|
||||
"warnings": {},
|
||||
"x": 280,
|
||||
"y": 866
|
||||
},
|
||||
"21": {
|
||||
"data": {
|
||||
"advanced": {
|
||||
"customName": "indicator tag",
|
||||
"customNameId": 0,
|
||||
"join": []
|
||||
},
|
||||
"customDatapaths": {
|
||||
"filter_dispatch_output": {
|
||||
"condition_1:dispatch_detonation_playbooks:outputs:observable.classifications": {
|
||||
"contains": [],
|
||||
"isCustomDatapath": true,
|
||||
"label": "condition_1:dispatch_detonation_playbooks:outputs:observable.classifications",
|
||||
"value": "filtered-data:filter_dispatch_output:condition_1:dispatch_detonation_playbooks:playbook_output:observable.classifications"
|
||||
},
|
||||
"condition_1:dispatch_detonation_playbooks:outputs:observable.value": {
|
||||
"contains": [],
|
||||
"isCustomDatapath": true,
|
||||
"label": "condition_1:dispatch_detonation_playbooks:outputs:observable.value",
|
||||
"value": "filtered-data:filter_dispatch_output:condition_1:dispatch_detonation_playbooks:playbook_output:observable.value"
|
||||
}
|
||||
}
|
||||
},
|
||||
"customFunction": {
|
||||
"draftMode": false,
|
||||
"name": "indicator_tag",
|
||||
"repoName": "community"
|
||||
},
|
||||
"functionId": 4,
|
||||
"functionName": "indicator_tag",
|
||||
"id": "21",
|
||||
"selectMore": false,
|
||||
"type": "utility",
|
||||
"utilities": {
|
||||
"indicator_tag": {
|
||||
"description": "Tag an existing indicator record. Tags can be overwritten or appended.",
|
||||
"fields": [
|
||||
{
|
||||
"dataTypes": [
|
||||
"*"
|
||||
],
|
||||
"description": "Specifies the indicator which the tag will be added to. Supports a string indicator value or an indicator id.",
|
||||
"inputType": "item",
|
||||
"label": "indicator",
|
||||
"name": "indicator",
|
||||
"placeholder": "my_indicator",
|
||||
"renderType": "datapath",
|
||||
"required": false
|
||||
},
|
||||
{
|
||||
"dataTypes": [
|
||||
"*"
|
||||
],
|
||||
"description": "Comma separated list of tags. Tags should only contain characters Aa-Zz, 0-9, '-', and '_'.",
|
||||
"inputType": "item",
|
||||
"label": "tags",
|
||||
"name": "tags",
|
||||
"placeholder": "tag1,tag2,...,tagk",
|
||||
"renderType": "datapath",
|
||||
"required": false
|
||||
},
|
||||
{
|
||||
"dataTypes": [],
|
||||
"description": "Either True or False with default as False. If set to True, existing tags on the indicator record will be replaced by the provided input. If set to False, the new tags will be appended to the existing indicator tags.",
|
||||
"inputType": "item",
|
||||
"label": "overwrite",
|
||||
"name": "overwrite",
|
||||
"placeholder": "False",
|
||||
"renderType": "datapath",
|
||||
"required": false
|
||||
}
|
||||
],
|
||||
"label": "indicator_tag",
|
||||
"name": "indicator_tag"
|
||||
}
|
||||
},
|
||||
"utilityType": "custom_function",
|
||||
"values": {
|
||||
"indicator_tag": {
|
||||
"indicator": "filtered-data:filter_dispatch_output:condition_1:dispatch_detonation_playbooks:playbook_output:observable.value",
|
||||
"overwrite": null,
|
||||
"tags": "filtered-data:filter_dispatch_output:condition_1:dispatch_detonation_playbooks:playbook_output:observable.classifications"
|
||||
}
|
||||
}
|
||||
},
|
||||
"errors": {},
|
||||
"id": "21",
|
||||
"type": "utility",
|
||||
"warnings": {},
|
||||
"x": 280,
|
||||
"y": 1040
|
||||
},
|
||||
"23": {
|
||||
"data": {
|
||||
"advanced": {
|
||||
"customName": "workbook update task",
|
||||
"customNameId": 0,
|
||||
"join": []
|
||||
},
|
||||
"customFunction": {
|
||||
"draftMode": false,
|
||||
"name": "workbook_task_update",
|
||||
"repoName": "community"
|
||||
},
|
||||
"functionId": 6,
|
||||
"functionName": "workbook_update_task",
|
||||
"id": "23",
|
||||
"selectMore": false,
|
||||
"type": "utility",
|
||||
"utilities": {
|
||||
"workbook_task_update": {
|
||||
"description": "Update a workbook task by task name or the task where the currently running playbook appears. Requires a task_name, container_id, and a note_title, note_content, owner, or status.",
|
||||
"fields": [
|
||||
{
|
||||
"dataTypes": [
|
||||
"*"
|
||||
],
|
||||
"description": "Name of a workbook task or keyword 'playbook' to update the task where the currently running playbook appears. (Required)",
|
||||
"inputType": "item",
|
||||
"label": "task_name",
|
||||
"name": "task_name",
|
||||
"placeholder": "my_task",
|
||||
"renderType": "datapath",
|
||||
"required": false
|
||||
},
|
||||
{
|
||||
"dataTypes": [
|
||||
"*"
|
||||
],
|
||||
"description": "Note title. (Optional)",
|
||||
"inputType": "item",
|
||||
"label": "note_title",
|
||||
"name": "note_title",
|
||||
"placeholder": "My Title",
|
||||
"renderType": "datapath",
|
||||
"required": false
|
||||
},
|
||||
{
|
||||
"dataTypes": [
|
||||
"*"
|
||||
],
|
||||
"description": "Note content. (Optional)",
|
||||
"inputType": "item",
|
||||
"label": "note_content",
|
||||
"name": "note_content",
|
||||
"placeholder": "My notes",
|
||||
"renderType": "datapath",
|
||||
"required": false
|
||||
},
|
||||
{
|
||||
"dataTypes": [
|
||||
"*"
|
||||
],
|
||||
"description": "Accepts 'incomplete', 'in_progress, or 'complete'. (Optional)",
|
||||
"inputType": "item",
|
||||
"label": "status",
|
||||
"name": "status",
|
||||
"placeholder": "in_progress",
|
||||
"renderType": "datapath",
|
||||
"required": false
|
||||
},
|
||||
{
|
||||
"dataTypes": [
|
||||
"*"
|
||||
],
|
||||
"description": "A user to assign as the task owner or keyword 'current\" to assign the task to the user that launched the playbook. (Optional)",
|
||||
"inputType": "item",
|
||||
"label": "owner",
|
||||
"name": "owner",
|
||||
"placeholder": "username",
|
||||
"renderType": "datapath",
|
||||
"required": false
|
||||
},
|
||||
{
|
||||
"dataTypes": [
|
||||
"phantom container id"
|
||||
],
|
||||
"description": "The ID of a SOAR Container. (Required)",
|
||||
"inputType": "item",
|
||||
"label": "container",
|
||||
"name": "container",
|
||||
"placeholder": "container:id",
|
||||
"renderType": "datapath",
|
||||
"required": false
|
||||
}
|
||||
],
|
||||
"label": "workbook_task_update",
|
||||
"name": "workbook_task_update"
|
||||
}
|
||||
},
|
||||
"utilityType": "custom_function",
|
||||
"values": {
|
||||
"workbook_task_update": {
|
||||
"container": "container:id",
|
||||
"note_content": "merge_report_1:formatted_data",
|
||||
"note_title": "Automatic Dynamic Analysis Report",
|
||||
"owner": null,
|
||||
"status": "complete",
|
||||
"task_name": "playbook"
|
||||
}
|
||||
}
|
||||
},
|
||||
"errors": {},
|
||||
"id": "23",
|
||||
"type": "utility",
|
||||
"warnings": {},
|
||||
"x": 280,
|
||||
"y": 1200
|
||||
},
|
||||
"28": {
|
||||
"data": {
|
||||
"advanced": {
|
||||
"customName": "no observables comment",
|
||||
"customNameId": 0,
|
||||
"description": "observable output of detonation playbooks does not exist",
|
||||
"join": [],
|
||||
"note": "observable output of detonation playbooks not exits."
|
||||
},
|
||||
"functionId": 2,
|
||||
"functionName": "no_observables_comment",
|
||||
"id": "28",
|
||||
"selectMore": false,
|
||||
"tab": "apis",
|
||||
"type": "utility",
|
||||
"utilities": {
|
||||
"comment": {
|
||||
"description": "",
|
||||
"fields": [
|
||||
{
|
||||
"description": "",
|
||||
"label": "comment",
|
||||
"name": "comment",
|
||||
"placeholder": "Enter a comment",
|
||||
"renderType": "datapath",
|
||||
"required": true
|
||||
},
|
||||
{
|
||||
"hidden": true,
|
||||
"name": "container",
|
||||
"required": false
|
||||
},
|
||||
{
|
||||
"hidden": true,
|
||||
"name": "author",
|
||||
"required": false
|
||||
},
|
||||
{
|
||||
"hidden": true,
|
||||
"name": "trace",
|
||||
"required": false
|
||||
}
|
||||
],
|
||||
"label": "add comment",
|
||||
"name": "comment"
|
||||
}
|
||||
},
|
||||
"utilityType": "api",
|
||||
"values": {
|
||||
"comment": {
|
||||
"_internal": [
|
||||
"container",
|
||||
"author",
|
||||
"trace"
|
||||
],
|
||||
"comment": "No observable output found for dispatched playbooks."
|
||||
}
|
||||
}
|
||||
},
|
||||
"errors": {},
|
||||
"id": "28",
|
||||
"type": "utility",
|
||||
"warnings": {},
|
||||
"x": 0,
|
||||
"y": 680
|
||||
},
|
||||
"29": {
|
||||
"data": {
|
||||
"advanced": {
|
||||
"customName": "filter dispatch output",
|
||||
"customNameId": 0,
|
||||
"description": "Filter out any results that are Null.",
|
||||
"join": [],
|
||||
"note": "Filter out any results that are Null."
|
||||
},
|
||||
"conditions": [
|
||||
{
|
||||
"comparisons": [
|
||||
{
|
||||
"conditionIndex": 0,
|
||||
"op": "!=",
|
||||
"param": "dispatch_detonation_playbooks:playbook_output:observable",
|
||||
"value": ""
|
||||
}
|
||||
],
|
||||
"conditionIndex": 0,
|
||||
"customName": "output exists",
|
||||
"logic": "and"
|
||||
}
|
||||
],
|
||||
"functionId": 1,
|
||||
"functionName": "filter_dispatch_output",
|
||||
"id": "29",
|
||||
"type": "filter"
|
||||
},
|
||||
"errors": {},
|
||||
"id": "29",
|
||||
"type": "filter",
|
||||
"warnings": {},
|
||||
"x": 340,
|
||||
"y": 680
|
||||
},
|
||||
"30": {
|
||||
"data": {
|
||||
"advanced": {
|
||||
"customName": "new artifacts filter",
|
||||
"customNameId": 0,
|
||||
"description": "This block is used to ensure only \"new\" artifacts are utilized.",
|
||||
"join": [],
|
||||
"note": "This block is used to ensure only \"new\" artifacts are utilized."
|
||||
},
|
||||
"conditions": [
|
||||
{
|
||||
"comparisons": [
|
||||
{
|
||||
"conditionIndex": 0,
|
||||
"op": "!=",
|
||||
"param": "artifact:*.id",
|
||||
"value": ""
|
||||
}
|
||||
],
|
||||
"conditionIndex": 0,
|
||||
"customName": "artifacts exist",
|
||||
"logic": "and"
|
||||
},
|
||||
{
|
||||
"comparisons": [
|
||||
{
|
||||
"conditionIndex": 1,
|
||||
"op": "==",
|
||||
"param": "artifact:*.id",
|
||||
"value": ""
|
||||
}
|
||||
],
|
||||
"conditionIndex": 1,
|
||||
"customName": "artifacts do not exist",
|
||||
"logic": "and"
|
||||
}
|
||||
],
|
||||
"functionId": 2,
|
||||
"functionName": "new_artifacts_filter",
|
||||
"id": "30",
|
||||
"type": "filter"
|
||||
},
|
||||
"errors": {},
|
||||
"id": "30",
|
||||
"type": "filter",
|
||||
"warnings": {},
|
||||
"x": 370,
|
||||
"y": 148
|
||||
},
|
||||
"4": {
|
||||
"data": {
|
||||
"advanced": {
|
||||
"customName": "dispatch detonation playbooks",
|
||||
"customNameId": 0,
|
||||
"join": []
|
||||
},
|
||||
"functionId": 1,
|
||||
"functionName": "dispatch_detonation_playbooks",
|
||||
"id": "4",
|
||||
"inputs": {
|
||||
"artifact_ids_include": {
|
||||
"datapaths": [
|
||||
"filtered-data:new_artifacts_filter:condition_1:artifact:*.id"
|
||||
],
|
||||
"deduplicate": false
|
||||
},
|
||||
"indicator_tags_exclude": {
|
||||
"datapaths": [],
|
||||
"deduplicate": false
|
||||
},
|
||||
"indicator_tags_include": {
|
||||
"datapaths": [],
|
||||
"deduplicate": false
|
||||
},
|
||||
"playbook_repo": {
|
||||
"datapaths": [],
|
||||
"deduplicate": false
|
||||
},
|
||||
"playbook_tags": {
|
||||
"datapaths": [
|
||||
"sandbox"
|
||||
],
|
||||
"deduplicate": false
|
||||
}
|
||||
},
|
||||
"playbookName": "dispatch_input_playbooks",
|
||||
"playbookRepo": 3,
|
||||
"playbookRepoName": "community",
|
||||
"playbookType": "data",
|
||||
"synchronous": true,
|
||||
"type": "playbook"
|
||||
},
|
||||
"errors": {},
|
||||
"id": "4",
|
||||
"type": "playbook",
|
||||
"warnings": {},
|
||||
"x": 140,
|
||||
"y": 335
|
||||
},
|
||||
"5": {
|
||||
"data": {
|
||||
"advanced": {
|
||||
"customName": "artifacts check comment",
|
||||
"customNameId": 0,
|
||||
"description": "no url or vault_id artifacts inputs",
|
||||
"join": [],
|
||||
"note": "no url or vault_id artifacts inputs"
|
||||
},
|
||||
"functionId": 1,
|
||||
"functionName": "artifacts_check_comment",
|
||||
"id": "5",
|
||||
"selectMore": false,
|
||||
"tab": "apis",
|
||||
"type": "utility",
|
||||
"utilities": {
|
||||
"comment": {
|
||||
"description": "",
|
||||
"fields": [
|
||||
{
|
||||
"description": "",
|
||||
"label": "comment",
|
||||
"name": "comment",
|
||||
"placeholder": "Enter a comment",
|
||||
"renderType": "datapath",
|
||||
"required": true
|
||||
},
|
||||
{
|
||||
"hidden": true,
|
||||
"name": "container",
|
||||
"required": false
|
||||
},
|
||||
{
|
||||
"hidden": true,
|
||||
"name": "author",
|
||||
"required": false
|
||||
},
|
||||
{
|
||||
"hidden": true,
|
||||
"name": "trace",
|
||||
"required": false
|
||||
}
|
||||
],
|
||||
"label": "add comment",
|
||||
"name": "comment"
|
||||
}
|
||||
},
|
||||
"utilityType": "api",
|
||||
"values": {
|
||||
"comment": {
|
||||
"_internal": [
|
||||
"container",
|
||||
"author",
|
||||
"trace"
|
||||
],
|
||||
"comment": "no url or vault_id artifacts inputs"
|
||||
}
|
||||
}
|
||||
},
|
||||
"errors": {},
|
||||
"id": "5",
|
||||
"type": "utility",
|
||||
"warnings": {},
|
||||
"x": 480,
|
||||
"y": 328
|
||||
},
|
||||
"7": {
|
||||
"data": {
|
||||
"advanced": {
|
||||
"customName": "filter successful observable output",
|
||||
"customNameId": 0,
|
||||
"description": "Filter to check if observable output is successfully generated or not.",
|
||||
"join": [],
|
||||
"note": "Filter to check if observable output is successfully generated or not."
|
||||
},
|
||||
"conditions": [
|
||||
{
|
||||
"comparisons": [
|
||||
{
|
||||
"conditionIndex": 0,
|
||||
"op": "!=",
|
||||
"param": "dispatch_detonation_playbooks:playbook_output:observable",
|
||||
"value": ""
|
||||
}
|
||||
],
|
||||
"conditionIndex": 0,
|
||||
"customName": "observable_exist",
|
||||
"display": "If",
|
||||
"logic": "or",
|
||||
"type": "if"
|
||||
},
|
||||
{
|
||||
"comparisons": [
|
||||
{
|
||||
"conditionIndex": 1,
|
||||
"op": "==",
|
||||
"param": "",
|
||||
"value": ""
|
||||
}
|
||||
],
|
||||
"conditionIndex": 1,
|
||||
"customName": "observable_not_exist",
|
||||
"display": "Else",
|
||||
"logic": "and",
|
||||
"type": "else"
|
||||
}
|
||||
],
|
||||
"functionId": 2,
|
||||
"functionName": "filter_successful_observable_output",
|
||||
"id": "7",
|
||||
"type": "decision"
|
||||
},
|
||||
"errors": {},
|
||||
"id": "7",
|
||||
"type": "decision",
|
||||
"warnings": {},
|
||||
"x": 220,
|
||||
"y": 506
|
||||
}
|
||||
},
|
||||
"notes": "Inputs: url, vault_id\nActions: url detonation, , file detonation\nOutputs: report, indicator tag, workbook update task"
|
||||
},
|
||||
"input_spec": null,
|
||||
"output_spec": null,
|
||||
"playbook_type": "automation",
|
||||
"python_version": "3",
|
||||
"schema": "5.0.9",
|
||||
"version": "6.0.0.114895"
|
||||
},
|
||||
"create_time": "2023-04-29T21:39:15.147763+00:00",
|
||||
"draft_mode": false,
|
||||
"labels": [
|
||||
"*"
|
||||
],
|
||||
"tags": [
|
||||
"urlscan.io",
|
||||
"url",
|
||||
"D3-DA",
|
||||
"CrowdStrike_OAuth_API",
|
||||
"VirusTotal_v3",
|
||||
"sandbox",
|
||||
"vault_id",
|
||||
"SAA"
|
||||
]
|
||||
}
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 115 KiB |
@@ -0,0 +1,295 @@
|
||||
"""
|
||||
Accepts a URL or vault_id and does reputation analysis on the objects. Generates a global report and a per observable sub-report and normalized score. The score can be customized based on a variety of factors.
|
||||
"""
|
||||
|
||||
|
||||
import phantom.rules as phantom
|
||||
import json
|
||||
from datetime import datetime, timedelta
|
||||
|
||||
|
||||
@phantom.playbook_block()
|
||||
def on_start(container):
|
||||
phantom.debug('on_start() called')
|
||||
|
||||
# call 'new_artifacts_filter' block
|
||||
new_artifacts_filter(container=container)
|
||||
|
||||
return
|
||||
|
||||
@phantom.playbook_block()
|
||||
def dispatch_detonation_playbooks(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
|
||||
phantom.debug("dispatch_detonation_playbooks() called")
|
||||
|
||||
filtered_artifact_0_data_new_artifacts_filter = phantom.collect2(container=container, datapath=["filtered-data:new_artifacts_filter:condition_1:artifact:*.id"])
|
||||
|
||||
filtered_artifact_0__id = [item[0] for item in filtered_artifact_0_data_new_artifacts_filter]
|
||||
|
||||
inputs = {
|
||||
"playbook_tags": ["sandbox"],
|
||||
"playbook_repo": [],
|
||||
"indicator_tags_include": [],
|
||||
"indicator_tags_exclude": [],
|
||||
"artifact_ids_include": filtered_artifact_0__id,
|
||||
}
|
||||
|
||||
################################################################################
|
||||
## Custom Code Start
|
||||
################################################################################
|
||||
|
||||
# Write your custom code here...
|
||||
|
||||
################################################################################
|
||||
## Custom Code End
|
||||
################################################################################
|
||||
|
||||
# call playbook "community/dispatch_input_playbooks", returns the playbook_run_id
|
||||
playbook_run_id = phantom.playbook("community/dispatch_input_playbooks", container=container, name="dispatch_detonation_playbooks", callback=filter_successful_observable_output, inputs=inputs)
|
||||
|
||||
return
|
||||
|
||||
|
||||
@phantom.playbook_block()
|
||||
def artifacts_check_comment(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
|
||||
phantom.debug("artifacts_check_comment() called")
|
||||
|
||||
################################################################################
|
||||
# no url or vault_id artifacts inputs
|
||||
################################################################################
|
||||
|
||||
################################################################################
|
||||
## Custom Code Start
|
||||
################################################################################
|
||||
|
||||
# Write your custom code here...
|
||||
|
||||
################################################################################
|
||||
## Custom Code End
|
||||
################################################################################
|
||||
|
||||
phantom.comment(container=container, comment="no url or vault_id artifacts inputs")
|
||||
|
||||
return
|
||||
|
||||
|
||||
@phantom.playbook_block()
|
||||
def filter_successful_observable_output(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
|
||||
phantom.debug("filter_successful_observable_output() called")
|
||||
|
||||
################################################################################
|
||||
# Filter to check if observable output is successfully generated or not.
|
||||
################################################################################
|
||||
|
||||
# check for 'if' condition 1
|
||||
found_match_1 = phantom.decision(
|
||||
container=container,
|
||||
conditions=[
|
||||
["dispatch_detonation_playbooks:playbook_output:observable", "!=", ""]
|
||||
])
|
||||
|
||||
# call connected blocks if condition 1 matched
|
||||
if found_match_1:
|
||||
filter_dispatch_output(action=action, success=success, container=container, results=results, handle=handle)
|
||||
return
|
||||
|
||||
# check for 'else' condition 2
|
||||
no_observables_comment(action=action, success=success, container=container, results=results, handle=handle)
|
||||
|
||||
return
|
||||
|
||||
|
||||
@phantom.playbook_block()
|
||||
def merge_report_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
|
||||
phantom.debug("merge_report_1() called")
|
||||
|
||||
################################################################################
|
||||
# summary report for all sandbox detonation input playbooks.
|
||||
################################################################################
|
||||
|
||||
template = """SOAR detonated indicators in connected sandboxes. The table below shows a summary of the information gathered.\n\n| Value | Score | Confidence | Source |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3} |\n%%"""
|
||||
|
||||
# parameter list for template variable replacement
|
||||
parameters = [
|
||||
"filtered-data:filter_dispatch_output:condition_1:dispatch_detonation_playbooks:playbook_output:observable.value",
|
||||
"filtered-data:filter_dispatch_output:condition_1:dispatch_detonation_playbooks:playbook_output:observable.reputation.score",
|
||||
"filtered-data:filter_dispatch_output:condition_1:dispatch_detonation_playbooks:playbook_output:observable.reputation.confidence",
|
||||
"filtered-data:filter_dispatch_output:condition_1:dispatch_detonation_playbooks:playbook_output:observable.source"
|
||||
]
|
||||
|
||||
################################################################################
|
||||
## Custom Code Start
|
||||
################################################################################
|
||||
|
||||
# Write your custom code here...
|
||||
phantom.debug(phantom.format(container=container, template=template, parameters=parameters, name="merge_report_1"))
|
||||
################################################################################
|
||||
## Custom Code End
|
||||
################################################################################
|
||||
|
||||
phantom.format(container=container, template=template, parameters=parameters, name="merge_report_1")
|
||||
|
||||
indicator_tag(container=container)
|
||||
|
||||
return
|
||||
|
||||
|
||||
@phantom.playbook_block()
|
||||
def indicator_tag(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
|
||||
phantom.debug("indicator_tag() called")
|
||||
|
||||
filtered_output_0_dispatch_detonation_playbooks_output_observable = phantom.collect2(container=container, datapath=["filtered-data:filter_dispatch_output:condition_1:dispatch_detonation_playbooks:playbook_output:observable.classifications","filtered-data:filter_dispatch_output:condition_1:dispatch_detonation_playbooks:playbook_output:observable.value"])
|
||||
|
||||
parameters = []
|
||||
|
||||
# build parameters list for 'indicator_tag' call
|
||||
for filtered_output_0_dispatch_detonation_playbooks_output_observable_item in filtered_output_0_dispatch_detonation_playbooks_output_observable:
|
||||
parameters.append({
|
||||
"tags": filtered_output_0_dispatch_detonation_playbooks_output_observable_item[0],
|
||||
"indicator": filtered_output_0_dispatch_detonation_playbooks_output_observable_item[1],
|
||||
"overwrite": None,
|
||||
})
|
||||
|
||||
################################################################################
|
||||
## Custom Code Start
|
||||
################################################################################
|
||||
|
||||
# Write your custom code here...
|
||||
|
||||
################################################################################
|
||||
## Custom Code End
|
||||
################################################################################
|
||||
|
||||
phantom.custom_function(custom_function="community/indicator_tag", parameters=parameters, name="indicator_tag", callback=workbook_update_task)
|
||||
|
||||
return
|
||||
|
||||
|
||||
@phantom.playbook_block()
|
||||
def workbook_update_task(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
|
||||
phantom.debug("workbook_update_task() called")
|
||||
|
||||
id_value = container.get("id", None)
|
||||
merge_report_1 = phantom.get_format_data(name="merge_report_1")
|
||||
|
||||
parameters = []
|
||||
|
||||
parameters.append({
|
||||
"owner": None,
|
||||
"status": "complete",
|
||||
"container": id_value,
|
||||
"task_name": "playbook",
|
||||
"note_title": "Automatic Dynamic Analysis Report",
|
||||
"note_content": merge_report_1,
|
||||
})
|
||||
|
||||
################################################################################
|
||||
## Custom Code Start
|
||||
################################################################################
|
||||
|
||||
# Write your custom code here...
|
||||
|
||||
################################################################################
|
||||
## Custom Code End
|
||||
################################################################################
|
||||
|
||||
phantom.custom_function(custom_function="community/workbook_task_update", parameters=parameters, name="workbook_update_task")
|
||||
|
||||
return
|
||||
|
||||
|
||||
@phantom.playbook_block()
|
||||
def no_observables_comment(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
|
||||
phantom.debug("no_observables_comment() called")
|
||||
|
||||
################################################################################
|
||||
# observable output of detonation playbooks does not exist
|
||||
################################################################################
|
||||
|
||||
################################################################################
|
||||
## Custom Code Start
|
||||
################################################################################
|
||||
|
||||
# Write your custom code here...
|
||||
|
||||
################################################################################
|
||||
## Custom Code End
|
||||
################################################################################
|
||||
|
||||
phantom.comment(container=container, comment="No observable output found for dispatched playbooks.")
|
||||
|
||||
return
|
||||
|
||||
|
||||
@phantom.playbook_block()
|
||||
def filter_dispatch_output(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
|
||||
phantom.debug("filter_dispatch_output() called")
|
||||
|
||||
################################################################################
|
||||
# Filter out any results that are Null.
|
||||
################################################################################
|
||||
|
||||
# collect filtered artifact ids and results for 'if' condition 1
|
||||
matched_artifacts_1, matched_results_1 = phantom.condition(
|
||||
container=container,
|
||||
conditions=[
|
||||
["dispatch_detonation_playbooks:playbook_output:observable", "!=", ""]
|
||||
],
|
||||
name="filter_dispatch_output:condition_1")
|
||||
|
||||
# call connected blocks if filtered artifacts or results
|
||||
if matched_artifacts_1 or matched_results_1:
|
||||
merge_report_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
|
||||
|
||||
return
|
||||
|
||||
|
||||
@phantom.playbook_block()
|
||||
def new_artifacts_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
|
||||
phantom.debug("new_artifacts_filter() called")
|
||||
|
||||
################################################################################
|
||||
# This block is used to ensure only "new" artifacts are utilized.
|
||||
################################################################################
|
||||
|
||||
# collect filtered artifact ids and results for 'if' condition 1
|
||||
matched_artifacts_1, matched_results_1 = phantom.condition(
|
||||
container=container,
|
||||
conditions=[
|
||||
["artifact:*.id", "!=", ""]
|
||||
],
|
||||
name="new_artifacts_filter:condition_1")
|
||||
|
||||
# call connected blocks if filtered artifacts or results
|
||||
if matched_artifacts_1 or matched_results_1:
|
||||
dispatch_detonation_playbooks(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
|
||||
|
||||
# collect filtered artifact ids and results for 'if' condition 2
|
||||
matched_artifacts_2, matched_results_2 = phantom.condition(
|
||||
container=container,
|
||||
conditions=[
|
||||
["artifact:*.id", "==", ""]
|
||||
],
|
||||
name="new_artifacts_filter:condition_2")
|
||||
|
||||
# call connected blocks if filtered artifacts or results
|
||||
if matched_artifacts_2 or matched_results_2:
|
||||
artifacts_check_comment(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)
|
||||
|
||||
return
|
||||
|
||||
|
||||
@phantom.playbook_block()
|
||||
def on_finish(container, summary):
|
||||
phantom.debug("on_finish() called")
|
||||
|
||||
################################################################################
|
||||
## Custom Code Start
|
||||
################################################################################
|
||||
|
||||
# Write your custom code here...
|
||||
|
||||
################################################################################
|
||||
## Custom Code End
|
||||
################################################################################
|
||||
|
||||
return
|
||||
@@ -0,0 +1,28 @@
|
||||
name: Dynamic Analysis Dispatch
|
||||
id: a15da934-1f59-4672-b98c-ec1bbfd80885
|
||||
version: 1
|
||||
date: '2023-03-30'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: Investigation
|
||||
description: Automatically dispatches input playbooks with the 'sandbox' tag.
|
||||
This will produce a merge report and indicator tag for each inputs.
|
||||
playbook: Dynamic_Analysis_Dispatch
|
||||
how_to_implement: This automatic playbook requires "sandbox" tag be present on each input playbook you want to launch.
|
||||
references: []
|
||||
app_list:
|
||||
- CrowdStrike OAuth API
|
||||
- urlscan.io
|
||||
- VirusTotal_v3
|
||||
- SAA
|
||||
tags:
|
||||
platform_tags:
|
||||
- url
|
||||
- domain
|
||||
- sandbox
|
||||
- ip
|
||||
- vault_id
|
||||
playbook_type: Automatic
|
||||
vpe_type: Modern
|
||||
playbook_fields: []
|
||||
product:
|
||||
- Splunk SOAR
|
||||
Reference in New Issue
Block a user