diff --git a/playbooks/block_indicators.json b/playbooks/block_indicators.json
new file mode 100644
index 0000000000..db7387542f
--- /dev/null
+++ b/playbooks/block_indicators.json
@@ -0,0 +1,3808 @@
+{
+ "blockly": false,
+ "blockly_xml": "",
+ "category": "Use Cases",
+ "misc": { "apps_list": ["Palo Alto Networks Firewall", "Carbon Black Response", "OpenDNS Umbrella", "Phantom"] },
+ "coa": {
+ "data": {
+ "clean": true,
+ "code_block": "",
+ "description": "This playbook retrieves IP addresses, domains, and file hashes, blocks them on various services, and adds them to specific blocklists as custom lists.",
+ "hash": "753b457bfed5fa341dd36803c11b681681df46f6",
+ "joint": {
+ "cells": [
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "70140aee-e625-43c7-bf11-da4d1bc729c1",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "0aa8e6f7-9c21-41b7-8930-8c2416a0509a",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "81b07a3a-01ac-4d3a-b254-9cb7a3e97392",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 27
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "8f7b00cd-6206-4e1f-a1fd-c17ca7df99d1",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "0aa8e6f7-9c21-41b7-8930-8c2416a0509a",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "d230871e-ee71-44a6-af7f-fb4f2f584da4",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 43
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "d333fcd2-eb73-4914-8e92-ad8551a6b068",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "0aa8e6f7-9c21-41b7-8930-8c2416a0509a",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "ea4b2594-8ef5-42a4-8285-125126536531",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 66
+ },
+ {
+ "0": "S",
+ "1": "T",
+ "2": "A",
+ "3": "R",
+ "4": "T",
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "ref-x": 33,
+ "ref-y": 8,
+ "text": "START"
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "ref-x": 13,
+ "xlink:href": "/inc/coa/img/block_icon_start.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ }
+ },
+ "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'filter_1' block\n filter_1(container=container)\n\n # call 'filter_2' block\n filter_2(container=container)\n\n # call 'filter_3' block\n filter_3(container=container)\n\n return",
+ "callback_code": "# read-only block view not available",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "0aa8e6f7-9c21-41b7-8930-8c2416a0509a",
+ "inPorts": [],
+ "join_code": "# read-only block view not available",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 22,
+ "line_start": 8,
+ "name": "",
+ "notes": "",
+ "number": 0,
+ "order": 1,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 180,
+ "y": 40
+ },
+ "previous_function": "",
+ "previous_name": "",
+ "show_number": true,
+ "size": {
+ "height": 54,
+ "width": 80
+ },
+ "status": "",
+ "title": "START",
+ "type": "coa.StartEnd",
+ "warn": false,
+ "z": 95
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "f157b9dd-877a-4fbe-94c7-7709af7c1ceb",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "81b07a3a-01ac-4d3a-b254-9cb7a3e97392",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "9537d314-97d6-484b-ae20-3d9564bab6d6",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 160
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "98116e8f-35f5-4a4d-b09d-f2f254b3f36a",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "9537d314-97d6-484b-ae20-3d9564bab6d6",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "7a912b77-6a81-421d-b6f5-d865b3fffd73",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 177
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "ea7e5f03-8b63-43f5-a2cb-1adf63b89c88",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "7a912b77-6a81-421d-b6f5-d865b3fffd73",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "08306503-f5d1-4cd0-b32b-90a7670ff1ca",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 190
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "429dcfde-c34b-40f8-9b0b-9614e6f0cb75",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "08306503-f5d1-4cd0-b32b-90a7670ff1ca",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "7d6e7306-cd84-4798-bb84-804b79fb09ef",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 250
+ },
+ {
+ "0": "E",
+ "1": "N",
+ "2": "D",
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".title": {
+ "text": "END"
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_end.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ }
+ },
+ "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return",
+ "callback_code": "# read-only block view not available",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "add to IP blocklist, add to domain blocklist, add to hash blocklist",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "7d6e7306-cd84-4798-bb84-804b79fb09ef",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "# read-only block view not available",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 297,
+ "line_start": 284,
+ "name": "",
+ "notes": "",
+ "number": 0,
+ "order": 14,
+ "outPorts": [],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1080,
+ "y": 40
+ },
+ "previous_function": "",
+ "previous_name": "",
+ "show_number": true,
+ "size": {
+ "height": 54,
+ "width": 80
+ },
+ "status": "",
+ "title": "END",
+ "type": "coa.StartEnd",
+ "warn": false,
+ "z": 264
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "f19bbeed-6445-4a8c-bc7c-a2171961cf69",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "d230871e-ee71-44a6-af7f-fb4f2f584da4",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "7862d46c-23ea-4cda-9ef9-db171fd5ac93",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 277
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "8b252e02-8361-4d12-8663-61c2e8965ed9",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "7862d46c-23ea-4cda-9ef9-db171fd5ac93",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "6ad60d9d-90e4-4515-9931-05f31cc5f87a",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 286
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "fddf6767-1020-4c4e-9178-5bdcc37ef938",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "ea4b2594-8ef5-42a4-8285-125126536531",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "25ad9a87-018a-440b-a48d-3a0bd95226f6",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 288
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "ea23ca12-a7c3-40e3-b38c-67a92493b1b8",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "25ad9a87-018a-440b-a48d-3a0bd95226f6",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "45d563b4-3a4a-4cc8-bf1f-dfe4de434928",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 293
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "778389f4-851e-4b64-b5c1-e567e1277660",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "6ad60d9d-90e4-4515-9931-05f31cc5f87a",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "1924c418-d049-478e-8cfd-ec94eb22f7c6",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 295
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "a111892b-a198-4573-9271-5f68da45f08d",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "1924c418-d049-478e-8cfd-ec94eb22f7c6",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "7d6e7306-cd84-4798-bb84-804b79fb09ef",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 297
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "c17d4063-43db-4dc2-9ec2-b9c554f1a1f8",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "45d563b4-3a4a-4cc8-bf1f-dfe4de434928",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "dced0e6a-538a-4d02-800a-5e5c0caf92f7",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 301
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "0b7d5584-b8cd-47e6-8f0b-455358f4b318",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "dced0e6a-538a-4d02-800a-5e5c0caf92f7",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "7d6e7306-cd84-4798-bb84-804b79fb09ef",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 303
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773",
+ "transform": "rotate(45 30 70)"
+ },
+ ".border": {
+ "transform": "rotate(45 30 70)"
+ },
+ ".inPorts>.port-0>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".number": {
+ "text": 1
+ },
+ ".outPorts>.port-0": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ },
+ "ref-x": 83,
+ "ref-y": 40
+ },
+ ".outPorts>.port-0>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_1() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.destinationAddress\", \"!=\", \"\"],\n ],\n name=\"filter_1:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "81b07a3a-01ac-4d3a-b254-9cb7a3e97392",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 264,
+ "line_start": 247,
+ "name": "filter",
+ "notes": "Filtering on artifacts that have the destinationAddress CEF value populated.",
+ "number": 1,
+ "order": 12,
+ "outPorts": [
+ "out-1"
+ ],
+ "outputs": [
+ {
+ "conditions": [
+ {
+ "comparison": "!=",
+ "data_type": "",
+ "param": "artifact:*.cef.destinationAddress",
+ "value": ""
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 320,
+ "y": 20
+ },
+ "previous_function": "",
+ "previous_name": "filter_1",
+ "show_number": true,
+ "size": {
+ "height": 82,
+ "width": 82
+ },
+ "state": "filter",
+ "status": "",
+ "type": "coa.Filter",
+ "warn": false,
+ "z": 404
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773",
+ "transform": "rotate(45 30 70)"
+ },
+ ".border": {
+ "transform": "rotate(45 30 70)"
+ },
+ ".inPorts>.port-0>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".number": {
+ "text": 3
+ },
+ ".outPorts>.port-0": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ },
+ "ref-x": 83,
+ "ref-y": 40
+ },
+ ".outPorts>.port-0>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_3() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.fileHash\", \"!=\", \"\"],\n ],\n name=\"filter_3:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_6(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "ea4b2594-8ef5-42a4-8285-125126536531",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 123,
+ "line_start": 106,
+ "name": "filter",
+ "notes": "Filtering on artifacts that have the destinationDnsDomain CEF value populated.",
+ "number": 3,
+ "order": 6,
+ "outPorts": [
+ "out-1"
+ ],
+ "outputs": [
+ {
+ "conditions": [
+ {
+ "comparison": "!=",
+ "data_type": "",
+ "param": "artifact:*.cef.fileHash",
+ "value": ""
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 320,
+ "y": 300
+ },
+ "previous_function": "",
+ "previous_name": "filter_3",
+ "show_number": true,
+ "size": {
+ "height": 82,
+ "width": 82
+ },
+ "state": "filter",
+ "status": "",
+ "type": "coa.Filter",
+ "warn": false,
+ "z": 412
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773",
+ "transform": "rotate(45 30 70)"
+ },
+ ".border": {
+ "transform": "rotate(45 30 70)"
+ },
+ ".inPorts>.port-0>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".number": {
+ "text": 2
+ },
+ ".outPorts>.port-0": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ },
+ "ref-x": 83,
+ "ref-y": 40
+ },
+ ".outPorts>.port-0>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_2() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.destinationDnsDomain\", \"!=\", \"\"],\n ],\n name=\"filter_2:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_5(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "d230871e-ee71-44a6-af7f-fb4f2f584da4",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 106,
+ "line_start": 89,
+ "name": "filter",
+ "notes": "Filtering on artifacts that have the destinationDnsDomain CEF value populated.",
+ "number": 2,
+ "order": 5,
+ "outPorts": [
+ "out-1"
+ ],
+ "outputs": [
+ {
+ "conditions": [
+ {
+ "comparison": "!=",
+ "data_type": "",
+ "param": "artifact:*.cef.destinationDnsDomain",
+ "value": ""
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 320,
+ "y": 160
+ },
+ "previous_function": "",
+ "previous_name": "filter_2",
+ "show_number": true,
+ "size": {
+ "height": 82,
+ "width": 82
+ },
+ "state": "filter",
+ "status": "",
+ "type": "coa.Filter",
+ "warn": false,
+ "z": 416
+ },
+ {
+ "action": "add listitem",
+ "action_type": "generic",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "create": "True",
+ "list": "custom_list:domain_blocklist",
+ "new_row": "block_domain_1:action_result.parameter.domain"
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "add listitem",
+ "actions": [
+ "no op",
+ "update list",
+ "get action result",
+ "create container",
+ "import container",
+ "export container",
+ "deflate item",
+ "add artifact",
+ "find listitem",
+ "add listitem",
+ "find artifacts",
+ "update artifact tags",
+ "add note",
+ "update artifact",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Phantom",
+ "app_version": "3.0.2",
+ "appid": "deb82aa9-22cc-4675-9cf1-534b8d006eb7",
+ "asset_name": "phantom",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "create": "True",
+ "list": "custom_list:domain_blocklist",
+ "new_row": "block_domain_1:action_result.parameter.domain"
+ },
+ "has_app": true,
+ "id": 16,
+ "loaded": false,
+ "missing": false,
+ "name": "phantom",
+ "output": [
+ {
+ "column_name": "Status",
+ "column_order": 0,
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success",
+ "failed"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.create",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.list",
+ "data_type": "string",
+ "example_values": [
+ "demo_list"
+ ]
+ },
+ {
+ "contains": [
+ "*"
+ ],
+ "data_path": "action_result.parameter.new_row",
+ "data_type": "string",
+ "example_values": [
+ "[\"value1\",\"value2\",\"value3\"]"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.failed",
+ "data_type": "boolean"
+ },
+ {
+ "data_path": "action_result.data.*.success",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.summary.server",
+ "data_type": "string",
+ "example_values": [
+ "https://10.1.1.10"
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Server: https://10.1.1.10"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "create": {
+ "data_type": "boolean",
+ "default": false,
+ "description": "Create list if it does not exist (default: false)",
+ "key": "create",
+ "order": 2,
+ "required": false
+ },
+ "list": {
+ "data_type": "string",
+ "default": null,
+ "description": "Name or ID of a custom list",
+ "key": "list",
+ "order": 0,
+ "required": true
+ },
+ "new_row": {
+ "contains": [
+ "*"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "New Row (string or JSON list)",
+ "key": "new_row",
+ "order": 1,
+ "primary": true,
+ "required": true
+ }
+ },
+ "product_name": "Phantom",
+ "product_vendor": "Phantom",
+ "targets": "16",
+ "type": "information"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "add to domain blocklist"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88,
+ "opacity": 1,
+ "stroke": "#E6984E"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Generic"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_generic.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#E6984E"
+ },
+ "text.icon": {
+ "fill": "#E6984E"
+ }
+ },
+ "block_code": "def add_to_domain_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('add_to_domain_blocklist() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'add_to_domain_blocklist' call\n results_data_1 = phantom.collect2(container=container, datapath=['block_domain_1:action_result.parameter.domain', 'block_domain_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'add_to_domain_blocklist' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'list': \"custom_list:domain_blocklist\",\n 'create': True,\n 'new_row': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"add listitem\", parameters=parameters, assets=['phantom'], name=\"add_to_domain_blocklist\", parent_action=action)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#5094D4",
+ "connected_to_start": true,
+ "connection_name": "block domain",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "add to domain blocklist",
+ "delay": 0,
+ "description": "The domain is added to the custom list 'domain_blocklist' in order to prevent the Playbook from attempting to block a domain that has already been blocked.",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "1924c418-d049-478e-8cfd-ec94eb22f7c6",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 219,
+ "line_start": 194,
+ "message": "Configuring now",
+ "name": "add listitem",
+ "notes": "The domain is added to the custom list 'domain_blocklist' in order to prevent the Playbook from attempting to block a domain that has already been blocked.",
+ "number": 2,
+ "order": 10,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 840,
+ "y": 160
+ },
+ "previous_function": "",
+ "previous_name": "add_to_domain_blocklist",
+ "required_params": {
+ "list": true,
+ "new_row": true
+ },
+ "reviewer": "",
+ "show_number": true,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "action_assets",
+ "status": "",
+ "title": "Generic",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 421
+ },
+ {
+ "action": "block hash",
+ "action_type": "contain",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "comment": "",
+ "hash": "filtered-data:filter_6:condition_1:artifact:*.cef.fileHash"
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "",
+ "app_version": "",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "comment": "",
+ "hash": "filtered-data:filter_6:condition_1:artifact:*.cef.fileHash"
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "carbonblack",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.comment",
+ "data_type": "string",
+ "example_values": [
+ "Sample comment"
+ ]
+ },
+ {
+ "column_name": "Hash",
+ "column_order": 0,
+ "contains": [
+ "md5",
+ "hash"
+ ],
+ "data_path": "action_result.parameter.hash",
+ "data_type": "string",
+ "example_values": [
+ "180469AE0B239E31DB4C65F02FD70BC1"
+ ]
+ },
+ {
+ "data_path": "action_result.data",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Message",
+ "column_order": 1,
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Block hash action succeeded. It might take some time for blacklisting to take effect."
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "product_name": "",
+ "product_vendor": "",
+ "type": "endpoint"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "block hash"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88,
+ "opacity": 1,
+ "stroke": "#E6984E"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Contain"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_contain.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#E6984E"
+ },
+ "text.icon": {
+ "fill": "#E6984E"
+ }
+ },
+ "block_code": "def block_hash_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_hash_2() called')\n\n # collect data for 'block_hash_2' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_6:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_6:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'block_hash_2' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'hash': filtered_artifacts_item_1[0],\n 'comment': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"block hash\", parameters=parameters, assets=['carbonblack'], callback=add_to_hash_blocklist, name=\"block_hash_2\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#3D9959",
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": 0,
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "45d563b4-3a4a-4cc8-bf1f-dfe4de434928",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 67,
+ "line_start": 45,
+ "message": "Configuring now",
+ "name": "block hash",
+ "notes": "Blocks the hash utilizing the CarbonBlack Response endpoint technology app, preventing the process from running on endpoints utilizing CarbonBlack Response.",
+ "number": 2,
+ "order": 3,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 600,
+ "y": 300
+ },
+ "previous_function": "",
+ "previous_name": "block_hash_2",
+ "required_params": {
+ "hash": true
+ },
+ "reviewer": "",
+ "show_number": false,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Contain",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 423
+ },
+ {
+ "action": "block domain",
+ "action_type": "contain",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "disable_safeguards": "",
+ "domain": "filtered-data:filter_5:condition_1:artifact:*.cef.destinationDnsDomain"
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "",
+ "app_version": "",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "disable_safeguards": "",
+ "domain": "filtered-data:filter_5:condition_1:artifact:*.cef.destinationDnsDomain"
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "opendns_umbrella",
+ "output": [
+ {
+ "column_name": "Status",
+ "column_order": 1,
+ "data_path": "action_result.status",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.disable_safeguards",
+ "data_type": "boolean"
+ },
+ {
+ "column_name": "Domain",
+ "column_order": 0,
+ "contains": [
+ "domain"
+ ],
+ "data_path": "action_result.parameter.domain",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string"
+ },
+ {
+ "column_name": "ID",
+ "column_order": 2,
+ "data_path": "action_result.data.*.id",
+ "data_type": "string"
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric"
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric"
+ }
+ ],
+ "product_name": "",
+ "product_vendor": "",
+ "type": "endpoint"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "block domain"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88,
+ "opacity": 1,
+ "stroke": "#E6984E"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Contain"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_contain.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#E6984E"
+ },
+ "text.icon": {
+ "fill": "#E6984E"
+ }
+ },
+ "block_code": "def block_domain_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_domain_1() called')\n\n # collect data for 'block_domain_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_5:condition_1:artifact:*.cef.destinationDnsDomain', 'filtered-data:filter_5:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'block_domain_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'domain': filtered_artifacts_item_1[0],\n 'disable_safeguards': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"block domain\", parameters=parameters, assets=['opendns_umbrella'], callback=add_to_domain_blocklist, name=\"block_domain_1\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#3D9959",
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": 0,
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "6ad60d9d-90e4-4515-9931-05f31cc5f87a",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 89,
+ "line_start": 67,
+ "message": "Configuring now",
+ "name": "block domain",
+ "notes": "Blocks a domain utilizing the OpenDNS Umbrella app, preventing endpoints from accessing the domain from within the network.",
+ "number": 1,
+ "order": 4,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 600,
+ "y": 160
+ },
+ "previous_function": "",
+ "previous_name": "block_domain_1",
+ "required_params": {
+ "domain": true
+ },
+ "reviewer": "",
+ "show_number": false,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Contain",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 424
+ },
+ {
+ "action": "block ip",
+ "action_type": "contain",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "ip": "filtered-data:filter_4:condition_1:artifact:*.cef.destinationAddress",
+ "is_source_address": "",
+ "vsys": ""
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "",
+ "app_version": "",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "ip": "filtered-data:filter_4:condition_1:artifact:*.cef.destinationAddress",
+ "is_source_address": "",
+ "vsys": ""
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "pan",
+ "output": [
+ {
+ "column_name": "IP",
+ "column_order": 0,
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.parameter.ip",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.vsys",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.is_source_address",
+ "data_type": "boolean"
+ },
+ {
+ "column_name": "Status",
+ "column_order": 1,
+ "data_path": "action_result.status",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Message",
+ "column_order": 2,
+ "data_path": "action_result.message",
+ "data_type": "string"
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric"
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric"
+ }
+ ],
+ "product_name": "",
+ "product_vendor": "",
+ "type": "firewall"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "block ip"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88,
+ "opacity": 1,
+ "stroke": "#E6984E"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Contain"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_contain.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#E6984E"
+ },
+ "text.icon": {
+ "fill": "#E6984E"
+ }
+ },
+ "block_code": "def block_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_ip_1() called')\n\n # collect data for 'block_ip_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.destinationAddress', 'filtered-data:filter_4:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'block_ip_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'ip': filtered_artifacts_item_1[0],\n 'vsys': \"\",\n 'is_source_address': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"block ip\", parameters=parameters, assets=['pan'], callback=add_to_IP_blocklist, name=\"block_ip_1\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#3D9959",
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": 0,
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "7a912b77-6a81-421d-b6f5-d865b3fffd73",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 45,
+ "line_start": 22,
+ "message": "Configuring now",
+ "name": "block ip",
+ "notes": "Blocks the IP as a destination address, utilizing the Palo Alto Networks Firewall app to prevent further access to the IP address as a destination.",
+ "number": 1,
+ "order": 2,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 600,
+ "y": 20
+ },
+ "previous_function": "",
+ "previous_name": "block_ip_1",
+ "required_params": {
+ "ip": true
+ },
+ "reviewer": "",
+ "show_number": false,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Contain",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 425
+ },
+ {
+ "action": "add listitem",
+ "action_type": "generic",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "create": "True",
+ "list": "custom_list:filehash_blocklist",
+ "new_row": "block_hash_2:action_result.parameter.hash"
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "add listitem",
+ "actions": [
+ "no op",
+ "update list",
+ "get action result",
+ "create container",
+ "import container",
+ "export container",
+ "deflate item",
+ "add artifact",
+ "find listitem",
+ "add listitem",
+ "find artifacts",
+ "update artifact tags",
+ "add note",
+ "update artifact",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Phantom",
+ "app_version": "3.0.2",
+ "appid": "deb82aa9-22cc-4675-9cf1-534b8d006eb7",
+ "asset_name": "phantom",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "create": "True",
+ "list": "custom_list:filehash_blocklist",
+ "new_row": "block_hash_2:action_result.parameter.hash"
+ },
+ "has_app": true,
+ "id": 16,
+ "loaded": false,
+ "missing": false,
+ "name": "phantom",
+ "output": [
+ {
+ "column_name": "Status",
+ "column_order": 0,
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success",
+ "failed"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.create",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.list",
+ "data_type": "string",
+ "example_values": [
+ "demo_list"
+ ]
+ },
+ {
+ "contains": [
+ "*"
+ ],
+ "data_path": "action_result.parameter.new_row",
+ "data_type": "string",
+ "example_values": [
+ "[\"value1\",\"value2\",\"value3\"]"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.failed",
+ "data_type": "boolean"
+ },
+ {
+ "data_path": "action_result.data.*.success",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.summary.server",
+ "data_type": "string",
+ "example_values": [
+ "https://10.1.1.10"
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Server: https://10.1.1.10"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "create": {
+ "data_type": "boolean",
+ "default": false,
+ "description": "Create list if it does not exist (default: false)",
+ "key": "create",
+ "order": 2,
+ "required": false
+ },
+ "list": {
+ "data_type": "string",
+ "default": null,
+ "description": "Name or ID of a custom list",
+ "key": "list",
+ "order": 0,
+ "required": true
+ },
+ "new_row": {
+ "contains": [
+ "*"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "New Row (string or JSON list)",
+ "key": "new_row",
+ "order": 1,
+ "primary": true,
+ "required": true
+ }
+ },
+ "product_name": "Phantom",
+ "product_vendor": "Phantom",
+ "targets": "16",
+ "type": "information"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "add to hash blocklist"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88,
+ "opacity": 1,
+ "stroke": "#E6984E"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Generic"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_generic.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#E6984E"
+ },
+ "text.icon": {
+ "fill": "#E6984E"
+ }
+ },
+ "block_code": "def add_to_hash_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('add_to_hash_blocklist() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'add_to_hash_blocklist' call\n results_data_1 = phantom.collect2(container=container, datapath=['block_hash_2:action_result.parameter.hash', 'block_hash_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'add_to_hash_blocklist' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'list': \"custom_list:filehash_blocklist\",\n 'create': True,\n 'new_row': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"add listitem\", parameters=parameters, assets=['phantom'], name=\"add_to_hash_blocklist\", parent_action=action)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#5094D4",
+ "connected_to_start": true,
+ "connection_name": "block hash",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "add to hash blocklist",
+ "delay": 0,
+ "description": "The file hash is added to the custom list 'filehash_blocklist' in order to prevent the Playbook from attempting to block a file hash that has already been blocked.",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "dced0e6a-538a-4d02-800a-5e5c0caf92f7",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 191,
+ "line_start": 166,
+ "message": "Configuring now",
+ "name": "add listitem",
+ "notes": "The file hash is added to the custom list 'filehash_blocklist' in order to prevent the Playbook from attempting to block a file hash that has already been blocked.",
+ "number": 3,
+ "order": 9,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 840,
+ "y": 300
+ },
+ "previous_function": "",
+ "previous_name": "add_to_hash_blocklist",
+ "required_params": {
+ "list": true,
+ "new_row": true
+ },
+ "reviewer": "",
+ "show_number": true,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "action_assets",
+ "status": "",
+ "title": "Generic",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 426
+ },
+ {
+ "action": "add listitem",
+ "action_type": "generic",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "create": "True",
+ "list": "custom_list:ip_address_blocklist",
+ "new_row": "block_ip_1:action_result.parameter.ip"
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "add listitem",
+ "actions": [
+ "no op",
+ "update list",
+ "get action result",
+ "create container",
+ "import container",
+ "export container",
+ "deflate item",
+ "add artifact",
+ "find listitem",
+ "add listitem",
+ "find artifacts",
+ "update artifact tags",
+ "add note",
+ "update artifact",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Phantom",
+ "app_version": "3.0.2",
+ "appid": "deb82aa9-22cc-4675-9cf1-534b8d006eb7",
+ "asset_name": "phantom",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "create": "True",
+ "list": "custom_list:ip_address_blocklist",
+ "new_row": "block_ip_1:action_result.parameter.ip"
+ },
+ "has_app": true,
+ "id": 16,
+ "loaded": false,
+ "missing": false,
+ "name": "phantom",
+ "output": [
+ {
+ "column_name": "Status",
+ "column_order": 0,
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success",
+ "failed"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.create",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.list",
+ "data_type": "string",
+ "example_values": [
+ "demo_list"
+ ]
+ },
+ {
+ "contains": [
+ "*"
+ ],
+ "data_path": "action_result.parameter.new_row",
+ "data_type": "string",
+ "example_values": [
+ "[\"value1\",\"value2\",\"value3\"]"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.failed",
+ "data_type": "boolean"
+ },
+ {
+ "data_path": "action_result.data.*.success",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.summary.server",
+ "data_type": "string",
+ "example_values": [
+ "https://10.1.1.10"
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Server: https://10.1.1.10"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "create": {
+ "data_type": "boolean",
+ "default": false,
+ "description": "Create list if it does not exist (default: false)",
+ "key": "create",
+ "order": 2,
+ "required": false
+ },
+ "list": {
+ "data_type": "string",
+ "default": null,
+ "description": "Name or ID of a custom list",
+ "key": "list",
+ "order": 0,
+ "required": true
+ },
+ "new_row": {
+ "contains": [
+ "*"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "New Row (string or JSON list)",
+ "key": "new_row",
+ "order": 1,
+ "primary": true,
+ "required": true
+ }
+ },
+ "product_name": "Phantom",
+ "product_vendor": "Phantom",
+ "targets": "16",
+ "type": "information"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "add to IP blocklist"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88,
+ "opacity": 1,
+ "stroke": "#E6984E"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Generic"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_generic.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#E6984E"
+ },
+ "text.icon": {
+ "fill": "#E6984E"
+ }
+ },
+ "block_code": "def add_to_IP_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('add_to_IP_blocklist() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'add_to_IP_blocklist' call\n results_data_1 = phantom.collect2(container=container, datapath=['block_ip_1:action_result.parameter.ip', 'block_ip_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'add_to_IP_blocklist' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'list': \"custom_list:ip_address_blocklist\",\n 'create': True,\n 'new_row': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"add listitem\", parameters=parameters, assets=['phantom'], name=\"add_to_IP_blocklist\", parent_action=action)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#5094D4",
+ "connected_to_start": true,
+ "connection_name": "block ip",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "add to IP blocklist",
+ "delay": 0,
+ "description": "The IP address is added to the custom list 'ip_address_blocklist' in order to prevent the Playbook from attempting to block an IP address that has already been blocked.",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "08306503-f5d1-4cd0-b32b-90a7670ff1ca",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 247,
+ "line_start": 222,
+ "message": "Configuring now",
+ "name": "add listitem",
+ "notes": "The IP address is added to the custom list 'ip_address_blocklist' in order to prevent the Playbook from attempting to block an IP address that has already been blocked.",
+ "number": 1,
+ "order": 11,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 840,
+ "y": 20
+ },
+ "previous_function": "",
+ "previous_name": "add_to_IP_blocklist",
+ "required_params": {
+ "list": true,
+ "new_row": true
+ },
+ "reviewer": "",
+ "show_number": true,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "action_assets",
+ "status": "",
+ "title": "Generic",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 430
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773",
+ "transform": "rotate(45 30 70)"
+ },
+ ".border": {
+ "transform": "rotate(45 30 70)"
+ },
+ ".inPorts>.port-0>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".number": {
+ "text": 6
+ },
+ ".outPorts>.port-0": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ },
+ "ref-x": 83,
+ "ref-y": 40
+ },
+ ".outPorts>.port-0>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def filter_6(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_6() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"filtered-data:filter_3:condition_1:artifact:*.cef.fileHash\", \"in\", \"custom_list:filehash_blocklist\"],\n ],\n name=\"filter_6:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n block_hash_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "Checking to see if this filehash is in the custom list called \"filehash_blocklist\"",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "25ad9a87-018a-440b-a48d-3a0bd95226f6",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 163,
+ "line_start": 146,
+ "name": "filter",
+ "notes": "Checking to see if this filehash is in the custom list called \"filehash_blocklist\"",
+ "number": 6,
+ "order": 8,
+ "outPorts": [
+ "out-1"
+ ],
+ "outputs": [
+ {
+ "conditions": [
+ {
+ "comparison": "in",
+ "data_type": "",
+ "param": "filtered-data:filter_3:condition_1:artifact:*.cef.fileHash",
+ "value": "custom_list:filehash_blocklist"
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 460,
+ "y": 300
+ },
+ "previous_function": "",
+ "previous_name": "filter_6",
+ "show_number": true,
+ "size": {
+ "height": 82,
+ "width": 82
+ },
+ "state": "filter",
+ "status": "",
+ "type": "coa.Filter",
+ "warn": false,
+ "z": 432
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773",
+ "transform": "rotate(45 30 70)"
+ },
+ ".border": {
+ "transform": "rotate(45 30 70)"
+ },
+ ".inPorts>.port-0>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".number": {
+ "text": 5
+ },
+ ".outPorts>.port-0": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ },
+ "ref-x": 83,
+ "ref-y": 40
+ },
+ ".outPorts>.port-0>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_5() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"filtered-data:filter_2:condition_1:artifact:*.cef.destinationDnsDomain\", \"in\", \"custom_list:domain_blocklist\"],\n ],\n name=\"filter_5:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n block_domain_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "Checking to see if this domain address is in the custom list called \"domain_blocklist\"",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "7862d46c-23ea-4cda-9ef9-db171fd5ac93",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 143,
+ "line_start": 126,
+ "name": "filter",
+ "notes": "Checking to see if this domain address is in the custom list called \"domain_blocklist\"",
+ "number": 5,
+ "order": 7,
+ "outPorts": [
+ "out-1"
+ ],
+ "outputs": [
+ {
+ "conditions": [
+ {
+ "comparison": "in",
+ "data_type": "",
+ "param": "filtered-data:filter_2:condition_1:artifact:*.cef.destinationDnsDomain",
+ "value": "custom_list:domain_blocklist"
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 460,
+ "y": 160
+ },
+ "previous_function": "",
+ "previous_name": "filter_5",
+ "show_number": true,
+ "size": {
+ "height": 82,
+ "width": 82
+ },
+ "state": "filter",
+ "status": "",
+ "type": "coa.Filter",
+ "warn": false,
+ "z": 433
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773",
+ "transform": "rotate(45 30 70)"
+ },
+ ".border": {
+ "transform": "rotate(45 30 70)"
+ },
+ ".inPorts>.port-0>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".number": {
+ "text": 4
+ },
+ ".outPorts>.port-0": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ },
+ "ref-x": 83,
+ "ref-y": 40
+ },
+ ".outPorts>.port-0>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_4() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress\", \"not in\", \"custom_list:ip_address_blocklist\"],\n ],\n name=\"filter_4:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n block_ip_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "Checking to see if this IP address is in the custom list called \"ip_address_blocklist\"",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "9537d314-97d6-484b-ae20-3d9564bab6d6",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 284,
+ "line_start": 267,
+ "name": "filter",
+ "notes": "Checking to see if this IP address is in the custom list called \"ip_address_blocklist\"",
+ "number": 4,
+ "order": 13,
+ "outPorts": [
+ "out-1"
+ ],
+ "outputs": [
+ {
+ "conditions": [
+ {
+ "comparison": "not in",
+ "data_type": "",
+ "param": "filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress",
+ "value": "custom_list:ip_address_blocklist"
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 460,
+ "y": 20
+ },
+ "previous_function": "",
+ "previous_name": "filter_4",
+ "show_number": true,
+ "size": {
+ "height": 82,
+ "width": 82
+ },
+ "state": "filter",
+ "status": "",
+ "type": "coa.Filter",
+ "warn": false,
+ "z": 434
+ }
+ ]
+ },
+ "notes": "This playbook uses the following Apps: \n\n- Palo Alto Networks Firewall (PAN)\n- CarbonBlack Response\n- OpenDNS Umbrella\n\nThis playbook uses the following custom list:\n\n- ip_address_blocklist\n- domain_blocklist\n- filehash_blocklist\n\nThis playbook provides an easy, automated, and straightforward solution to maintaining up-to-date IP address, file, and domain blocklists. The process is:\n\nEach Artifact within an event is checked for the presence of the following CEF fields:\nDestinationDnsDomain - Domains\nDestinationAddress - IP addresses\nFileHash - Files\nThe CEF value is then cross-referenced with their respective Custom Lists.\nIP addresses are blocked on a Firewall, while domains are blocked using a blocklist service. The blocking of these two will prevent access to the IOCs. Finally, file hashes are blocked using an endpoint protection service, which will prevent the process from running on affected endpoints within a network.\nAfter the IOCs are blocked using various apps, they are added to their respective custom lists as to maintain a running blocklist record."
+ },
+ "python_version": "3",
+ "schema": 4,
+ "version": "4.10.0.40961"
+ },
+ "create_time": "2021-01-21T21:26:58.710395+00:00",
+ "draft_mode": false,
+ "labels": [
+ "events"
+ ],
+ "tags": []
+}
diff --git a/playbooks/block_indicators.png b/playbooks/block_indicators.png
new file mode 100644
index 0000000000..60fb2e8638
Binary files /dev/null and b/playbooks/block_indicators.png differ
diff --git a/playbooks/block_indicators.py b/playbooks/block_indicators.py
new file mode 100644
index 0000000000..55297ef4b2
--- /dev/null
+++ b/playbooks/block_indicators.py
@@ -0,0 +1,297 @@
+"""
+This playbook retrieves IP addresses, domains, and file hashes, blocks them on various services, and adds them to specific blocklists as custom lists.
+"""
+
+import phantom.rules as phantom
+import json
+from datetime import datetime, timedelta
+def on_start(container):
+ phantom.debug('on_start() called')
+
+ # call 'filter_1' block
+ filter_1(container=container)
+
+ # call 'filter_2' block
+ filter_2(container=container)
+
+ # call 'filter_3' block
+ filter_3(container=container)
+
+ return
+
+def block_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('block_ip_1() called')
+
+ # collect data for 'block_ip_1' call
+ filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.destinationAddress', 'filtered-data:filter_4:condition_1:artifact:*.id'])
+
+ parameters = []
+
+ # build parameters list for 'block_ip_1' call
+ for filtered_artifacts_item_1 in filtered_artifacts_data_1:
+ if filtered_artifacts_item_1[0]:
+ parameters.append({
+ 'ip': filtered_artifacts_item_1[0],
+ 'vsys': "",
+ 'is_source_address': "",
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': filtered_artifacts_item_1[1]},
+ })
+
+ phantom.act(action="block ip", parameters=parameters, assets=['pan'], callback=add_to_IP_blocklist, name="block_ip_1")
+
+ return
+
+def block_hash_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('block_hash_2() called')
+
+ # collect data for 'block_hash_2' call
+ filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_6:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_6:condition_1:artifact:*.id'])
+
+ parameters = []
+
+ # build parameters list for 'block_hash_2' call
+ for filtered_artifacts_item_1 in filtered_artifacts_data_1:
+ if filtered_artifacts_item_1[0]:
+ parameters.append({
+ 'hash': filtered_artifacts_item_1[0],
+ 'comment': "",
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': filtered_artifacts_item_1[1]},
+ })
+
+ phantom.act(action="block hash", parameters=parameters, assets=['carbonblack'], callback=add_to_hash_blocklist, name="block_hash_2")
+
+ return
+
+def block_domain_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('block_domain_1() called')
+
+ # collect data for 'block_domain_1' call
+ filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_5:condition_1:artifact:*.cef.destinationDnsDomain', 'filtered-data:filter_5:condition_1:artifact:*.id'])
+
+ parameters = []
+
+ # build parameters list for 'block_domain_1' call
+ for filtered_artifacts_item_1 in filtered_artifacts_data_1:
+ if filtered_artifacts_item_1[0]:
+ parameters.append({
+ 'domain': filtered_artifacts_item_1[0],
+ 'disable_safeguards': "",
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': filtered_artifacts_item_1[1]},
+ })
+
+ phantom.act(action="block domain", parameters=parameters, assets=['opendns_umbrella'], callback=add_to_domain_blocklist, name="block_domain_1")
+
+ return
+
+def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('filter_2() called')
+
+ # collect filtered artifact ids for 'if' condition 1
+ matched_artifacts_1, matched_results_1 = phantom.condition(
+ container=container,
+ conditions=[
+ ["artifact:*.cef.destinationDnsDomain", "!=", ""],
+ ],
+ name="filter_2:condition_1")
+
+ # call connected blocks if filtered artifacts or results
+ if matched_artifacts_1 or matched_results_1:
+ filter_5(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+ return
+
+def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('filter_3() called')
+
+ # collect filtered artifact ids for 'if' condition 1
+ matched_artifacts_1, matched_results_1 = phantom.condition(
+ container=container,
+ conditions=[
+ ["artifact:*.cef.fileHash", "!=", ""],
+ ],
+ name="filter_3:condition_1")
+
+ # call connected blocks if filtered artifacts or results
+ if matched_artifacts_1 or matched_results_1:
+ filter_6(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+ return
+
+"""
+Checking to see if this domain address is in the custom list called "domain_blocklist"
+"""
+def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('filter_5() called')
+
+ # collect filtered artifact ids for 'if' condition 1
+ matched_artifacts_1, matched_results_1 = phantom.condition(
+ container=container,
+ conditions=[
+ ["filtered-data:filter_2:condition_1:artifact:*.cef.destinationDnsDomain", "in", "custom_list:domain_blocklist"],
+ ],
+ name="filter_5:condition_1")
+
+ # call connected blocks if filtered artifacts or results
+ if matched_artifacts_1 or matched_results_1:
+ block_domain_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+ return
+
+"""
+Checking to see if this filehash is in the custom list called "filehash_blocklist"
+"""
+def filter_6(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('filter_6() called')
+
+ # collect filtered artifact ids for 'if' condition 1
+ matched_artifacts_1, matched_results_1 = phantom.condition(
+ container=container,
+ conditions=[
+ ["filtered-data:filter_3:condition_1:artifact:*.cef.fileHash", "in", "custom_list:filehash_blocklist"],
+ ],
+ name="filter_6:condition_1")
+
+ # call connected blocks if filtered artifacts or results
+ if matched_artifacts_1 or matched_results_1:
+ block_hash_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+ return
+
+"""
+The file hash is added to the custom list 'filehash_blocklist' in order to prevent the Playbook from attempting to block a file hash that has already been blocked.
+"""
+def add_to_hash_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('add_to_hash_blocklist() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'add_to_hash_blocklist' call
+ results_data_1 = phantom.collect2(container=container, datapath=['block_hash_2:action_result.parameter.hash', 'block_hash_2:action_result.parameter.context.artifact_id'], action_results=results)
+
+ parameters = []
+
+ # build parameters list for 'add_to_hash_blocklist' call
+ for results_item_1 in results_data_1:
+ if results_item_1[0]:
+ parameters.append({
+ 'list': "custom_list:filehash_blocklist",
+ 'create': True,
+ 'new_row': results_item_1[0],
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': results_item_1[1]},
+ })
+
+ phantom.act(action="add listitem", parameters=parameters, assets=['phantom'], name="add_to_hash_blocklist", parent_action=action)
+
+ return
+
+"""
+The domain is added to the custom list 'domain_blocklist' in order to prevent the Playbook from attempting to block a domain that has already been blocked.
+"""
+def add_to_domain_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('add_to_domain_blocklist() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'add_to_domain_blocklist' call
+ results_data_1 = phantom.collect2(container=container, datapath=['block_domain_1:action_result.parameter.domain', 'block_domain_1:action_result.parameter.context.artifact_id'], action_results=results)
+
+ parameters = []
+
+ # build parameters list for 'add_to_domain_blocklist' call
+ for results_item_1 in results_data_1:
+ if results_item_1[0]:
+ parameters.append({
+ 'list': "custom_list:domain_blocklist",
+ 'create': True,
+ 'new_row': results_item_1[0],
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': results_item_1[1]},
+ })
+
+ phantom.act(action="add listitem", parameters=parameters, assets=['phantom'], name="add_to_domain_blocklist", parent_action=action)
+
+ return
+
+"""
+The IP address is added to the custom list 'ip_address_blocklist' in order to prevent the Playbook from attempting to block an IP address that has already been blocked.
+"""
+def add_to_IP_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('add_to_IP_blocklist() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'add_to_IP_blocklist' call
+ results_data_1 = phantom.collect2(container=container, datapath=['block_ip_1:action_result.parameter.ip', 'block_ip_1:action_result.parameter.context.artifact_id'], action_results=results)
+
+ parameters = []
+
+ # build parameters list for 'add_to_IP_blocklist' call
+ for results_item_1 in results_data_1:
+ if results_item_1[0]:
+ parameters.append({
+ 'list': "custom_list:ip_address_blocklist",
+ 'create': True,
+ 'new_row': results_item_1[0],
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': results_item_1[1]},
+ })
+
+ phantom.act(action="add listitem", parameters=parameters, assets=['phantom'], name="add_to_IP_blocklist", parent_action=action)
+
+ return
+
+def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('filter_1() called')
+
+ # collect filtered artifact ids for 'if' condition 1
+ matched_artifacts_1, matched_results_1 = phantom.condition(
+ container=container,
+ conditions=[
+ ["artifact:*.cef.destinationAddress", "!=", ""],
+ ],
+ name="filter_1:condition_1")
+
+ # call connected blocks if filtered artifacts or results
+ if matched_artifacts_1 or matched_results_1:
+ filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+ return
+
+"""
+Checking to see if this IP address is in the custom list called "ip_address_blocklist"
+"""
+def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('filter_4() called')
+
+ # collect filtered artifact ids for 'if' condition 1
+ matched_artifacts_1, matched_results_1 = phantom.condition(
+ container=container,
+ conditions=[
+ ["filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress", "not in", "custom_list:ip_address_blocklist"],
+ ],
+ name="filter_4:condition_1")
+
+ # call connected blocks if filtered artifacts or results
+ if matched_artifacts_1 or matched_results_1:
+ block_ip_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+ return
+
+def on_finish(container, summary):
+ phantom.debug('on_finish() called')
+ # This function is called after all actions are completed.
+ # summary of all the action and/or all details of actions
+ # can be collected here.
+
+ # summary_json = phantom.get_summary()
+ # if 'result' in summary_json:
+ # for action_result in summary_json['result']:
+ # if 'action_run_id' in action_result:
+ # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)
+ # phantom.debug(action_results)
+
+ return
\ No newline at end of file
diff --git a/playbooks/block_indicators.yml b/playbooks/block_indicators.yml
new file mode 100644
index 0000000000..9caf9a527c
--- /dev/null
+++ b/playbooks/block_indicators.yml
@@ -0,0 +1,23 @@
+name: Block Indicators
+id: fc0edc76-ff2b-48b0-5f6f-63da6783fd63
+version: 1
+date: '2021-01-21'
+author: Philip Royer, Splunk
+type: Response
+description: This playbook retrieves IP addresses, domains, and file hashes, blocks them on various services, and adds them to specific blocklists as custom lists.
+playbook: block_indicators
+how_to_implement: "This playbook uses the following custom lists: ip_address_blocklist, domain_blocklist, filehash_blocklist. This playbook provides an easy, automated, and straightforward solution to maintaining up-to-date IP address, file, and domain blocklists. The playbook looks for any of the required CEF fields within the container. The CEF value is then cross-referenced with their respective Custom Lists. IP addresses are blocked on a Firewall, while domains are blocked using a blocklist service. The blocking of these two will prevent access to the IOCs. Finally, file hashes are blocked using an endpoint protection service, which will prevent the process from running on affected endpoints within a network. After the IOCs are blocked using various apps, they are added to their respective custom lists as to maintain a running blocklist record."
+references: []
+app_list:
+- "Palo Alto Networks Firewall"
+- "CarbonBlack Response"
+- "OpenDNS Umbrella"
+tags:
+ platform_tags:
+ - Response
+ playbook_fields:
+ - destinationDnsDomain
+ - destinationAddress
+ - fileHash
+ product:
+ - Splunk SOAR
\ No newline at end of file
diff --git a/playbooks/email_notification_for_malware.json b/playbooks/email_notification_for_malware.json
new file mode 100644
index 0000000000..24f8c4685e
--- /dev/null
+++ b/playbooks/email_notification_for_malware.json
@@ -0,0 +1,8672 @@
+{
+ "blockly": false,
+ "blockly_xml": "",
+ "category": "Use Cases",
+ "coa": {
+ "data": {
+ "clean": true,
+ "code_block": "",
+ "description": "This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal \"file reputation\" and PAN WildFire \"detonate file\" are used to determine if a file is malware, and CarbonBlack Response \"hunt file\" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team.",
+ "hash": "cd4b30ce1b1555275490936455ad489a860c1c98",
+ "joint": {
+ "cells": [
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "b019e440-ef29-4772-bda2-a9386a65fccb",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "f86960a4-1d0d-4f37-924c-8640149388a8",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 32
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "eaa4fc01-be31-4366-b66d-7aaaa8cd5967",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "12461935-1aee-4aec-878c-0e2fb1742912",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 171
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "74fcb7c5-ea09-4556-90ce-c60cf8681d04",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "cff987f2-2566-44d5-a694-26087dc2a0a2",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 767
+ },
+ {
+ "0": "S",
+ "1": "T",
+ "2": "A",
+ "3": "R",
+ "4": "T",
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "ref-x": 33,
+ "ref-y": 8,
+ "text": "START"
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "ref-x": 13,
+ "xlink:href": "/inc/coa/img/block_icon_start.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ }
+ },
+ "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'filter_1' block\n filter_1(container=container)\n\n return",
+ "callback_code": "# read-only block view not available",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "4f900fb0-068e-4214-8caa-1b065f7f9bfa",
+ "inPorts": [],
+ "join_code": "# read-only block view not available",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 16,
+ "line_start": 8,
+ "name": "",
+ "notes": "",
+ "number": 0,
+ "order": 1,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": -120,
+ "y": 120
+ },
+ "previous_function": "",
+ "previous_name": "",
+ "show_number": true,
+ "size": {
+ "height": 54,
+ "width": 80
+ },
+ "status": "",
+ "title": "START",
+ "type": "coa.StartEnd",
+ "warn": false,
+ "z": 1394
+ },
+ {
+ "0": "E",
+ "1": "N",
+ "2": "D",
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".title": {
+ "text": "END"
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_end.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ }
+ },
+ "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return",
+ "callback_code": "# read-only block view not available",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "send email",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "cff987f2-2566-44d5-a694-26087dc2a0a2",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "# read-only block view not available",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 338,
+ "line_start": 325,
+ "name": "",
+ "notes": "",
+ "number": 0,
+ "order": 13,
+ "outPorts": [],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1880,
+ "y": 120
+ },
+ "previous_function": "",
+ "previous_name": "",
+ "show_number": true,
+ "size": {
+ "height": 54,
+ "width": 80
+ },
+ "status": "",
+ "title": "END",
+ "type": "coa.StartEnd",
+ "warn": false,
+ "z": 1571
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "1af67ff6-453c-46aa-87e1-3731e1a659a5",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "4f900fb0-068e-4214-8caa-1b065f7f9bfa",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899",
+ "port": "in",
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 1682
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "d4f646d5-8ec0-41ef-8519-cd07b8de14f3",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "35f205e2-949e-463e-9057-658f597b1dc9",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 1834
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "ef8c12b6-f42d-459c-a8b1-b04690b626ee",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "f86960a4-1d0d-4f37-924c-8640149388a8",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 1951
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "0b2d5872-1c82-438a-bf42-2ffefc4b4bb1",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "214e20f6-a5fb-4409-b2f2-752d24605d9c",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 1954
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "ca25cb81-1e40-4c53-a811-3fd0be926cca",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b",
+ "port": "out-2",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "34337267-8e89-4ddf-a601-9040234d2744",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 1960
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "d3d6a860-6f58-4b63-86d5-8c1a7da31e5a",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "34337267-8e89-4ddf-a601-9040234d2744",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "bef1c9d9-aa68-4355-8ea3-66637924fc29",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 1967
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "50e35606-e056-445a-b71e-84a1d6026b43",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "bef1c9d9-aa68-4355-8ea3-66637924fc29",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "12461935-1aee-4aec-878c-0e2fb1742912",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 1969
+ },
+ {
+ "action": "file reputation",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "hash": "filtered-data:initial_artifact_filter:condition_1:artifact:*.cef.fileHash"
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "VirusTotal",
+ "app_version": "1.2.37",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "hash": "filtered-data:filter_1:condition_1:artifact:*.cef.fileHash"
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "virustotal",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success"
+ ]
+ },
+ {
+ "contains": [
+ "hash",
+ "sha256",
+ "sha1",
+ "md5"
+ ],
+ "data_path": "action_result.parameter.hash",
+ "data_type": "string",
+ "example_values": [
+ "6c1948f7edf115cd1f13cd170b882077930be150"
+ ]
+ },
+ {
+ "contains": [
+ "hash",
+ "md5"
+ ],
+ "data_path": "action_result.data.*.md5",
+ "data_type": "string",
+ "example_values": [
+ "494303294715f5ffad7ad3f43b73b00b"
+ ]
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.data.*.permalink",
+ "data_type": "string",
+ "example_values": [
+ "https://www.test.com/file/27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7/analysis/1548112684/"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.positives",
+ "data_type": "numeric",
+ "example_values": [
+ 64
+ ]
+ },
+ {
+ "contains": [
+ "sha1"
+ ],
+ "data_path": "action_result.data.*.resource",
+ "data_type": "string",
+ "example_values": [
+ "6c1948f7edf115cd1f13cd170b882077930be150"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.response_code",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scan_date",
+ "data_type": "string",
+ "example_values": [
+ "2019-01-21 23:18:04"
+ ]
+ },
+ {
+ "contains": [
+ "virustotal scan id"
+ ],
+ "data_path": "action_result.data.*.scan_id",
+ "data_type": "string",
+ "example_values": [
+ "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7-1548112684"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.*.detected",
+ "data_type": "boolean"
+ },
+ {
+ "data_path": "action_result.data.*.scans.*.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.*.update",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.*.version",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.ALYac.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ALYac.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ALYac.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.ALYac.version",
+ "data_type": "string",
+ "example_values": [
+ "1.1.1.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AVG.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AVG.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32:Parite"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AVG.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AVG.version",
+ "data_type": "string",
+ "example_values": [
+ "18.4.3895.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AVware.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AVware.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.b (v)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AVware.update",
+ "data_type": "string",
+ "example_values": [
+ "20180925"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.AVware.version",
+ "data_type": "string",
+ "example_values": [
+ "1.6.0.52"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Acronis.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Acronis.result",
+ "data_type": "string",
+ "example_values": [
+ "suspicious"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Acronis.update",
+ "data_type": "string",
+ "example_values": [
+ "20190119"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Acronis.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0.1.37"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Ad-Aware.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Ad-Aware.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Ad-Aware.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Ad-Aware.version",
+ "data_type": "string",
+ "example_values": [
+ "3.0.5.370"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AegisLab.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AegisLab.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.AegisLab.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AegisLab.version",
+ "data_type": "string",
+ "example_values": [
+ "4.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AhnLab-V3.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AhnLab-V3.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32/Parite"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AhnLab-V3.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AhnLab-V3.version",
+ "data_type": "string",
+ "example_values": [
+ "3.14.1.22785"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Alibaba.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Alibaba.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.Alibaba.update",
+ "data_type": "string",
+ "example_values": [
+ "20180921"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Alibaba.version",
+ "data_type": "string",
+ "example_values": [
+ "0.1.0.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Antiy-AVL.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Antiy-AVL.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus/Win32.Parite.c"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Antiy-AVL.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Antiy-AVL.version",
+ "data_type": "string",
+ "example_values": [
+ "3.0.0.1"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Arcabit.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Arcabit.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Arcabit.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Arcabit.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0.0.837"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avast-Mobile.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avast-Mobile.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avast-Mobile.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avast-Mobile.version",
+ "data_type": "string",
+ "example_values": [
+ "190121-00"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avast.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avast.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32:Parite"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avast.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avast.version",
+ "data_type": "string",
+ "example_values": [
+ "18.4.3895.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avira.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avira.result",
+ "data_type": "string",
+ "example_values": [
+ "W32/Parite"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avira.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Avira.version",
+ "data_type": "string",
+ "example_values": [
+ "8.3.3.8"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Babable.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Babable.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.Babable.update",
+ "data_type": "string",
+ "example_values": [
+ "20180918"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Babable.version",
+ "data_type": "string",
+ "example_values": [
+ "9107201"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Baidu.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Baidu.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Virus.Parite.d"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Baidu.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Baidu.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0.0.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.BitDefender.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.BitDefender.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.BitDefender.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.BitDefender.version",
+ "data_type": "string",
+ "example_values": [
+ "7.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Bkav.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Bkav.result",
+ "data_type": "string",
+ "example_values": [
+ "W32.Pinfi.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Bkav.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Bkav.version",
+ "data_type": "string",
+ "example_values": [
+ "1.3.0.9899"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CAT-QuickHeal.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CAT-QuickHeal.result",
+ "data_type": "string",
+ "example_values": [
+ "W32.Perite.A"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CAT-QuickHeal.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CAT-QuickHeal.version",
+ "data_type": "string",
+ "example_values": [
+ "14.00"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CMC.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CMC.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Win32.Parite.b!O"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CMC.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CMC.version",
+ "data_type": "string",
+ "example_values": [
+ "1.1.0.977"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ClamAV.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ClamAV.result",
+ "data_type": "string",
+ "example_values": [
+ "Heuristics.W32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ClamAV.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.ClamAV.version",
+ "data_type": "string",
+ "example_values": [
+ "0.101.1.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Comodo.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Comodo.result",
+ "data_type": "string",
+ "example_values": [
+ "Malware@#1b1651nqd7ivb"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Comodo.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Comodo.version",
+ "data_type": "string",
+ "example_values": [
+ "30310"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CrowdStrike.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CrowdStrike.result",
+ "data_type": "string",
+ "example_values": [
+ "malicious_confidence_100% (W)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CrowdStrike.update",
+ "data_type": "string",
+ "example_values": [
+ "20181023"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CrowdStrike.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cybereason.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cybereason.result",
+ "data_type": "string",
+ "example_values": [
+ "malicious.94715f"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cybereason.update",
+ "data_type": "string",
+ "example_values": [
+ "20190109"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cybereason.version",
+ "data_type": "string",
+ "example_values": [
+ "1.2.27"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cylance.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cylance.result",
+ "data_type": "string",
+ "example_values": [
+ "Unsafe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cylance.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Cylance.version",
+ "data_type": "string",
+ "example_values": [
+ "2.3.1.101"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cyren.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cyren.result",
+ "data_type": "string",
+ "example_values": [
+ "W32/Virut.E.gen!Eldorado"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cyren.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Cyren.version",
+ "data_type": "string",
+ "example_values": [
+ "6.2.0.1"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.DrWeb.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.DrWeb.result",
+ "data_type": "string",
+ "example_values": [
+ "Trojan.DownLoader20.25948"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.DrWeb.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.DrWeb.version",
+ "data_type": "string",
+ "example_values": [
+ "7.0.34.11020"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ESET-NOD32.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ESET-NOD32.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32/Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ESET-NOD32.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ESET-NOD32.version",
+ "data_type": "string",
+ "example_values": [
+ "18744"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Emsisoft.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Emsisoft.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B (B)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Emsisoft.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Emsisoft.version",
+ "data_type": "string",
+ "example_values": [
+ "2018.4.0.1029"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Endgame.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Endgame.result",
+ "data_type": "string",
+ "example_values": [
+ "malicious (high confidence)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Endgame.update",
+ "data_type": "string",
+ "example_values": [
+ "20181108"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Endgame.version",
+ "data_type": "string",
+ "example_values": [
+ "3.0.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.F-Prot.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.F-Prot.result",
+ "data_type": "string",
+ "example_values": [
+ "W32/Virut.E.gen!Eldorado"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.F-Prot.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.F-Prot.version",
+ "data_type": "string",
+ "example_values": [
+ "4.7.1.166"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.F-Secure.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.F-Secure.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.F-Secure.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.F-Secure.version",
+ "data_type": "string",
+ "example_values": [
+ "11.0.19100.45"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Fortinet.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Fortinet.result",
+ "data_type": "string",
+ "example_values": [
+ "W32/Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Fortinet.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Fortinet.version",
+ "data_type": "string",
+ "example_values": [
+ "5.4.247.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.GData.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.GData.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.GData.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.GData.version",
+ "data_type": "string",
+ "example_values": [
+ "A:25.20275B:25.14197"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Ikarus.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Ikarus.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Win32.Virut"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Ikarus.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Ikarus.version",
+ "data_type": "string",
+ "example_values": [
+ "0.1.5.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Invincea.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Invincea.result",
+ "data_type": "string",
+ "example_values": [
+ "heuristic"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Invincea.update",
+ "data_type": "string",
+ "example_values": [
+ "20181128"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Invincea.version",
+ "data_type": "string",
+ "example_values": [
+ "6.3.6.26157"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Jiangmin.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Jiangmin.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32/Parite.b"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Jiangmin.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Jiangmin.version",
+ "data_type": "string",
+ "example_values": [
+ "16.0.100"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.K7AntiVirus.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.K7AntiVirus.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus ( 00001b711 )"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.K7AntiVirus.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.K7AntiVirus.version",
+ "data_type": "string",
+ "example_values": [
+ "11.24.29740"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.K7GW.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.K7GW.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus ( 00001b711 )"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.K7GW.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.K7GW.version",
+ "data_type": "string",
+ "example_values": [
+ "11.24.29740"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Kaspersky.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Kaspersky.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Win32.Parite.b"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Kaspersky.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Kaspersky.version",
+ "data_type": "string",
+ "example_values": [
+ "15.0.1.13"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Kingsoft.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Kingsoft.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.b.5756"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Kingsoft.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Kingsoft.version",
+ "data_type": "string",
+ "example_values": [
+ "2013.8.14.323"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.MAX.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.MAX.result",
+ "data_type": "string",
+ "example_values": [
+ "malware (ai score=100)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.MAX.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.MAX.version",
+ "data_type": "string",
+ "example_values": [
+ "2018.9.12.1"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Malwarebytes.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Malwarebytes.result",
+ "data_type": "string",
+ "example_values": [
+ "Trojan.Agent.QQ"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Malwarebytes.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Malwarebytes.version",
+ "data_type": "string",
+ "example_values": [
+ "2.1.1.1115"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.McAfee-GW-Edition.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.McAfee-GW-Edition.result",
+ "data_type": "string",
+ "example_values": [
+ "BehavesLike.Win32.Pate.hh"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.McAfee-GW-Edition.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.McAfee-GW-Edition.version",
+ "data_type": "string",
+ "example_values": [
+ "v2017.3010"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.McAfee.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.McAfee.result",
+ "data_type": "string",
+ "example_values": [
+ "W32/Pate.b"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.McAfee.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.McAfee.version",
+ "data_type": "string",
+ "example_values": [
+ "6.0.6.653"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.MicroWorld-eScan.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.MicroWorld-eScan.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.MicroWorld-eScan.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.MicroWorld-eScan.version",
+ "data_type": "string",
+ "example_values": [
+ "14.0.297.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Microsoft.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Microsoft.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus:Win32/Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Microsoft.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Microsoft.version",
+ "data_type": "string",
+ "example_values": [
+ "1.1.15500.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.NANO-Antivirus.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.NANO-Antivirus.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Win32.Parite.bgvo"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.NANO-Antivirus.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.NANO-Antivirus.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0.134.24576"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Paloalto.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Paloalto.result",
+ "data_type": "string",
+ "example_values": [
+ "generic.ml"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Paloalto.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Paloalto.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Panda.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Panda.result",
+ "data_type": "string",
+ "example_values": [
+ "W32/Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Panda.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Panda.version",
+ "data_type": "string",
+ "example_values": [
+ "4.6.4.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Qihoo-360.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Qihoo-360.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Win32.Parite.H"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Qihoo-360.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Qihoo-360.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0.0.1120"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Rising.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Rising.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Parite!1.9B80 (CLOUD)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Rising.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Rising.version",
+ "data_type": "string",
+ "example_values": [
+ "25.0.0.24"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.SUPERAntiSpyware.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.SUPERAntiSpyware.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.SUPERAntiSpyware.update",
+ "data_type": "string",
+ "example_values": [
+ "20190116"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.SUPERAntiSpyware.version",
+ "data_type": "string",
+ "example_values": [
+ "5.6.0.1032"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.SentinelOne.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.SentinelOne.result",
+ "data_type": "string",
+ "example_values": [
+ "static engine - malicious"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.SentinelOne.update",
+ "data_type": "string",
+ "example_values": [
+ "20190118"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.SentinelOne.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0.21.268"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Sophos.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Sophos.result",
+ "data_type": "string",
+ "example_values": [
+ "W32/Parite-B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Sophos.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Sophos.version",
+ "data_type": "string",
+ "example_values": [
+ "4.98.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Symantec.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Symantec.result",
+ "data_type": "string",
+ "example_values": [
+ "Trojan.Gen.6"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Symantec.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Symantec.version",
+ "data_type": "string",
+ "example_values": [
+ "1.8.0.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TACHYON.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TACHYON.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus/W32.Parite.C"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TACHYON.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TACHYON.version",
+ "data_type": "string",
+ "example_values": [
+ "2019-01-21.02"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Tencent.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Tencent.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Win32.Dropper.c"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Tencent.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Tencent.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0.0.1"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TheHacker.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TheHacker.result",
+ "data_type": "string",
+ "example_values": [
+ "W32/Pate.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TheHacker.update",
+ "data_type": "string",
+ "example_values": [
+ "20190118"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TheHacker.version",
+ "data_type": "string",
+ "example_values": [
+ "6.8.0.5.3962"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TotalDefense.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TotalDefense.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32/Pinfi.A"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TotalDefense.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.TotalDefense.version",
+ "data_type": "string",
+ "example_values": [
+ "37.1.62.1"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Trapmine.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Trapmine.result",
+ "data_type": "string",
+ "example_values": [
+ "malicious.high.ml.score"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Trapmine.update",
+ "data_type": "string",
+ "example_values": [
+ "20190103"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Trapmine.version",
+ "data_type": "string",
+ "example_values": [
+ "3.0.34.707"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.result",
+ "data_type": "string",
+ "example_values": [
+ "PE_PARITE.A"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.version",
+ "data_type": "string",
+ "example_values": [
+ "10.0.0.1040"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TrendMicro.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TrendMicro.result",
+ "data_type": "string",
+ "example_values": [
+ "PE_PARITE.A"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TrendMicro.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TrendMicro.version",
+ "data_type": "string",
+ "example_values": [
+ "10.0.0.1040"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Trustlook.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Trustlook.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.Trustlook.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Trustlook.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.VBA32.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.VBA32.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Win32.Parite.b"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.VBA32.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.VBA32.version",
+ "data_type": "string",
+ "example_values": [
+ "3.35.1"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.VIPRE.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.VIPRE.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.b (v)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.VIPRE.update",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.VIPRE.version",
+ "data_type": "string",
+ "example_values": [
+ "None"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ViRobot.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ViRobot.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.A"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ViRobot.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ViRobot.version",
+ "data_type": "string",
+ "example_values": [
+ "2014.3.20.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Webroot.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Webroot.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.Webroot.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Webroot.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0.0.403"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Yandex.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Yandex.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Yandex.update",
+ "data_type": "string",
+ "example_values": [
+ "20190120"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Yandex.version",
+ "data_type": "string",
+ "example_values": [
+ "5.5.1.3"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Zillya.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Zillya.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Parite.Win32.9"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Zillya.update",
+ "data_type": "string",
+ "example_values": [
+ "20190118"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Zillya.version",
+ "data_type": "string",
+ "example_values": [
+ "2.0.0.3733"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ZoneAlarm.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ZoneAlarm.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Win32.Parite.b"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ZoneAlarm.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ZoneAlarm.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Zoner.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Zoner.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Zoner.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Zoner.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.eGambit.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.eGambit.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.eGambit.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.eGambit.version",
+ "data_type": "string",
+ "example_values": [
+ "v4.3.5"
+ ]
+ },
+ {
+ "contains": [
+ "hash",
+ "sha1"
+ ],
+ "data_path": "action_result.data.*.sha1",
+ "data_type": "string",
+ "example_values": [
+ "6c1948f7edf115cd1f13cd170b882077930be150"
+ ]
+ },
+ {
+ "contains": [
+ "hash",
+ "sha256"
+ ],
+ "data_path": "action_result.data.*.sha256",
+ "data_type": "string",
+ "example_values": [
+ "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.total",
+ "data_type": "numeric",
+ "example_values": [
+ 72
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.verbose_msg",
+ "data_type": "string",
+ "example_values": [
+ "Scan finished, information embedded"
+ ]
+ },
+ {
+ "data_path": "action_result.summary.positives",
+ "data_type": "numeric",
+ "example_values": [
+ 64
+ ]
+ },
+ {
+ "data_path": "action_result.summary.total_scans",
+ "data_type": "numeric",
+ "example_values": [
+ 72
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Positives: 64, Total scans: 72"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_positives",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "product_name": "VirusTotal",
+ "product_vendor": "VirusTotal",
+ "type": ""
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "file reputation"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#FFFFFF"
+ },
+ "text.icon": {
+ "fill": "#FFFFFF"
+ }
+ },
+ "block_code": "def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('file_reputation_1() called')\n\n # collect data for 'file_reputation_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_1:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'file_reputation_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'hash': filtered_artifacts_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"file reputation\", parameters=parameters, assets=['virustotal'], callback=filter_2, name=\"file_reputation_1\")\n\n return",
+ "callback_code": "",
+ "callback_start": 55,
+ "callsback": true,
+ "color": "#654796",
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": 0,
+ "description": "Run a reputation lookup on the fileHash to determine how many antivirus engines recognize it as malware.",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "f86960a4-1d0d-4f37-924c-8640149388a8",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 40,
+ "line_start": 19,
+ "message": "Configuring now",
+ "name": "file reputation",
+ "notes": "Run a reputation lookup on the fileHash to determine how many antivirus engines recognize it as malware.",
+ "number": 1,
+ "order": 2,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 160,
+ "y": 100
+ },
+ "previous_function": "",
+ "previous_name": "file_reputation_1",
+ "required_params": {
+ "hash": true
+ },
+ "reviewer": "",
+ "show_number": false,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 1981
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773",
+ "transform": "rotate(45 30 70)"
+ },
+ ".border": {
+ "transform": "rotate(45 30 70)"
+ },
+ ".inPorts>.port-0>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".number": {
+ "text": 5
+ },
+ ".outPorts>.port-0": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ },
+ "ref-x": 83,
+ "ref-y": 40
+ },
+ ".outPorts>.port-0>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_5() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"detonate_file_1:action_result.summary.malware\", \"==\", \"yes\"],\n ],\n name=\"filter_5:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "detonate file",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "filter 5",
+ "description": "Only hunt files that are considered malware per the sandbox (malware == yes).",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 110,
+ "line_start": 92,
+ "name": "filter",
+ "notes": "Only hunt files that are considered malware per the sandbox (malware == yes).",
+ "number": 5,
+ "order": 5,
+ "outPorts": [
+ "out-1"
+ ],
+ "outputs": [
+ {
+ "conditions": [
+ {
+ "comparison": "==",
+ "data_type": "",
+ "param": "detonate_file_1:action_result.summary.malware",
+ "value": "yes"
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1020,
+ "y": 240
+ },
+ "previous_function": "",
+ "previous_name": "filter_5",
+ "show_number": true,
+ "size": {
+ "height": 82,
+ "width": 82
+ },
+ "state": "filter",
+ "status": "",
+ "type": "coa.Filter",
+ "warn": false,
+ "z": 2020
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773",
+ "transform": "rotate(45 30 70)"
+ },
+ ".border": {
+ "transform": "rotate(45 30 70)"
+ },
+ ".inPorts>.port-0>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".number": {
+ "text": 3
+ },
+ ".outPorts>.port-0": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ },
+ "ref-x": 83,
+ "ref-y": 40
+ },
+ ".outPorts>.port-0>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_3() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"filtered-data:filter_2:condition_2:file_reputation_1:action_result.parameter.hash\", \"==\", \"artifact:*.cef.fileHash\"],\n ],\n name=\"filter_3:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "file reputation",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "filter 3",
+ "description": "Match hashes with less than 10 positives to artifacts to identify filtered_artifacts.",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "34337267-8e89-4ddf-a601-9040234d2744",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 131,
+ "line_start": 113,
+ "name": "filter",
+ "notes": "Match hashes with less than 10 positives to artifacts to identify filtered_artifacts.",
+ "number": 3,
+ "order": 6,
+ "outPorts": [
+ "out-1"
+ ],
+ "outputs": [
+ {
+ "conditions": [
+ {
+ "comparison": "==",
+ "data_type": "",
+ "param": "filtered-data:filter_2:condition_2:file_reputation_1:action_result.parameter.hash",
+ "value": "artifact:*.cef.fileHash"
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 500,
+ "y": 240
+ },
+ "previous_function": "",
+ "previous_name": "filter_3",
+ "show_number": true,
+ "size": {
+ "height": 82,
+ "width": 82
+ },
+ "state": "filter",
+ "status": "",
+ "type": "coa.Filter",
+ "warn": false,
+ "z": 2022
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773",
+ "transform": "rotate(45 30 70)"
+ },
+ ".border": {
+ "transform": "rotate(45 30 70)"
+ },
+ ".inPorts>.port-0>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".number": {
+ "text": 2
+ },
+ ".outPorts>.port-0": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ },
+ "ref-x": 83,
+ "ref-y": 40
+ },
+ ".outPorts>.port-0>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ ".outPorts>.port-1": {
+ "port": {
+ "id": "out-2",
+ "type": "out"
+ },
+ "ref-x": 41,
+ "ref-y": 82
+ },
+ ".outPorts>.port-1>.port-body": {
+ "port": {
+ "id": "out-2",
+ "type": "out"
+ }
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_2() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">=\", 10],\n ],\n name=\"filter_2:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n # collect filtered artifact ids for 'if' condition 2\n matched_artifacts_2, matched_results_2 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \"<\", 10],\n ],\n name=\"filter_2:condition_2\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_2 or matched_results_2:\n filter_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "file reputation",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "filter 2",
+ "description": "If 10 or more antivirus engines flagged the hash, proceed directly to hunt for the file. Else, use a sandbox to detonate the executable first.",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 165,
+ "line_start": 134,
+ "name": "filter",
+ "notes": "If 10 or more antivirus engines flagged the hash, proceed directly to hunt for the file. Else, use a sandbox to detonate the executable first.",
+ "number": 2,
+ "order": 7,
+ "outPorts": [
+ "out-1",
+ "out-2"
+ ],
+ "outputs": [
+ {
+ "conditions": [
+ {
+ "comparison": ">=",
+ "data_type": "",
+ "param": "file_reputation_1:action_result.summary.positives",
+ "value": "10"
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ },
+ {
+ "conditions": [
+ {
+ "comparison": "<",
+ "data_type": "",
+ "param": "file_reputation_1:action_result.summary.positives",
+ "value": "10"
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 400,
+ "y": 100
+ },
+ "previous_function": "",
+ "previous_name": "filter_2",
+ "show_number": true,
+ "size": {
+ "height": 82,
+ "width": 82
+ },
+ "state": "filter",
+ "status": "",
+ "type": "coa.Filter",
+ "warn": false,
+ "z": 2023
+ },
+ {
+ "action": "hunt file",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "hash": "filtered-data:filter_9:condition_1:file_reputation_1:action_result.parameter.hash",
+ "range": "",
+ "type": ""
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "Carbon Black Response",
+ "app_version": "1.2.80",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "hash": "filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.hash",
+ "range": "",
+ "type": ""
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "carbonblack",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success"
+ ]
+ },
+ {
+ "contains": [
+ "hash",
+ "md5"
+ ],
+ "data_path": "action_result.parameter.hash",
+ "data_type": "string",
+ "example_values": [
+ "4fb491ac8d46aaf22ba8bc5c73dabef7",
+ "13ded573464ba7f43fe640479b309e09",
+ "9bf50324444c46997c2492d505b47f2d",
+ "5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.range",
+ "data_type": "string",
+ "example_values": [
+ "0-10",
+ "0-2",
+ "5-8"
+ ]
+ },
+ {
+ "contains": [
+ "carbon black query type"
+ ],
+ "data_path": "action_result.parameter.type",
+ "data_type": "string",
+ "example_values": [
+ "process",
+ "binary"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.elapsed",
+ "data_type": "numeric",
+ "example_values": [
+ 0.1120398044586182,
+ 0.04952096939086914,
+ 0.1234798431396484,
+ 0.05507302284240723,
+ 0.05384993553161621
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_result.*.name",
+ "data_type": "string",
+ "example_values": [
+ "Signed"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_result.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-01T00:00:00Z",
+ "2015-01-01T00:00:00Z",
+ "2013-11-01T00:00:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1,
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "16.0.10827.20181",
+ "4.7.0205.0",
+ "6.1.7600.16385 (win7_rtm.090713-1255)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.group.*.name",
+ "data_type": "string",
+ "example_values": [
+ "default group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.group.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.group.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.group.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.host_count.*.name",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.host_count.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1,
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.hostname.*.name",
+ "data_type": "string",
+ "example_values": [
+ "CB-TEST-02",
+ "WIN7-CLIENT1",
+ "ACCOUNTING-PC"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.hostname.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.hostname.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0",
+ "16.7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.hostname.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe",
+ "c:\\program files\\microsoft security client\\nissrv.exe",
+ "C:\\Windows\\system32\\ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0",
+ "50.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Office",
+ "Microsoft Malware Protection"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-19T00:00:00Z",
+ "2018-09-29T00:00:00Z",
+ "2018-10-02T00:00:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1,
+ 0
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.binary.highlights.*.ids",
+ "data_type": "string",
+ "example_values": [
+ "13DED573464BA7F43FE640479B309E09",
+ "9BF50324444C46997C2492D505B47F2D",
+ "5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.highlights.*.name",
+ "data_type": "string",
+ "example_values": [
+ "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST",
+ "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST",
+ "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST"
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "5fb30fe90736c7fc77de637021b1ce7c"
+ ]
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust",
+ "data_type": "numeric",
+ "example_values": [
+ -100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-07T02:37:28Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.cb_version",
+ "data_type": "numeric",
+ "example_values": [
+ 610,
+ 510,
+ 511
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.company_name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.copied_mod_len",
+ "data_type": "numeric",
+ "example_values": [
+ 9683736,
+ 366512,
+ 16896
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_issuer",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Code Signing PCA"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_prog_name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Office",
+ "Microsoft Corp."
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_publisher",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_result",
+ "data_type": "string",
+ "example_values": [
+ "Signed"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_result_code",
+ "data_type": "string",
+ "example_values": [
+ "0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_sign_time",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-14T20:23:00Z",
+ "2015-01-30T19:14:00Z",
+ "2009-07-14T10:17:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_subject",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.endpoint",
+ "data_type": "string",
+ "example_values": [
+ "CB-TEST-02|27",
+ "WIN7-CLIENT1|15",
+ "DC1|19"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.event_partition_id",
+ "data_type": "numeric",
+ "example_values": [
+ 100972684312576,
+ 100955696070656
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.facet_id",
+ "data_type": "numeric",
+ "example_values": [
+ 883737,
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.file_desc",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Office Click-to-Run (SxS)",
+ "Microsoft Network Realtime Inspection Service",
+ "TCP/IP Ping Command"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.file_version",
+ "data_type": "string",
+ "example_values": [
+ "16.0.10827.20181",
+ "4.7.0205.0",
+ "6.1.7600.16385 (win7_rtm.090713-1255)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.group",
+ "data_type": "string",
+ "example_values": [
+ "Default Group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.host_count",
+ "data_type": "numeric",
+ "example_values": [
+ 1,
+ 6
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.internal_name",
+ "data_type": "string",
+ "example_values": [
+ "OfficeClickToRun.exe",
+ "NisSrv.exe",
+ "ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.is_64bit",
+ "data_type": "boolean",
+ "example_values": [
+ false,
+ true
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.is_executable_image",
+ "data_type": "boolean",
+ "example_values": [
+ false,
+ true
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.last_seen",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-28T10:06:02.456Z",
+ "2018-10-28T10:06:42.455Z",
+ "2018-10-26T00:01:41.224Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.legal_copyright",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation. All rights reserved."
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.md5",
+ "data_type": "string",
+ "example_values": [
+ "13DED573464BA7F43FE640479B309E09",
+ "9BF50324444C46997C2492D505B47F2D",
+ "5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.observed_filename",
+ "data_type": "string",
+ "example_values": [
+ "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe",
+ "c:\\program files\\microsoft security client\\nissrv.exe",
+ "c:\\windows\\system32\\ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.orig_mod_len",
+ "data_type": "numeric",
+ "example_values": [
+ 9683736,
+ 366512,
+ 16896
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.original_filename",
+ "data_type": "string",
+ "example_values": [
+ "OfficeClickToRun.exe",
+ "NisSrv.exe",
+ "ping.exe.mui"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.os_type",
+ "data_type": "string",
+ "example_values": [
+ "Windows"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.product_name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Office",
+ "Microsoft Malware Protection"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.product_version",
+ "data_type": "string",
+ "example_values": [
+ "16.0.10827.20181",
+ "4.7.0205.0",
+ "6.1.7600.16385"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.server_added_timestamp",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-19T17:04:47.906Z",
+ "2015-07-01T02:12:21.783Z",
+ "2015-05-15T07:23:54.846Z"
+ ]
+ },
+ {
+ "column_name": "Signed",
+ "column_order": 1,
+ "data_path": "action_result.data.*.binary.results.*.signed",
+ "data_type": "string",
+ "example_values": [
+ "Signed"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.timestamp",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-19T17:04:47.906Z",
+ "2015-07-01T02:12:21.783Z",
+ "2015-05-15T07:23:54.846Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.watchlists.*.value",
+ "data_type": "string",
+ "example_values": [
+ "2015-07-01T02:20:02.062Z",
+ "2015-05-15T07:30:02.843Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid",
+ "data_type": "string",
+ "example_values": [
+ "5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.start",
+ "data_type": "numeric",
+ "example_values": [
+ 0,
+ 5
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.terms",
+ "data_type": "string",
+ "example_values": [
+ "md5:13ded573464ba7f43fe640479b309e09",
+ "md5:9bf50324444c46997c2492d505b47f2d",
+ "md5:5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.total_results",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.all_segments",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.comprehensive_search",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.elapsed",
+ "data_type": "numeric",
+ "example_values": [
+ 0.2200779914855957
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.day_of_week.*.name",
+ "data_type": "string",
+ "example_values": [
+ "0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.day_of_week.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1566
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.group.*.name",
+ "data_type": "string",
+ "example_values": [
+ "default group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.group.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.group.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.group.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 10128
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.host_type.*.name",
+ "data_type": "string",
+ "example_values": [
+ "domain_controller"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.host_type.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.host_type.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.host_type.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 10123
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hostname.*.name",
+ "data_type": "string",
+ "example_values": [
+ "dc2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hostname.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hostname.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "51.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hostname.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 5185
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hour_of_day.*.name",
+ "data_type": "string",
+ "example_values": [
+ "0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hour_of_day.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 411
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.facets.parent_name.*.name",
+ "data_type": "string",
+ "example_values": [
+ "svchost.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.parent_name.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.parent_name.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.parent_name.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9971
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.facets.path_full.*.name",
+ "data_type": "string",
+ "example_values": [
+ "c:\\windows\\syswow64\\wbem\\wmiprvse.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.path_full.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.path_full.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.path_full.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9971
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.process.facets.process_md5.*.name",
+ "data_type": "string",
+ "example_values": [
+ "4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_md5.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_md5.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_md5.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9971
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.facets.process_name.*.name",
+ "data_type": "string",
+ "example_values": [
+ "wmiprvse.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_name.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_name.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_name.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9971
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.start.*.name",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-24T00:00:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.start.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 324
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.username_full.*.name",
+ "data_type": "string",
+ "example_values": [
+ "LOCAL SERVICE"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.username_full.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.username_full.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.4"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.username_full.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9966
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.incomplete_results",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust",
+ "data_type": "numeric",
+ "example_values": [
+ -100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-07T02:37:28Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.childproc_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "contains": [
+ "file path"
+ ],
+ "data_path": "action_result.data.*.process.results.*.cmdline",
+ "data_type": "string",
+ "example_values": [
+ "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.comms_ip",
+ "data_type": "numeric",
+ "example_values": [
+ 168886572
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.crossproc_count",
+ "data_type": "numeric",
+ "example_values": [
+ 2
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.emet_config",
+ "data_type": "string",
+ "example_values": [
+ ""
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.emet_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.filemod_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.filtering_known_dlls",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.group",
+ "data_type": "string",
+ "example_values": [
+ "default group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.host_type",
+ "data_type": "string",
+ "example_values": [
+ "workstation"
+ ]
+ },
+ {
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.hostname",
+ "data_type": "string",
+ "example_values": [
+ "win7-client1"
+ ]
+ },
+ {
+ "contains": [
+ "carbon black process id"
+ ],
+ "data_path": "action_result.data.*.process.results.*.id",
+ "data_type": "string",
+ "example_values": [
+ "0000000f-0000-0688-01d3-27738c9b4243"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.interface_ip",
+ "data_type": "numeric",
+ "example_values": [
+ 168886572
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.last_server_update",
+ "data_type": "string",
+ "example_values": [
+ "2018-03-22T09:21:32.332Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.last_update",
+ "data_type": "string",
+ "example_values": [
+ "2017-09-07T00:52:15.82Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.modload_count",
+ "data_type": "numeric",
+ "example_values": [
+ 43
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.netconn_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.os_type",
+ "data_type": "string",
+ "example_values": [
+ "windows"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.parent_id",
+ "data_type": "string",
+ "example_values": [
+ "0000000f-0000-0258-01d1-ec51b545a19b"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.parent_md5",
+ "data_type": "string",
+ "example_values": [
+ "000000000000000000000000000000"
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.parent_name",
+ "data_type": "string",
+ "example_values": [
+ "svchost.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.parent_pid",
+ "data_type": "numeric",
+ "example_values": [
+ 600
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.parent_unique_id",
+ "data_type": "string",
+ "example_values": [
+ "0000000f-0000-0258-01d1-ec51b545a19b-000000000001"
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.path",
+ "data_type": "string",
+ "example_values": [
+ "c:\\windows\\syswow64\\wbem\\wmiprvse.exe"
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.process.results.*.process_md5",
+ "data_type": "string",
+ "example_values": [
+ "4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "contains": [
+ "process name",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.process_name",
+ "data_type": "string",
+ "example_values": [
+ "wmiprvse.exe"
+ ]
+ },
+ {
+ "contains": [
+ "pid"
+ ],
+ "data_path": "action_result.data.*.process.results.*.process_pid",
+ "data_type": "numeric",
+ "example_values": [
+ 1672
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.processblock_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.regmod_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.segment_id",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "contains": [
+ "carbon black sensor id"
+ ],
+ "data_path": "action_result.data.*.process.results.*.sensor_id",
+ "data_type": "numeric",
+ "example_values": [
+ 15
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.start",
+ "data_type": "string",
+ "example_values": [
+ "2017-09-07T00:52:15.758Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.terminated",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.unique_id",
+ "data_type": "string",
+ "example_values": [
+ "0000000f-0000-0688-01d3-27738c9b4243-000000000001"
+ ]
+ },
+ {
+ "contains": [
+ "user name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.username",
+ "data_type": "string",
+ "example_values": [
+ "SYSTEM"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.start",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.terms",
+ "data_type": "string",
+ "example_values": [
+ "md5:4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.total_results",
+ "data_type": "numeric",
+ "example_values": [
+ 32404
+ ]
+ },
+ {
+ "data_path": "action_result.summary.device_count",
+ "data_type": "numeric",
+ "example_values": [
+ 32404,
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Displaying 10 'process' results of total 32404",
+ "Displaying 1 'binary' results of total 1",
+ "Displaying 0 'binary' results of total 1"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "product_name": "Carbon Black",
+ "product_vendor": "Bit9",
+ "type": "endpoint"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "hunt file 1"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#FFFFFF"
+ },
+ "text.icon": {
+ "fill": "#FFFFFF"
+ }
+ },
+ "block_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_1' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_1' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name=\"hunt_file_1\")\n\n return",
+ "callback_code": "",
+ "callback_start": 193,
+ "callsback": true,
+ "color": "#654796",
+ "connected_to_start": true,
+ "connection_name": "file reputation",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": 0,
+ "description": "Hunt for binaries with the malicious fileHash across endpoints.",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "214e20f6-a5fb-4409-b2f2-752d24605d9c",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 112,
+ "line_end": 193,
+ "line_start": 168,
+ "message": "Configuring now",
+ "name": "hunt file",
+ "notes": "Hunt for binaries with the malicious fileHash across endpoints.",
+ "number": 1,
+ "order": 8,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 780,
+ "y": 100
+ },
+ "previous_function": "",
+ "previous_name": "hunt_file_1",
+ "required_params": {
+ "hash": true
+ },
+ "reviewer": "",
+ "show_number": true,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 2024
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773",
+ "transform": "rotate(45 30 70)"
+ },
+ ".border": {
+ "transform": "rotate(45 30 70)"
+ },
+ ".inPorts>.port-0>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".number": {
+ "text": 1
+ },
+ ".outPorts>.port-0": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ },
+ "ref-x": 83,
+ "ref-y": 40
+ },
+ ".outPorts>.port-0>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_1() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.fileHash\", \"!=\", \"\"],\n ],\n name=\"filter_1:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n file_reputation_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "filter 1",
+ "description": "Only process artifacts that have a CEF fileHash.",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 37,
+ "line_end": 213,
+ "line_start": 196,
+ "name": "filter",
+ "notes": "Only process artifacts that have a CEF fileHash.",
+ "number": 1,
+ "order": 9,
+ "outPorts": [
+ "out-1"
+ ],
+ "outputs": [
+ {
+ "conditions": [
+ {
+ "comparison": "!=",
+ "data_type": "",
+ "param": "artifact:*.cef.fileHash",
+ "value": ""
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 20,
+ "y": 100
+ },
+ "previous_function": "",
+ "previous_name": "filter_1",
+ "show_number": true,
+ "size": {
+ "height": 82,
+ "width": 82
+ },
+ "state": "filter",
+ "status": "",
+ "type": "coa.Filter",
+ "warn": false,
+ "z": 2025
+ },
+ {
+ "action": "detonate file",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "file_name": "",
+ "force_analysis": "",
+ "private": "",
+ "vault_id": "filtered-data:filter_11:condition_1:artifact:*.cef.vaultId",
+ "vm": ""
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "WildFire",
+ "app_version": "1.0.24",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "file_name": "",
+ "vault_id": "filtered-data:filter_4:condition_1:artifact:*.cef.vaultId"
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "wildfire",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.parameter.file_name",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "pe file",
+ "pdf",
+ "flash",
+ "apk",
+ "jar",
+ "doc",
+ "xls",
+ "ppt"
+ ],
+ "data_path": "action_result.parameter.vault_id",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.file_info.filetype",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.file_info.malware",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "md5",
+ "hash"
+ ],
+ "data_path": "action_result.data.*.file_info.md5",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "sha1",
+ "hash"
+ ],
+ "data_path": "action_result.data.*.file_info.sha1",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "sha256",
+ "hash"
+ ],
+ "data_path": "action_result.data.*.file_info.sha256",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.file_info.size",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.#text",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.#text",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@behavior_id",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "md5",
+ "hash"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@md5",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "sha1",
+ "hash"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha1",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "sha256",
+ "hash"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha256",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@behavior_id",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "md5",
+ "hash"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@md5",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "sha1",
+ "hash"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha1",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "sha256",
+ "hash"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha256",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@deleted_file",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "pid"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@pid",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "process name"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@process_image",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "pid"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@pid",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "process name"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@process_image",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@written_file",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.malware",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "md5",
+ "hash"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.md5",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@query",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@response",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@type",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@country",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@ip",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@port",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@country",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@ip",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@port",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.network.url.*.@host",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.network.url.*.@method",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.network.url.*.@uri",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.network.url.*.@user_agent",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.platform",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@command",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "process name"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@name",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "pid"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@pid",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "md5",
+ "hash"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@md5",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "file path"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@name",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "sha1",
+ "hash"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha1",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "sha256",
+ "hash"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha256",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@size",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@type",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.mutex.createmutex.*.@name",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@key",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@subkey",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@data",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@key",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@subkey",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "process name"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@name",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "pid"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@pid",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@text",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "pid"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@pid",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "process name"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@process_image",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@reg_key",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "pid"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@pid",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "process name"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@process_image",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@reg_key",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "pid"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@pid",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "process name"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@process_image",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@reg_key",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "sha256",
+ "hash"
+ ],
+ "data_path": "action_result.data.*.task_info.report.*.sha256",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.size",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.software",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.#text",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@details",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@id",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@score",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.task",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.#text",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.@seq",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.task_info.report.*.version",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.version",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary.malware",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string"
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric"
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric"
+ }
+ ],
+ "product_name": "WildFire",
+ "product_vendor": "Palo Alto Networks",
+ "type": "sandbox"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "detonate file"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#FFFFFF"
+ },
+ "text.icon": {
+ "fill": "#FFFFFF"
+ }
+ },
+ "block_code": "def detonate_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('detonate_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'detonate_file_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.vaultId', 'filtered-data:filter_4:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'detonate_file_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'vault_id': filtered_artifacts_item_1[0],\n 'file_name': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"detonate file\", parameters=parameters, assets=['wildfire'], callback=filter_5, name=\"detonate_file_1\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#654796",
+ "connected_to_start": true,
+ "connection_name": "file reputation",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": 0,
+ "description": "Detonate the file(s) in the vault.",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "12461935-1aee-4aec-878c-0e2fb1742912",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 135,
+ "line_end": 240,
+ "line_start": 216,
+ "message": "Configuring now",
+ "name": "detonate file",
+ "notes": "Detonate the file(s) in the vault.",
+ "number": 1,
+ "order": 10,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 780,
+ "y": 240
+ },
+ "previous_function": "",
+ "previous_name": "detonate_file_1",
+ "required_params": {
+ "vault_id": true
+ },
+ "reviewer": "",
+ "show_number": false,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 2026
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#818D99",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#818D99",
+ "stroke": "#818D99"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "13fce689-6a47-484b-a70a-aa77e2e79cb1",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "214e20f6-a5fb-4409-b2f2-752d24605d9c",
+ "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "f989d5e9-9586-408e-b424-8a3a5384936a",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 2037
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#818D99",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#818D99",
+ "stroke": "#818D99"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "eeca94e9-2c8b-4474-ad9f-39da792e28a3",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "35f205e2-949e-463e-9057-658f597b1dc9",
+ "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "f989d5e9-9586-408e-b424-8a3a5384936a",
+ "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 2040
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773",
+ "transform": "rotate(45 30 70)"
+ },
+ ".border": {
+ "transform": "rotate(45 30 70)"
+ },
+ ".inPorts>.port-0>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".number": {
+ "text": 4
+ },
+ ".outPorts>.port-0": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ },
+ "ref-x": 83,
+ "ref-y": 40
+ },
+ ".outPorts>.port-0>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_4() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"filtered-data:filter_3:condition_1:artifact:*.cef.vaultId\", \"!=\", \"\"],\n ],\n name=\"filter_4:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n detonate_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "file reputation",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "filter 4",
+ "description": "Detonate file requires a Vault file, so only proceed if vaultId is not null.",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "bef1c9d9-aa68-4355-8ea3-66637924fc29",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 89,
+ "line_start": 71,
+ "name": "filter",
+ "notes": "Detonate file requires a Vault file, so only proceed if vaultId is not null.",
+ "number": 4,
+ "order": 4,
+ "outPorts": [
+ "out-1"
+ ],
+ "outputs": [
+ {
+ "conditions": [
+ {
+ "comparison": "!=",
+ "data_type": "",
+ "param": "filtered-data:filter_3:condition_1:artifact:*.cef.vaultId",
+ "value": ""
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 640,
+ "y": 240
+ },
+ "previous_function": "",
+ "previous_name": "filter_4",
+ "show_number": true,
+ "size": {
+ "height": 82,
+ "width": 82
+ },
+ "state": "filter",
+ "status": "",
+ "type": "coa.Filter",
+ "warn": false,
+ "z": 2059
+ },
+ {
+ "action": "hunt file",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "hash": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5",
+ "range": "",
+ "type": ""
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "",
+ "app_version": "",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "hash": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5",
+ "range": "",
+ "type": ""
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "carbonblack",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success"
+ ]
+ },
+ {
+ "contains": [
+ "hash",
+ "md5"
+ ],
+ "data_path": "action_result.parameter.hash",
+ "data_type": "string",
+ "example_values": [
+ "4fb491ac8d46aaf22ba8bc5c73dabef7",
+ "13ded573464ba7f43fe640479b309e09",
+ "9bf50324444c46997c2492d505b47f2d",
+ "5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.range",
+ "data_type": "string",
+ "example_values": [
+ "0-10",
+ "0-2",
+ "5-8"
+ ]
+ },
+ {
+ "contains": [
+ "carbon black query type"
+ ],
+ "data_path": "action_result.parameter.type",
+ "data_type": "string",
+ "example_values": [
+ "process",
+ "binary"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.elapsed",
+ "data_type": "numeric",
+ "example_values": [
+ 0.1120398044586182,
+ 0.04952096939086914,
+ 0.1234798431396484,
+ 0.05507302284240723,
+ 0.05384993553161621
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_result.*.name",
+ "data_type": "string",
+ "example_values": [
+ "Signed"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_result.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-01T00:00:00Z",
+ "2015-01-01T00:00:00Z",
+ "2013-11-01T00:00:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1,
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "16.0.10827.20181",
+ "4.7.0205.0",
+ "6.1.7600.16385 (win7_rtm.090713-1255)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.group.*.name",
+ "data_type": "string",
+ "example_values": [
+ "default group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.group.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.group.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.group.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.host_count.*.name",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.host_count.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1,
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.hostname.*.name",
+ "data_type": "string",
+ "example_values": [
+ "CB-TEST-02",
+ "WIN7-CLIENT1",
+ "ACCOUNTING-PC"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.hostname.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.hostname.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0",
+ "16.7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.hostname.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe",
+ "c:\\program files\\microsoft security client\\nissrv.exe",
+ "C:\\Windows\\system32\\ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0",
+ "50.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Office",
+ "Microsoft Malware Protection"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-19T00:00:00Z",
+ "2018-09-29T00:00:00Z",
+ "2018-10-02T00:00:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1,
+ 0
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.binary.highlights.*.ids",
+ "data_type": "string",
+ "example_values": [
+ "13DED573464BA7F43FE640479B309E09",
+ "9BF50324444C46997C2492D505B47F2D",
+ "5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.highlights.*.name",
+ "data_type": "string",
+ "example_values": [
+ "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST",
+ "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST",
+ "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST"
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "5fb30fe90736c7fc77de637021b1ce7c"
+ ]
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust",
+ "data_type": "numeric",
+ "example_values": [
+ -100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-07T02:37:28Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.cb_version",
+ "data_type": "numeric",
+ "example_values": [
+ 610,
+ 510,
+ 511
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.company_name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.copied_mod_len",
+ "data_type": "numeric",
+ "example_values": [
+ 9683736,
+ 366512,
+ 16896
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_issuer",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Code Signing PCA"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_prog_name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Office",
+ "Microsoft Corp."
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_publisher",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_result",
+ "data_type": "string",
+ "example_values": [
+ "Signed"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_result_code",
+ "data_type": "string",
+ "example_values": [
+ "0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_sign_time",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-14T20:23:00Z",
+ "2015-01-30T19:14:00Z",
+ "2009-07-14T10:17:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_subject",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.endpoint",
+ "data_type": "string",
+ "example_values": [
+ "CB-TEST-02|27",
+ "WIN7-CLIENT1|15",
+ "DC1|19"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.event_partition_id",
+ "data_type": "numeric",
+ "example_values": [
+ 100972684312576,
+ 100955696070656
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.facet_id",
+ "data_type": "numeric",
+ "example_values": [
+ 883737,
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.file_desc",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Office Click-to-Run (SxS)",
+ "Microsoft Network Realtime Inspection Service",
+ "TCP/IP Ping Command"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.file_version",
+ "data_type": "string",
+ "example_values": [
+ "16.0.10827.20181",
+ "4.7.0205.0",
+ "6.1.7600.16385 (win7_rtm.090713-1255)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.group",
+ "data_type": "string",
+ "example_values": [
+ "Default Group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.host_count",
+ "data_type": "numeric",
+ "example_values": [
+ 1,
+ 6
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.internal_name",
+ "data_type": "string",
+ "example_values": [
+ "OfficeClickToRun.exe",
+ "NisSrv.exe",
+ "ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.is_64bit",
+ "data_type": "boolean",
+ "example_values": [
+ false,
+ true
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.is_executable_image",
+ "data_type": "boolean",
+ "example_values": [
+ false,
+ true
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.last_seen",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-28T10:06:02.456Z",
+ "2018-10-28T10:06:42.455Z",
+ "2018-10-26T00:01:41.224Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.legal_copyright",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation. All rights reserved."
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.md5",
+ "data_type": "string",
+ "example_values": [
+ "13DED573464BA7F43FE640479B309E09",
+ "9BF50324444C46997C2492D505B47F2D",
+ "5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.observed_filename",
+ "data_type": "string",
+ "example_values": [
+ "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe",
+ "c:\\program files\\microsoft security client\\nissrv.exe",
+ "c:\\windows\\system32\\ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.orig_mod_len",
+ "data_type": "numeric",
+ "example_values": [
+ 9683736,
+ 366512,
+ 16896
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.original_filename",
+ "data_type": "string",
+ "example_values": [
+ "OfficeClickToRun.exe",
+ "NisSrv.exe",
+ "ping.exe.mui"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.os_type",
+ "data_type": "string",
+ "example_values": [
+ "Windows"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.product_name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Office",
+ "Microsoft Malware Protection"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.product_version",
+ "data_type": "string",
+ "example_values": [
+ "16.0.10827.20181",
+ "4.7.0205.0",
+ "6.1.7600.16385"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.server_added_timestamp",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-19T17:04:47.906Z",
+ "2015-07-01T02:12:21.783Z",
+ "2015-05-15T07:23:54.846Z"
+ ]
+ },
+ {
+ "column_name": "Signed",
+ "column_order": 1,
+ "data_path": "action_result.data.*.binary.results.*.signed",
+ "data_type": "string",
+ "example_values": [
+ "Signed"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.timestamp",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-19T17:04:47.906Z",
+ "2015-07-01T02:12:21.783Z",
+ "2015-05-15T07:23:54.846Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.watchlists.*.value",
+ "data_type": "string",
+ "example_values": [
+ "2015-07-01T02:20:02.062Z",
+ "2015-05-15T07:30:02.843Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid",
+ "data_type": "string",
+ "example_values": [
+ "5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.start",
+ "data_type": "numeric",
+ "example_values": [
+ 0,
+ 5
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.terms",
+ "data_type": "string",
+ "example_values": [
+ "md5:13ded573464ba7f43fe640479b309e09",
+ "md5:9bf50324444c46997c2492d505b47f2d",
+ "md5:5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.total_results",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.all_segments",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.comprehensive_search",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.elapsed",
+ "data_type": "numeric",
+ "example_values": [
+ 0.2200779914855957
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.day_of_week.*.name",
+ "data_type": "string",
+ "example_values": [
+ "0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.day_of_week.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1566
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.group.*.name",
+ "data_type": "string",
+ "example_values": [
+ "default group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.group.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.group.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.group.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 10128
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.host_type.*.name",
+ "data_type": "string",
+ "example_values": [
+ "domain_controller"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.host_type.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.host_type.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.host_type.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 10123
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hostname.*.name",
+ "data_type": "string",
+ "example_values": [
+ "dc2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hostname.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hostname.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "51.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hostname.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 5185
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hour_of_day.*.name",
+ "data_type": "string",
+ "example_values": [
+ "0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hour_of_day.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 411
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.facets.parent_name.*.name",
+ "data_type": "string",
+ "example_values": [
+ "svchost.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.parent_name.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.parent_name.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.parent_name.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9971
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.facets.path_full.*.name",
+ "data_type": "string",
+ "example_values": [
+ "c:\\windows\\syswow64\\wbem\\wmiprvse.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.path_full.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.path_full.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.path_full.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9971
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.process.facets.process_md5.*.name",
+ "data_type": "string",
+ "example_values": [
+ "4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_md5.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_md5.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_md5.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9971
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.facets.process_name.*.name",
+ "data_type": "string",
+ "example_values": [
+ "wmiprvse.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_name.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_name.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_name.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9971
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.start.*.name",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-24T00:00:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.start.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 324
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.username_full.*.name",
+ "data_type": "string",
+ "example_values": [
+ "LOCAL SERVICE"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.username_full.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.username_full.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.4"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.username_full.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9966
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.incomplete_results",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust",
+ "data_type": "numeric",
+ "example_values": [
+ -100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-07T02:37:28Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.childproc_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "contains": [
+ "file path"
+ ],
+ "data_path": "action_result.data.*.process.results.*.cmdline",
+ "data_type": "string",
+ "example_values": [
+ "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.comms_ip",
+ "data_type": "numeric",
+ "example_values": [
+ 168886572
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.crossproc_count",
+ "data_type": "numeric",
+ "example_values": [
+ 2
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.emet_config",
+ "data_type": "string",
+ "example_values": [
+ ""
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.emet_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.filemod_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.filtering_known_dlls",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.group",
+ "data_type": "string",
+ "example_values": [
+ "default group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.host_type",
+ "data_type": "string",
+ "example_values": [
+ "workstation"
+ ]
+ },
+ {
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.hostname",
+ "data_type": "string",
+ "example_values": [
+ "win7-client1"
+ ]
+ },
+ {
+ "contains": [
+ "carbon black process id"
+ ],
+ "data_path": "action_result.data.*.process.results.*.id",
+ "data_type": "string",
+ "example_values": [
+ "0000000f-0000-0688-01d3-27738c9b4243"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.interface_ip",
+ "data_type": "numeric",
+ "example_values": [
+ 168886572
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.last_server_update",
+ "data_type": "string",
+ "example_values": [
+ "2018-03-22T09:21:32.332Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.last_update",
+ "data_type": "string",
+ "example_values": [
+ "2017-09-07T00:52:15.82Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.modload_count",
+ "data_type": "numeric",
+ "example_values": [
+ 43
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.netconn_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.os_type",
+ "data_type": "string",
+ "example_values": [
+ "windows"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.parent_id",
+ "data_type": "string",
+ "example_values": [
+ "0000000f-0000-0258-01d1-ec51b545a19b"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.parent_md5",
+ "data_type": "string",
+ "example_values": [
+ "000000000000000000000000000000"
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.parent_name",
+ "data_type": "string",
+ "example_values": [
+ "svchost.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.parent_pid",
+ "data_type": "numeric",
+ "example_values": [
+ 600
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.parent_unique_id",
+ "data_type": "string",
+ "example_values": [
+ "0000000f-0000-0258-01d1-ec51b545a19b-000000000001"
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.path",
+ "data_type": "string",
+ "example_values": [
+ "c:\\windows\\syswow64\\wbem\\wmiprvse.exe"
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.process.results.*.process_md5",
+ "data_type": "string",
+ "example_values": [
+ "4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "contains": [
+ "process name",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.process_name",
+ "data_type": "string",
+ "example_values": [
+ "wmiprvse.exe"
+ ]
+ },
+ {
+ "contains": [
+ "pid"
+ ],
+ "data_path": "action_result.data.*.process.results.*.process_pid",
+ "data_type": "numeric",
+ "example_values": [
+ 1672
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.processblock_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.regmod_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.segment_id",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "contains": [
+ "carbon black sensor id"
+ ],
+ "data_path": "action_result.data.*.process.results.*.sensor_id",
+ "data_type": "numeric",
+ "example_values": [
+ 15
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.start",
+ "data_type": "string",
+ "example_values": [
+ "2017-09-07T00:52:15.758Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.terminated",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.unique_id",
+ "data_type": "string",
+ "example_values": [
+ "0000000f-0000-0688-01d3-27738c9b4243-000000000001"
+ ]
+ },
+ {
+ "contains": [
+ "user name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.username",
+ "data_type": "string",
+ "example_values": [
+ "SYSTEM"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.start",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.terms",
+ "data_type": "string",
+ "example_values": [
+ "md5:4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.total_results",
+ "data_type": "numeric",
+ "example_values": [
+ 32404
+ ]
+ },
+ {
+ "data_path": "action_result.summary.device_count",
+ "data_type": "numeric",
+ "example_values": [
+ 32404,
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Displaying 10 'process' results of total 32404",
+ "Displaying 1 'binary' results of total 1",
+ "Displaying 0 'binary' results of total 1"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "product_name": "",
+ "product_vendor": "",
+ "type": "endpoint"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "hunt file 2"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#FFFFFF"
+ },
+ "text.icon": {
+ "fill": "#FFFFFF"
+ }
+ },
+ "block_code": "def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_2' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5\", \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_2' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name=\"hunt_file_2\")\n\n return",
+ "callback_code": "",
+ "callback_start": 68,
+ "callsback": true,
+ "color": "#654796",
+ "connected_to_start": true,
+ "connection_name": "detonate file",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": 0,
+ "description": "Hunt for binaries with the malicious fileHash across endpoints.",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "35f205e2-949e-463e-9057-658f597b1dc9",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 215,
+ "line_end": 68,
+ "line_start": 43,
+ "message": "Configuring now",
+ "name": "hunt file",
+ "notes": "Hunt for binaries with the malicious fileHash across endpoints.",
+ "number": 2,
+ "order": 3,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1160,
+ "y": 240
+ },
+ "previous_function": "",
+ "previous_name": "hunt_file_2",
+ "required_params": {
+ "hash": true
+ },
+ "reviewer": "",
+ "show_number": true,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 2065
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".format": {
+ "text": "format_for_emailer"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out-1": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out-1>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "format"
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('format_for_emailer() called')\n \n template = \"\"\"Malware in a security event has been confirmed using file reputation and/or file detonation services.\n\nReputation Results:\nUsing file reputation services, the following file hashes have been identified as malware:\n{0}\n\nEDR tool detects that the above file hashes are present on the following endpoints: \n{1}\n\nDetonation Results:\nUsing sandboxing services, the following file hashes have been identified as malware:\n{2}\n\nThe Phantom Vault ID for the malicious files, as determined by the sandbox service, are as follows:\n{3}\n\nEDR tool detects that the file hashes indicated as positives per the sandbox service are present on the following endpoints: \n{4}\n\nContainer id: {5}\n\n[EOM]\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"hunt_file_1:action_result.parameter.hash\",\n \"hunt_file_1:action_result.data.*.process.results.*.hostname\",\n \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5\",\n \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.vault_id\",\n \"hunt_file_2:action_result.data.*.process.results.*.hostname\",\n \"container:id\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"format_for_emailer\")\n\n send_email_1(container=container)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "hunt file 1, hunt file 2",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "format_for_emailer",
+ "description": "Format all results for an email.",
+ "format": "format",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "f989d5e9-9586-408e-b424-8a3a5384936a",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "def join_format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('join_format_for_emailer() called')\n\n # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n if phantom.completed(action_names=['hunt_file_1', 'hunt_file_2']):\n \n # call connected block \"format_for_emailer\"\n format_for_emailer(container=container, handle=handle)\n \n return",
+ "join_optional": [],
+ "join_start": 314,
+ "line_end": 325,
+ "line_start": 272,
+ "message": "Configuring now",
+ "name": "format",
+ "notes": "Format all results for an email.",
+ "number": 2,
+ "order": 12,
+ "outPorts": [
+ "out-1"
+ ],
+ "parameters": [
+ {
+ "position": 0,
+ "type": "",
+ "value": "hunt_file_1:action_result.parameter.hash"
+ },
+ {
+ "position": 1,
+ "type": "",
+ "value": "hunt_file_1:action_result.data.*.process.results.*.hostname"
+ },
+ {
+ "position": 2,
+ "type": "",
+ "value": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5"
+ },
+ {
+ "position": 3,
+ "type": "",
+ "value": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.vault_id"
+ },
+ {
+ "position": 4,
+ "type": "",
+ "value": "hunt_file_2:action_result.data.*.process.results.*.hostname"
+ },
+ {
+ "position": 5,
+ "type": "",
+ "value": "container:id"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1400,
+ "y": 100
+ },
+ "previous_function": "",
+ "previous_name": "format_for_emailer",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "format",
+ "status": "",
+ "template": "Malware in a security event has been confirmed using file reputation and/or file detonation services.\n\nReputation Results:\nUsing file reputation services, the following file hashes have been identified as malware:\n{0}\n\nEDR tool detects that the above file hashes are present on the following endpoints: \n{1}\n\nDetonation Results:\nUsing sandboxing services, the following file hashes have been identified as malware:\n{2}\n\nThe Phantom Vault ID for the malicious files, as determined by the sandbox service, are as follows:\n{3}\n\nEDR tool detects that the file hashes indicated as positives per the sandbox service are present on the following endpoints: \n{4}\n\n\nContainer id: {5}\n\n[EOM]",
+ "title": "format",
+ "type": "coa.Format",
+ "warn": false,
+ "z": 2067
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#818D99",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#818D99",
+ "stroke": "#818D99"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "24b9331c-ecbd-454d-bdbd-926babd67934",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "f989d5e9-9586-408e-b424-8a3a5384936a",
+ "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb",
+ "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 2068
+ },
+ {
+ "action": "send email",
+ "action_type": "generic",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "attachments": "",
+ "bcc": "",
+ "body": "format_for_emailer:formatted_data",
+ "cc": "",
+ "from": "automation@phantom.localhost",
+ "headers": "",
+ "subject": "Malware event confirmed",
+ "to": "recipient@phantom.localhost"
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "SMTP",
+ "app_version": "1.2.29",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "attachments": "",
+ "bcc": "",
+ "body": "format_for_emailer:formatted_data",
+ "cc": "",
+ "from": "automation@phantom.localhost",
+ "headers": "",
+ "subject": "Malware event confirmed",
+ "to": "recipient@phantom.localhost"
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "smtp",
+ "output": [
+ {
+ "column_name": "Status",
+ "column_order": 0,
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success",
+ "failed"
+ ]
+ },
+ {
+ "contains": [
+ "vault id"
+ ],
+ "data_path": "action_result.parameter.attachments",
+ "data_type": "string",
+ "example_values": [
+ "ab2b2ccfba08ea538ef22f521caa01c3c2b17ccf"
+ ]
+ },
+ {
+ "contains": [
+ "email"
+ ],
+ "data_path": "action_result.parameter.bcc",
+ "data_type": "string",
+ "example_values": [
+ "test1@testdomain.com"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.body",
+ "data_type": "string",
+ "example_values": [
+ "Test body"
+ ]
+ },
+ {
+ "contains": [
+ "email"
+ ],
+ "data_path": "action_result.parameter.cc",
+ "data_type": "string",
+ "example_values": [
+ "test2@testdomain.com"
+ ]
+ },
+ {
+ "contains": [
+ "email"
+ ],
+ "data_path": "action_result.parameter.from",
+ "data_type": "string",
+ "example_values": [
+ "sender@testdomain.com"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.headers",
+ "data_type": "string",
+ "example_values": [
+ "{\"Subject\": \"Test1\", \"To\": \"test3@testdomain.com\"}"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.subject",
+ "data_type": "string",
+ "example_values": [
+ "Test"
+ ]
+ },
+ {
+ "contains": [
+ "email"
+ ],
+ "data_path": "action_result.parameter.to",
+ "data_type": "string",
+ "example_values": [
+ "receiver@testdomain.com"
+ ]
+ },
+ {
+ "data_path": "action_result.data",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Message",
+ "column_order": 1,
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Email sent"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric"
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric"
+ }
+ ],
+ "product_name": "SMTP",
+ "product_vendor": "Generic",
+ "type": "email"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "send email"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Generic"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_generic.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#FFFFFF"
+ },
+ "text.icon": {
+ "fill": "#FFFFFF"
+ }
+ },
+ "block_code": "def send_email_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('send_email_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'send_email_1' call\n formatted_data_1 = phantom.get_format_data(name='format_for_emailer')\n\n parameters = []\n \n # build parameters list for 'send_email_1' call\n parameters.append({\n 'cc': \"\",\n 'to': \"recipient@phantom.localhost\",\n 'bcc': \"\",\n 'body': formatted_data_1,\n 'from': \"automation@phantom.localhost\",\n 'headers': \"\",\n 'subject': \"Malware event confirmed\",\n 'attachments': \"\",\n })\n\n phantom.act(action=\"send email\", parameters=parameters, assets=['smtp'], name=\"send_email_1\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#5094D4",
+ "connected_to_start": true,
+ "connection_name": "hunt file 1, hunt file 2",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": 0,
+ "description": "Send the formatted string as an email.",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 269,
+ "line_start": 243,
+ "message": "Configuring now",
+ "name": "send email",
+ "notes": "Send the formatted string as an email.",
+ "number": 1,
+ "order": 11,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1640,
+ "y": 100
+ },
+ "previous_function": "",
+ "previous_name": "send_email_1",
+ "required_params": {
+ "body": true,
+ "to": true
+ },
+ "reviewer": "",
+ "show_number": false,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "action_assets",
+ "status": "",
+ "title": "Generic",
+ "type": "coa.Action",
+ "warn": "",
+ "z": 2069
+ }
+ ]
+ },
+ "notes": "The playbook uses the following Apps: \n - Virus Total (file reputation) [asset name = virustotal]\n - Palo Alto Networks Wildfire (detonate file) [asset name = wildfire]\n - Carbon Black (hunt file) [asset name = carbonblack]\n - SMTP (send email) [asset name = smtp]\n\nBe sure to update asset naming to reflect the asset names configured in your environment."
+ },
+ "python_version": "3",
+ "schema": 4,
+ "version": "4.10.0.40961"
+ },
+ "create_time": "2021-01-19T21:50:52.204902+00:00",
+ "draft_mode": false,
+ "labels": [
+ "*"
+ ],
+ "tags": []
+}
\ No newline at end of file
diff --git a/playbooks/email_notification_for_malware.png b/playbooks/email_notification_for_malware.png
new file mode 100644
index 0000000000..bc5bb024d6
Binary files /dev/null and b/playbooks/email_notification_for_malware.png differ
diff --git a/playbooks/email_notification_for_malware.py b/playbooks/email_notification_for_malware.py
new file mode 100644
index 0000000000..020befaecf
--- /dev/null
+++ b/playbooks/email_notification_for_malware.py
@@ -0,0 +1,338 @@
+"""
+This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team.
+"""
+
+import phantom.rules as phantom
+import json
+from datetime import datetime, timedelta
+def on_start(container):
+ phantom.debug('on_start() called')
+
+ # call 'filter_1' block
+ filter_1(container=container)
+
+ return
+
+"""
+Run a reputation lookup on the fileHash to determine how many antivirus engines recognize it as malware.
+"""
+def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('file_reputation_1() called')
+
+ # collect data for 'file_reputation_1' call
+ filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_1:condition_1:artifact:*.id'])
+
+ parameters = []
+
+ # build parameters list for 'file_reputation_1' call
+ for filtered_artifacts_item_1 in filtered_artifacts_data_1:
+ if filtered_artifacts_item_1[0]:
+ parameters.append({
+ 'hash': filtered_artifacts_item_1[0],
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': filtered_artifacts_item_1[1]},
+ })
+
+ phantom.act(action="file reputation", parameters=parameters, assets=['virustotal'], callback=filter_2, name="file_reputation_1")
+
+ return
+
+"""
+Hunt for binaries with the malicious fileHash across endpoints.
+"""
+def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('hunt_file_2() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'hunt_file_2' call
+ filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5", "filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.context.artifact_id"])
+
+ parameters = []
+
+ # build parameters list for 'hunt_file_2' call
+ for filtered_results_item_1 in filtered_results_data_1:
+ if filtered_results_item_1[0]:
+ parameters.append({
+ 'hash': filtered_results_item_1[0],
+ 'type': "",
+ 'range': "",
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': filtered_results_item_1[1]},
+ })
+
+ phantom.act(action="hunt file", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name="hunt_file_2")
+
+ return
+
+"""
+Detonate file requires a Vault file, so only proceed if vaultId is not null.
+"""
+def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('filter_4() called')
+
+ # collect filtered artifact ids for 'if' condition 1
+ matched_artifacts_1, matched_results_1 = phantom.condition(
+ container=container,
+ action_results=results,
+ conditions=[
+ ["filtered-data:filter_3:condition_1:artifact:*.cef.vaultId", "!=", ""],
+ ],
+ name="filter_4:condition_1")
+
+ # call connected blocks if filtered artifacts or results
+ if matched_artifacts_1 or matched_results_1:
+ detonate_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+ return
+
+"""
+Only hunt files that are considered malware per the sandbox (malware == yes).
+"""
+def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('filter_5() called')
+
+ # collect filtered artifact ids for 'if' condition 1
+ matched_artifacts_1, matched_results_1 = phantom.condition(
+ container=container,
+ action_results=results,
+ conditions=[
+ ["detonate_file_1:action_result.summary.malware", "==", "yes"],
+ ],
+ name="filter_5:condition_1")
+
+ # call connected blocks if filtered artifacts or results
+ if matched_artifacts_1 or matched_results_1:
+ hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+ return
+
+"""
+Match hashes with less than 10 positives to artifacts to identify filtered_artifacts.
+"""
+def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('filter_3() called')
+
+ # collect filtered artifact ids for 'if' condition 1
+ matched_artifacts_1, matched_results_1 = phantom.condition(
+ container=container,
+ action_results=results,
+ conditions=[
+ ["filtered-data:filter_2:condition_2:file_reputation_1:action_result.parameter.hash", "==", "artifact:*.cef.fileHash"],
+ ],
+ name="filter_3:condition_1")
+
+ # call connected blocks if filtered artifacts or results
+ if matched_artifacts_1 or matched_results_1:
+ filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+ return
+
+"""
+If 10 or more antivirus engines flagged the hash, proceed directly to hunt for the file. Else, use a sandbox to detonate the executable first.
+"""
+def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('filter_2() called')
+
+ # collect filtered artifact ids for 'if' condition 1
+ matched_artifacts_1, matched_results_1 = phantom.condition(
+ container=container,
+ action_results=results,
+ conditions=[
+ ["file_reputation_1:action_result.summary.positives", ">=", 10],
+ ],
+ name="filter_2:condition_1")
+
+ # call connected blocks if filtered artifacts or results
+ if matched_artifacts_1 or matched_results_1:
+ hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+ # collect filtered artifact ids for 'if' condition 2
+ matched_artifacts_2, matched_results_2 = phantom.condition(
+ container=container,
+ action_results=results,
+ conditions=[
+ ["file_reputation_1:action_result.summary.positives", "<", 10],
+ ],
+ name="filter_2:condition_2")
+
+ # call connected blocks if filtered artifacts or results
+ if matched_artifacts_2 or matched_results_2:
+ filter_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)
+
+ return
+
+"""
+Hunt for binaries with the malicious fileHash across endpoints.
+"""
+def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('hunt_file_1() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'hunt_file_1' call
+ filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.context.artifact_id"])
+
+ parameters = []
+
+ # build parameters list for 'hunt_file_1' call
+ for filtered_results_item_1 in filtered_results_data_1:
+ if filtered_results_item_1[0]:
+ parameters.append({
+ 'hash': filtered_results_item_1[0],
+ 'type': "",
+ 'range': "",
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': filtered_results_item_1[1]},
+ })
+
+ phantom.act(action="hunt file", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name="hunt_file_1")
+
+ return
+
+"""
+Only process artifacts that have a CEF fileHash.
+"""
+def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('filter_1() called')
+
+ # collect filtered artifact ids for 'if' condition 1
+ matched_artifacts_1, matched_results_1 = phantom.condition(
+ container=container,
+ conditions=[
+ ["artifact:*.cef.fileHash", "!=", ""],
+ ],
+ name="filter_1:condition_1")
+
+ # call connected blocks if filtered artifacts or results
+ if matched_artifacts_1 or matched_results_1:
+ file_reputation_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+ return
+
+"""
+Detonate the file(s) in the vault.
+"""
+def detonate_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('detonate_file_1() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'detonate_file_1' call
+ filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.vaultId', 'filtered-data:filter_4:condition_1:artifact:*.id'])
+
+ parameters = []
+
+ # build parameters list for 'detonate_file_1' call
+ for filtered_artifacts_item_1 in filtered_artifacts_data_1:
+ if filtered_artifacts_item_1[0]:
+ parameters.append({
+ 'vault_id': filtered_artifacts_item_1[0],
+ 'file_name': "",
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': filtered_artifacts_item_1[1]},
+ })
+
+ phantom.act(action="detonate file", parameters=parameters, assets=['wildfire'], callback=filter_5, name="detonate_file_1")
+
+ return
+
+"""
+Send the formatted string as an email.
+"""
+def send_email_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('send_email_1() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'send_email_1' call
+ formatted_data_1 = phantom.get_format_data(name='format_for_emailer')
+
+ parameters = []
+
+ # build parameters list for 'send_email_1' call
+ parameters.append({
+ 'cc': "",
+ 'to': "recipient@phantom.localhost",
+ 'bcc': "",
+ 'body': formatted_data_1,
+ 'from': "automation@phantom.localhost",
+ 'headers': "",
+ 'subject': "Malware event confirmed",
+ 'attachments': "",
+ })
+
+ phantom.act(action="send email", parameters=parameters, assets=['smtp'], name="send_email_1")
+
+ return
+
+"""
+Format all results for an email.
+"""
+def format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('format_for_emailer() called')
+
+ template = """Malware in a security event has been confirmed using file reputation and/or file detonation services.
+
+Reputation Results:
+Using file reputation services, the following file hashes have been identified as malware:
+{0}
+
+EDR tool detects that the above file hashes are present on the following endpoints:
+{1}
+
+Detonation Results:
+Using sandboxing services, the following file hashes have been identified as malware:
+{2}
+
+The Phantom Vault ID for the malicious files, as determined by the sandbox service, are as follows:
+{3}
+
+EDR tool detects that the file hashes indicated as positives per the sandbox service are present on the following endpoints:
+{4}
+
+Container id: {5}
+
+[EOM]"""
+
+ # parameter list for template variable replacement
+ parameters = [
+ "hunt_file_1:action_result.parameter.hash",
+ "hunt_file_1:action_result.data.*.process.results.*.hostname",
+ "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5",
+ "filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.vault_id",
+ "hunt_file_2:action_result.data.*.process.results.*.hostname",
+ "container:id",
+ ]
+
+ phantom.format(container=container, template=template, parameters=parameters, name="format_for_emailer")
+
+ send_email_1(container=container)
+
+ return
+
+def join_format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):
+ phantom.debug('join_format_for_emailer() called')
+
+ # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed
+ if phantom.completed(action_names=['hunt_file_1', 'hunt_file_2']):
+
+ # call connected block "format_for_emailer"
+ format_for_emailer(container=container, handle=handle)
+
+ return
+
+def on_finish(container, summary):
+ phantom.debug('on_finish() called')
+ # This function is called after all actions are completed.
+ # summary of all the action and/or all details of actions
+ # can be collected here.
+
+ # summary_json = phantom.get_summary()
+ # if 'result' in summary_json:
+ # for action_result in summary_json['result']:
+ # if 'action_run_id' in action_result:
+ # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)
+ # phantom.debug(action_results)
+
+ return
\ No newline at end of file
diff --git a/playbooks/email_notification_for_malware.yml b/playbooks/email_notification_for_malware.yml
new file mode 100644
index 0000000000..a6c5b70531
--- /dev/null
+++ b/playbooks/email_notification_for_malware.yml
@@ -0,0 +1,23 @@
+name: Email Notification for Malware
+id: fb3edc76-ff2b-48b0-5f6f-63da6483fd63
+version: 1
+date: '2021-01-19'
+author: Philip Royer, Splunk
+type: Response
+description: This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team.
+playbook: email_notification_for_malware
+how_to_implement: "Be sure to update asset naming to reflect the asset names configured in your environment."
+references: []
+app_list:
+- "VirusTotal"
+- "WildFire"
+- "CarbonBlack Response"
+- "SMTP"
+tags:
+ platform_tags:
+ - Response
+ playbook_fields:
+ - fileHash
+ - vaultId
+ product:
+ - Splunk SOAR
\ No newline at end of file
diff --git a/playbooks/malware_hunt_and_contain.json b/playbooks/malware_hunt_and_contain.json
new file mode 100644
index 0000000000..ab2ede583c
--- /dev/null
+++ b/playbooks/malware_hunt_and_contain.json
@@ -0,0 +1,11686 @@
+{
+ "blockly": false,
+ "blockly_xml": "",
+ "category": "Use Cases",
+ "coa": {
+ "data": {
+ "clean": true,
+ "code_block": "\"\"\"Malicous file detected on endpoint\"\"\"",
+ "description": "This playbook investigates and remediates malware infections on the endpoint.",
+ "hash": "d1af271dc2c9e67bf0393c4503368436c574f31a",
+ "joint": {
+ "cells": [
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "5ad21936-f8c5-45e3-ab48-4aa74d2185b3",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "4c86e34b-13d5-4884-b1d2-53d1f3448f91",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "3c5abd70-80e5-46b8-908e-4eeb0ae4cef5",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 14
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "c168d4c9-945d-4742-a662-6e4abbc945da",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "3c5abd70-80e5-46b8-908e-4eeb0ae4cef5",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "8c9518d8-506f-4750-9e8e-2094bd14d431",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 651
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "3949529c-aff6-4401-90d8-a70c288b74d5",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "b9591115-e22e-48e0-952d-47c76448f051",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "0444efd4-6363-4dea-acca-b0c02ce9f973",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 1290
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "9b55f239-b39d-4fe3-adda-f6168661b33a",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "72f13962-4d43-44be-9710-d2ed60cbbf00",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "0444efd4-6363-4dea-acca-b0c02ce9f973",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 1558
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "9c84c8ba-08f4-4cec-acfd-c4dbccbbc66e",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "4fb5d51d-3f89-4408-88c4-4af8f22feb5a",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 1694
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "b415fd2a-3939-4c18-a92e-efa93d32b1c6",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "a2d2bac8-c4c2-41b2-9c94-5e958b32684f",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4",
+ "port": "in",
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 1706
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "961848a5-5fd4-4e3b-8b7b-6ef40ea4d007",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "34bd4b5e-7b04-43a8-9fa7-dff28adb98dc",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4",
+ "port": "in",
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 1710
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "1649dbd5-f0bf-43ec-951b-5ad008365d1d",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "b9591115-e22e-48e0-952d-47c76448f051",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 1718
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "0db3fd7f-4779-44c3-8ea3-694bad0388d9",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "8c9518d8-506f-4750-9e8e-2094bd14d431",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "0fe35225-af74-44fa-b1a4-433a9c00cadb",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 1886
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "88f69577-f71a-4ee0-8386-9ab6bcd33e28",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "0fe35225-af74-44fa-b1a4-433a9c00cadb",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "f8ca6cc8-63fc-4ccf-b4cb-1a5ed1941c4d",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 1892
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "48627df2-9bc5-40fa-858e-426631c72ab9",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "8c9518d8-506f-4750-9e8e-2094bd14d431",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "91866693-2720-43a1-a437-f65f19382b9a",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 1903
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "fbce023e-da26-4df2-829b-99d0a167cdd0",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "8c9518d8-506f-4750-9e8e-2094bd14d431",
+ "port": "out-2",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 1968
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "509e0e96-ee20-4dd7-8a04-e5a9b8f1db85",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "34bd4b5e-7b04-43a8-9fa7-dff28adb98dc",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 1982
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "f5d00299-537c-4bf8-b86b-a500fa1c2258",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "4fb5d51d-3f89-4408-88c4-4af8f22feb5a",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 1988
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "ee268141-044c-48e5-b1ad-29803892a264",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "a2d2bac8-c4c2-41b2-9c94-5e958b32684f",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 1992
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "0a60f02d-fb84-4d21-af04-0adc070f3ccf",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "8c9518d8-506f-4750-9e8e-2094bd14d431",
+ "port": "out-2",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "e6a1a311-5337-4d44-b8d3-58d8a6cf8be1",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 2050
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "562f6e73-5fb8-4722-b99b-7b2b91109a37",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "4aa9e1f2-fc69-4439-ae54-3eb215adec8f",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 2324
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "14967b49-8e3a-4a08-8c66-53f7e7b5b4b2",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "4aa9e1f2-fc69-4439-ae54-3eb215adec8f",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4",
+ "port": "in",
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 2339
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "d580f77a-9877-4c13-9a40-308797deca8d",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "f8ca6cc8-63fc-4ccf-b4cb-1a5ed1941c4d",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "e9a5e63f-becb-4040-914b-bdaeb8278d88",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 2544
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ },
+ ".tool-remove": {
+ "position": 0.5
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "c2f5849d-4fa9-4a35-93df-7570b63d2304",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "e9a5e63f-becb-4040-914b-bdaeb8278d88",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "72f13962-4d43-44be-9710-d2ed60cbbf00",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 2557
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773",
+ "transform": "rotate(45 30 70)"
+ },
+ ".border": {
+ "transform": "rotate(45 30 70)"
+ },
+ ".inPorts>.port-0>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".number": {
+ "text": 3
+ },
+ ".outPorts>.port-0": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ },
+ "ref-x": 83,
+ "ref-y": 40
+ },
+ ".outPorts>.port-0>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_3() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">\", 5],\n [\"file_reputation_1:action_result.summary.positives\", \"<=\", 10],\n ],\n logical_operator='and',\n name=\"filter_3:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n create_ticket_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": false,
+ "connection_name": "block hash 2",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "",
+ "hasElse": false,
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "e9a5e63f-becb-4040-914b-bdaeb8278d88",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 44,
+ "line_start": 24,
+ "name": "filter",
+ "notes": "",
+ "number": 3,
+ "order": 2,
+ "outPorts": [
+ "out-1"
+ ],
+ "outputs": [
+ {
+ "conditions": [
+ {
+ "comparison": ">",
+ "data_type": "",
+ "param": "file_reputation_1:action_result.summary.positives",
+ "value": "5"
+ },
+ {
+ "comparison": "<=",
+ "data_type": "",
+ "param": "file_reputation_1:action_result.summary.positives",
+ "value": "10"
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1080,
+ "y": 80
+ },
+ "previous_block_type": "",
+ "previous_function": "",
+ "previous_name": "filter_3",
+ "show_number": true,
+ "size": {
+ "height": 82,
+ "width": 82
+ },
+ "state": "filter",
+ "status": "",
+ "type": "coa.Filter",
+ "warn": false,
+ "z": 2590
+ },
+ {
+ "action": "shutdown system",
+ "action_type": "contain",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname",
+ "message": "",
+ "wait_time": ""
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "",
+ "app_version": "",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname",
+ "message": "",
+ "ph": "",
+ "wait_time": ""
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "domainctrl1",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.wait_time",
+ "data_type": "numeric"
+ },
+ {
+ "data_path": "action_result.parameter.message",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Machine Ip Name",
+ "column_order": 0,
+ "contains": [
+ "ip",
+ "host name"
+ ],
+ "data_path": "action_result.parameter.ip_hostname",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Message",
+ "column_order": 1,
+ "data_path": "action_result.message",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Total Objects",
+ "data_path": "summary.total_objects",
+ "data_type": "numeric"
+ },
+ {
+ "column_name": "Total Objects Successful",
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric"
+ }
+ ],
+ "product_name": "",
+ "product_vendor": "",
+ "type": "endpoint"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "shutdown system"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Contain"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_contain.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#FFFFFF"
+ },
+ "text.icon": {
+ "fill": "#FFFFFF"
+ }
+ },
+ "block_code": "def shutdown_system_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('shutdown_system_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'shutdown_system_1' call\n results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'shutdown_system_1' call\n for results_item_1 in results_data_1:\n parameters.append({\n 'ph': \"\",\n 'message': \"\",\n 'wait_time': \"\",\n 'ip_hostname': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"shutdown system\", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name=\"shutdown_system_1\", parent_action=action)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#3D9959",
+ "connected_to_start": false,
+ "connection_name": "hunt file 2",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": "0",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "a2d2bac8-c4c2-41b2-9c94-5e958b32684f",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 69,
+ "line_start": 44,
+ "message": "Configuring now",
+ "name": "shutdown system",
+ "notes": "",
+ "number": 1,
+ "order": 3,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 840,
+ "y": 760
+ },
+ "previous_block_type": "",
+ "previous_function": "",
+ "previous_name": "shutdown_system_1",
+ "required_params": {},
+ "reviewer": "",
+ "showNumber": false,
+ "show_number": false,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Contain",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 2794
+ },
+ {
+ "action": "create ticket",
+ "action_type": "generic",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "description": "",
+ "fields": "",
+ "short_description": "Virus Detected"
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "",
+ "app_version": "",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "description": "",
+ "fields": "",
+ "short_description": "Virus Detected",
+ "table": "",
+ "vault_id": ""
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "servicenow",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.short_description",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "servicenow table"
+ ],
+ "data_path": "action_result.parameter.table",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.fields",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.description",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "servicenow ticket id"
+ ],
+ "data_path": "action_result.summary.created_ticket_id",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "vault id"
+ ],
+ "data_path": "action_result.parameter.vault_id",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_updated_on",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_updated_by",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.escalation",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.watch_list",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.follow_up",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.made_sla",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.delivery_task",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sla_due",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Number",
+ "column_order": 0,
+ "data_path": "action_result.data.*.number",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.caller_id",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.correlation_id",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_mod_count",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.notify",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.resolved_by",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Closed On",
+ "column_order": 6,
+ "data_path": "action_result.data.*.closed_at",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_tags",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.cmdb_ci",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.subcategory",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.category",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.close_notes",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.expected_start",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.knowledge",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.opened_by.link",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.opened_by.value",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.impact",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.calendar_stc",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.caused_by",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.comments",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.problem_id",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.activity_due",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.state",
+ "data_type": "string"
+ },
+ {
+ "column_name": "ID",
+ "column_order": 4,
+ "contains": [
+ "servicenow ticket id"
+ ],
+ "data_path": "action_result.data.*.sys_id",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Opened On",
+ "column_order": 5,
+ "data_path": "action_result.data.*.opened_at",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.child_incidents",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.work_notes",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Short Description",
+ "column_order": 0,
+ "data_path": "action_result.data.*.short_description",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.comments_and_work_notes",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.time_worked",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_created_by",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.upon_reject",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.reassignment_count",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.business_stc",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.due_date",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_class_name",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.delivery_plan",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Description",
+ "column_order": 1,
+ "data_path": "action_result.data.*.description",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.parent",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.business_duration",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.rfc",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.company",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.assigned_to",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.approval_history",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.user_input",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.work_start",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_domain.link",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_domain.value",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.resolved_at",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.calendar_duration",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.group_list",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.active",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.approval",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.parent_incident",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_domain_path",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.closed_by",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Severity",
+ "column_order": 2,
+ "data_path": "action_result.data.*.severity",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.upon_approval",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.incident_state",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.reopen_count",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.contact_type",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.work_end",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.work_notes_list",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_created_on",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.location",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.correlation_display",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.close_code",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.assignment_group",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.approval_set",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.order",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.urgency",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Priority",
+ "column_order": 2,
+ "data_path": "action_result.data.*.priority",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.hold_reason",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.business_service",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.sys_id",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.sys_tags",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.attachment_details.*.file_name",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.compressed",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.size_bytes",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.table_name",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.image_width",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.content_type",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.image_height",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.table_sys_id",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.data.*.attachment_details.*.download_link",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.sys_mod_count",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.sys_created_by",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.sys_created_on",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.sys_updated_by",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.sys_updated_on",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.size_compressed",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.average_image_color",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.additional_assignee_list",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary.attachment_id",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary.attachment_added",
+ "data_type": "boolean"
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric"
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric"
+ }
+ ],
+ "product_name": "",
+ "product_vendor": "",
+ "type": "ticketing"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "create ticket 2"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Utilities"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg"
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_generic.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#FFFFFF"
+ },
+ "text.icon": {
+ "fill": "#FFFFFF"
+ }
+ },
+ "block_code": "# read-only block view not available",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#5094D4",
+ "connected_to_start": false,
+ "connection_name": "logoff user, shutdown system, disable user, block hash 3",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "def create_ticket_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'create_ticket_2' call\n\n disabled_users = set(phantom.collect2(datapath='disable_user_1:action_result.parameter.username'))\n blocked_hashes = set(phantom.collect2(datapath='block_hash_3:action_result.parameter.hash'))\n loggedoff_users = set(phantom.collect2(datapath='logoff_user_1:action_result.parameter.username'))\n shutdown_systems = set(phantom.collect2(datapath='shutdown_system_1:action_result.parameter.ip_hostname'))\n file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash', \n 'file_reputation_1:filtered-action_result.summary.positives'])\n detected_users = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.username'))\n detected_systems = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.hostname'))\n \n title = \"Virus Detected on {0} devices\".format(len(detected_systems))\n \n description = \"Hashes sumbitted with detections:\\n{0}\\n\\n\".format(\", \".join([\"{0} ({1})\".format(*fr) for fr in file_reputation]))\n description += \"File was found on {0} devices:\\n{1}\\n\\n\".format(len(detected_systems), ', '.join(detected_systems))\n description += \"This impacts at least {0} users:\\n{1}\\n\\n\".format(len(detected_users), ', '.join(detected_users))\n if len(blocked_hashes):\n description += \"{0} hashes were submitted for blocking:\\n{1}\\n\\n\".format(len(blocked_hashes), \", \".join(blocked_hashes))\n if len(loggedoff_users):\n description += \"{0} users were forced to logoff:\\n{1}\\n\\n\".format(len(loggedoff_users), \", \".join(loggedoff_users))\n if len(disabled_users):\n description += \"{0} user accounts were disabled:\\n{1}\\n\\n\".format(len(disabled_users), \", \".join(disabled_users))\n if len(shutdown_systems):\n description += \"{0} systems were shutdown:\\n{1}\\n\\n\".format(len(shutdown_systems), \", \".join(shutdown_systems))\n\n parameters = []\n \n # build parameters list for 'create_ticket_2' call\n parameters.append({\n 'short_description': title,\n 'description': description,\n 'fields': \"\",\n })\n\n if parameters:\n phantom.act(\"create ticket\", parameters=parameters, assets=['servicenow'], name=\"create_ticket_2\", parent_action=action) \n else:\n phantom.error(\"'create_ticket_2' will not be executed due to lack of parameters\")\n \n return",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": "0",
+ "description": "",
+ "has_custom": true,
+ "has_custom_block": true,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "b9591115-e22e-48e0-952d-47c76448f051",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 114,
+ "line_start": 69,
+ "message": "Configuring now",
+ "name": "create ticket",
+ "notes": "",
+ "number": 2,
+ "order": 4,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1220,
+ "y": 340
+ },
+ "previous_block_type": "",
+ "previous_function": "",
+ "previous_name": "create_ticket_2",
+ "required_params": {},
+ "reviewer": "",
+ "showNumber": true,
+ "show_number": true,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Utilities",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 2825
+ },
+ {
+ "action": "logoff user",
+ "action_type": "contain",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname",
+ "username": ""
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "",
+ "app_version": "",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname",
+ "username": ""
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "domainctrl1",
+ "output": [
+ {
+ "column_name": "Username",
+ "column_order": 0,
+ "contains": [
+ "user name"
+ ],
+ "data_path": "action_result.parameter.username",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Message",
+ "column_order": 1,
+ "data_path": "action_result.message",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.status",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "ip",
+ "host name"
+ ],
+ "data_path": "action_result.parameter.ip_hostname",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Total Objects",
+ "data_path": "summary.total_objects",
+ "data_type": "numeric"
+ },
+ {
+ "column_name": "Total Objects Successful",
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric"
+ }
+ ],
+ "product_name": "",
+ "product_vendor": "",
+ "type": "endpoint"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "logoff user"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Contain"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_contain.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#FFFFFF"
+ },
+ "text.icon": {
+ "fill": "#FFFFFF"
+ }
+ },
+ "block_code": "def logoff_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('logoff_user_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'logoff_user_1' call\n results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'logoff_user_1' call\n for results_item_1 in results_data_1:\n parameters.append({\n 'username': \"\",\n 'ip_hostname': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"logoff user\", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name=\"logoff_user_1\", parent_action=action)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#3D9959",
+ "connected_to_start": false,
+ "connection_name": "hunt file 2",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": "0",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "4fb5d51d-3f89-4408-88c4-4af8f22feb5a",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 166,
+ "line_start": 143,
+ "message": "Configuring now",
+ "name": "logoff user",
+ "notes": "",
+ "number": 1,
+ "order": 6,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 840,
+ "y": 620
+ },
+ "previous_block_type": "",
+ "previous_function": "",
+ "previous_name": "logoff_user_1",
+ "required_params": {},
+ "reviewer": "",
+ "showNumber": false,
+ "show_number": false,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Contain",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 2827
+ },
+ {
+ "0": "S",
+ "1": "T",
+ "2": "A",
+ "3": "R",
+ "4": "T",
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "ref-x": 33,
+ "ref-y": 8,
+ "text": "START"
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "ref-x": 13,
+ "xlink:href": "/inc/coa/img/block_icon_start.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ }
+ },
+ "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'file_reputation_1' block\n file_reputation_1(container=container)\n\n return",
+ "callback_code": "# read-only block view not available",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "4c86e34b-13d5-4884-b1d2-53d1f3448f91",
+ "inPorts": [],
+ "join_code": "# read-only block view not available",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 24,
+ "line_start": 16,
+ "name": "",
+ "notes": "",
+ "number": 0,
+ "order": 1,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 80,
+ "y": 100
+ },
+ "previous_function": "",
+ "previous_name": "",
+ "show_number": true,
+ "size": {
+ "height": 54,
+ "width": 80
+ },
+ "status": "",
+ "title": "START",
+ "type": "coa.StartEnd",
+ "warn": false,
+ "z": 2895
+ },
+ {
+ "0": "E",
+ "1": "N",
+ "2": "D",
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".title": {
+ "text": "END"
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_end.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ }
+ },
+ "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return",
+ "callback_code": "# read-only block view not available",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "create ticket 2, create ticket 3",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "0444efd4-6363-4dea-acca-b0c02ce9f973",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "# read-only block view not available",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 456,
+ "line_start": 443,
+ "name": "",
+ "notes": "",
+ "number": 0,
+ "order": 17,
+ "outPorts": [],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1460,
+ "y": 100
+ },
+ "previous_function": "",
+ "previous_name": "",
+ "show_number": true,
+ "size": {
+ "height": 54,
+ "width": 80
+ },
+ "status": "",
+ "title": "END",
+ "type": "coa.StartEnd",
+ "warn": false,
+ "z": 2901
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773",
+ "transform": "rotate(45 30 70)"
+ },
+ ".border": {
+ "transform": "rotate(45 30 70)"
+ },
+ ".inPorts>.port-0>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".number": {
+ "text": 1
+ },
+ ".outPorts>.port-0": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ },
+ "ref-x": 83,
+ "ref-y": 40
+ },
+ ".outPorts>.port-0>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ ".outPorts>.port-1": {
+ "port": {
+ "id": "out-2",
+ "type": "out"
+ },
+ "ref-x": 41,
+ "ref-y": 82
+ },
+ ".outPorts>.port-1>.port-body": {
+ "port": {
+ "id": "out-2",
+ "type": "out"
+ }
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_1() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">\", 5],\n [\"file_reputation_1:action_result.summary.positives\", \"<=\", 10],\n ],\n logical_operator='and',\n name=\"filter_1:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n get_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n # collect filtered artifact ids for 'if' condition 2\n matched_artifacts_2, matched_results_2 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">\", 10],\n ],\n name=\"filter_1:condition_2\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_2 or matched_results_2:\n hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n get_file_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "file reputation",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "",
+ "hasElse": false,
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "8c9518d8-506f-4750-9e8e-2094bd14d431",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 201,
+ "line_start": 166,
+ "name": "filter",
+ "notes": "",
+ "number": 1,
+ "order": 7,
+ "outPorts": [
+ "out-1",
+ "out-2"
+ ],
+ "outputs": [
+ {
+ "conditions": [
+ {
+ "comparison": ">",
+ "data_type": "",
+ "param": "file_reputation_1:action_result.summary.positives",
+ "value": "5"
+ },
+ {
+ "comparison": "<=",
+ "data_type": "",
+ "param": "file_reputation_1:action_result.summary.positives",
+ "value": "10"
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ },
+ {
+ "conditions": [
+ {
+ "comparison": ">",
+ "data_type": "",
+ "param": "file_reputation_1:action_result.summary.positives",
+ "value": "10"
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 460,
+ "y": 80
+ },
+ "previous_block_type": "",
+ "previous_function": "",
+ "previous_name": "filter_1",
+ "show_number": true,
+ "size": {
+ "height": 82,
+ "width": 82
+ },
+ "state": "filter",
+ "status": "",
+ "type": "coa.Filter",
+ "warn": false,
+ "z": 2941
+ },
+ {
+ "action": "hunt file",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash",
+ "range": "",
+ "type": ""
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "",
+ "app_version": "",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash",
+ "range": "",
+ "type": ""
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "carbonblack",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success"
+ ]
+ },
+ {
+ "contains": [
+ "hash",
+ "md5"
+ ],
+ "data_path": "action_result.parameter.hash",
+ "data_type": "string",
+ "example_values": [
+ "4fb491ac8d46aaf22ba8bc5c73dabef7",
+ "13ded573464ba7f43fe640479b309e09",
+ "9bf50324444c46997c2492d505b47f2d",
+ "5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.range",
+ "data_type": "string",
+ "example_values": [
+ "0-10",
+ "0-2",
+ "5-8"
+ ]
+ },
+ {
+ "contains": [
+ "carbon black query type"
+ ],
+ "data_path": "action_result.parameter.type",
+ "data_type": "string",
+ "example_values": [
+ "process",
+ "binary"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.elapsed",
+ "data_type": "numeric",
+ "example_values": [
+ 0.1120398044586182,
+ 0.04952096939086914,
+ 0.1234798431396484,
+ 0.05507302284240723,
+ 0.05384993553161621
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_result.*.name",
+ "data_type": "string",
+ "example_values": [
+ "Signed"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_result.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-01T00:00:00Z",
+ "2015-01-01T00:00:00Z",
+ "2013-11-01T00:00:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1,
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "16.0.10827.20181",
+ "4.7.0205.0",
+ "6.1.7600.16385 (win7_rtm.090713-1255)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.group.*.name",
+ "data_type": "string",
+ "example_values": [
+ "default group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.group.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.group.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.group.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.host_count.*.name",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.host_count.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1,
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.hostname.*.name",
+ "data_type": "string",
+ "example_values": [
+ "CB-TEST-02",
+ "WIN7-CLIENT1",
+ "ACCOUNTING-PC"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.hostname.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.hostname.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0",
+ "16.7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.hostname.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe",
+ "c:\\program files\\microsoft security client\\nissrv.exe",
+ "C:\\Windows\\system32\\ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0",
+ "50.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Office",
+ "Microsoft Malware Protection"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-19T00:00:00Z",
+ "2018-09-29T00:00:00Z",
+ "2018-10-02T00:00:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1,
+ 0
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.binary.highlights.*.ids",
+ "data_type": "string",
+ "example_values": [
+ "13DED573464BA7F43FE640479B309E09",
+ "9BF50324444C46997C2492D505B47F2D",
+ "5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.highlights.*.name",
+ "data_type": "string",
+ "example_values": [
+ "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST",
+ "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST",
+ "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST"
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "5fb30fe90736c7fc77de637021b1ce7c"
+ ]
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust",
+ "data_type": "numeric",
+ "example_values": [
+ -100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-07T02:37:28Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.cb_version",
+ "data_type": "numeric",
+ "example_values": [
+ 610,
+ 510,
+ 511
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.company_name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.copied_mod_len",
+ "data_type": "numeric",
+ "example_values": [
+ 9683736,
+ 366512,
+ 16896
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_issuer",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Code Signing PCA"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_prog_name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Office",
+ "Microsoft Corp."
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_publisher",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_result",
+ "data_type": "string",
+ "example_values": [
+ "Signed"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_result_code",
+ "data_type": "string",
+ "example_values": [
+ "0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_sign_time",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-14T20:23:00Z",
+ "2015-01-30T19:14:00Z",
+ "2009-07-14T10:17:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_subject",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.endpoint",
+ "data_type": "string",
+ "example_values": [
+ "CB-TEST-02|27",
+ "WIN7-CLIENT1|15",
+ "DC1|19"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.event_partition_id",
+ "data_type": "numeric",
+ "example_values": [
+ 100972684312576,
+ 100955696070656
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.facet_id",
+ "data_type": "numeric",
+ "example_values": [
+ 883737,
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.file_desc",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Office Click-to-Run (SxS)",
+ "Microsoft Network Realtime Inspection Service",
+ "TCP/IP Ping Command"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.file_version",
+ "data_type": "string",
+ "example_values": [
+ "16.0.10827.20181",
+ "4.7.0205.0",
+ "6.1.7600.16385 (win7_rtm.090713-1255)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.group",
+ "data_type": "string",
+ "example_values": [
+ "Default Group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.host_count",
+ "data_type": "numeric",
+ "example_values": [
+ 1,
+ 6
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.internal_name",
+ "data_type": "string",
+ "example_values": [
+ "OfficeClickToRun.exe",
+ "NisSrv.exe",
+ "ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.is_64bit",
+ "data_type": "boolean",
+ "example_values": [
+ false,
+ true
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.is_executable_image",
+ "data_type": "boolean",
+ "example_values": [
+ false,
+ true
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.last_seen",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-28T10:06:02.456Z",
+ "2018-10-28T10:06:42.455Z",
+ "2018-10-26T00:01:41.224Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.legal_copyright",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation. All rights reserved."
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.md5",
+ "data_type": "string",
+ "example_values": [
+ "13DED573464BA7F43FE640479B309E09",
+ "9BF50324444C46997C2492D505B47F2D",
+ "5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.observed_filename",
+ "data_type": "string",
+ "example_values": [
+ "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe",
+ "c:\\program files\\microsoft security client\\nissrv.exe",
+ "c:\\windows\\system32\\ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.orig_mod_len",
+ "data_type": "numeric",
+ "example_values": [
+ 9683736,
+ 366512,
+ 16896
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.original_filename",
+ "data_type": "string",
+ "example_values": [
+ "OfficeClickToRun.exe",
+ "NisSrv.exe",
+ "ping.exe.mui"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.os_type",
+ "data_type": "string",
+ "example_values": [
+ "Windows"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.product_name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Office",
+ "Microsoft Malware Protection"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.product_version",
+ "data_type": "string",
+ "example_values": [
+ "16.0.10827.20181",
+ "4.7.0205.0",
+ "6.1.7600.16385"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.server_added_timestamp",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-19T17:04:47.906Z",
+ "2015-07-01T02:12:21.783Z",
+ "2015-05-15T07:23:54.846Z"
+ ]
+ },
+ {
+ "column_name": "Signed",
+ "column_order": 1,
+ "data_path": "action_result.data.*.binary.results.*.signed",
+ "data_type": "string",
+ "example_values": [
+ "Signed"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.timestamp",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-19T17:04:47.906Z",
+ "2015-07-01T02:12:21.783Z",
+ "2015-05-15T07:23:54.846Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.watchlists.*.value",
+ "data_type": "string",
+ "example_values": [
+ "2015-07-01T02:20:02.062Z",
+ "2015-05-15T07:30:02.843Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid",
+ "data_type": "string",
+ "example_values": [
+ "5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.start",
+ "data_type": "numeric",
+ "example_values": [
+ 0,
+ 5
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.terms",
+ "data_type": "string",
+ "example_values": [
+ "md5:13ded573464ba7f43fe640479b309e09",
+ "md5:9bf50324444c46997c2492d505b47f2d",
+ "md5:5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.total_results",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.all_segments",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.comprehensive_search",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.elapsed",
+ "data_type": "numeric",
+ "example_values": [
+ 0.2200779914855957
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.day_of_week.*.name",
+ "data_type": "string",
+ "example_values": [
+ "0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.day_of_week.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1566
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.group.*.name",
+ "data_type": "string",
+ "example_values": [
+ "default group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.group.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.group.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.group.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 10128
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.host_type.*.name",
+ "data_type": "string",
+ "example_values": [
+ "domain_controller"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.host_type.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.host_type.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.host_type.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 10123
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hostname.*.name",
+ "data_type": "string",
+ "example_values": [
+ "dc2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hostname.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hostname.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "51.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hostname.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 5185
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hour_of_day.*.name",
+ "data_type": "string",
+ "example_values": [
+ "0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hour_of_day.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 411
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.facets.parent_name.*.name",
+ "data_type": "string",
+ "example_values": [
+ "svchost.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.parent_name.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.parent_name.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.parent_name.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9971
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.facets.path_full.*.name",
+ "data_type": "string",
+ "example_values": [
+ "c:\\windows\\syswow64\\wbem\\wmiprvse.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.path_full.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.path_full.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.path_full.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9971
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.process.facets.process_md5.*.name",
+ "data_type": "string",
+ "example_values": [
+ "4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_md5.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_md5.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_md5.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9971
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.facets.process_name.*.name",
+ "data_type": "string",
+ "example_values": [
+ "wmiprvse.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_name.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_name.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_name.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9971
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.start.*.name",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-24T00:00:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.start.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 324
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.username_full.*.name",
+ "data_type": "string",
+ "example_values": [
+ "LOCAL SERVICE"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.username_full.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.username_full.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.4"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.username_full.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9966
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.incomplete_results",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust",
+ "data_type": "numeric",
+ "example_values": [
+ -100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-07T02:37:28Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.childproc_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "contains": [
+ "file path"
+ ],
+ "data_path": "action_result.data.*.process.results.*.cmdline",
+ "data_type": "string",
+ "example_values": [
+ "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.comms_ip",
+ "data_type": "numeric",
+ "example_values": [
+ 168886572
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.crossproc_count",
+ "data_type": "numeric",
+ "example_values": [
+ 2
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.emet_config",
+ "data_type": "string",
+ "example_values": [
+ ""
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.emet_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.filemod_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.filtering_known_dlls",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.group",
+ "data_type": "string",
+ "example_values": [
+ "default group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.host_type",
+ "data_type": "string",
+ "example_values": [
+ "workstation"
+ ]
+ },
+ {
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.hostname",
+ "data_type": "string",
+ "example_values": [
+ "win7-client1"
+ ]
+ },
+ {
+ "contains": [
+ "carbon black process id"
+ ],
+ "data_path": "action_result.data.*.process.results.*.id",
+ "data_type": "string",
+ "example_values": [
+ "0000000f-0000-0688-01d3-27738c9b4243"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.interface_ip",
+ "data_type": "numeric",
+ "example_values": [
+ 168886572
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.last_server_update",
+ "data_type": "string",
+ "example_values": [
+ "2018-03-22T09:21:32.332Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.last_update",
+ "data_type": "string",
+ "example_values": [
+ "2017-09-07T00:52:15.82Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.modload_count",
+ "data_type": "numeric",
+ "example_values": [
+ 43
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.netconn_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.os_type",
+ "data_type": "string",
+ "example_values": [
+ "windows"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.parent_id",
+ "data_type": "string",
+ "example_values": [
+ "0000000f-0000-0258-01d1-ec51b545a19b"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.parent_md5",
+ "data_type": "string",
+ "example_values": [
+ "000000000000000000000000000000"
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.parent_name",
+ "data_type": "string",
+ "example_values": [
+ "svchost.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.parent_pid",
+ "data_type": "numeric",
+ "example_values": [
+ 600
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.parent_unique_id",
+ "data_type": "string",
+ "example_values": [
+ "0000000f-0000-0258-01d1-ec51b545a19b-000000000001"
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.path",
+ "data_type": "string",
+ "example_values": [
+ "c:\\windows\\syswow64\\wbem\\wmiprvse.exe"
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.process.results.*.process_md5",
+ "data_type": "string",
+ "example_values": [
+ "4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "contains": [
+ "process name",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.process_name",
+ "data_type": "string",
+ "example_values": [
+ "wmiprvse.exe"
+ ]
+ },
+ {
+ "contains": [
+ "pid"
+ ],
+ "data_path": "action_result.data.*.process.results.*.process_pid",
+ "data_type": "numeric",
+ "example_values": [
+ 1672
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.processblock_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.regmod_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.segment_id",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "contains": [
+ "carbon black sensor id"
+ ],
+ "data_path": "action_result.data.*.process.results.*.sensor_id",
+ "data_type": "numeric",
+ "example_values": [
+ 15
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.start",
+ "data_type": "string",
+ "example_values": [
+ "2017-09-07T00:52:15.758Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.terminated",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.unique_id",
+ "data_type": "string",
+ "example_values": [
+ "0000000f-0000-0688-01d3-27738c9b4243-000000000001"
+ ]
+ },
+ {
+ "contains": [
+ "user name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.username",
+ "data_type": "string",
+ "example_values": [
+ "SYSTEM"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.start",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.terms",
+ "data_type": "string",
+ "example_values": [
+ "md5:4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.total_results",
+ "data_type": "numeric",
+ "example_values": [
+ 32404
+ ]
+ },
+ {
+ "data_path": "action_result.summary.device_count",
+ "data_type": "numeric",
+ "example_values": [
+ 32404,
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Displaying 10 'process' results of total 32404",
+ "Displaying 1 'binary' results of total 1",
+ "Displaying 0 'binary' results of total 1"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "product_name": "",
+ "product_vendor": "",
+ "type": "endpoint"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "hunt file 2"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#FFFFFF"
+ },
+ "text.icon": {
+ "fill": "#FFFFFF"
+ }
+ },
+ "block_code": "def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_2' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_2' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=hunt_file_2_callback, name=\"hunt_file_2\")\n\n return",
+ "callback_code": "def hunt_file_2_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('hunt_file_2_callback() called')\n \n disable_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n logoff_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n shutdown_system_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n block_hash_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n return",
+ "callback_start": 226,
+ "callsback": true,
+ "color": "#654796",
+ "connected_to_start": true,
+ "connection_name": "file reputation",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": "0",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 236,
+ "line_start": 201,
+ "message": "Configuring now",
+ "name": "hunt file",
+ "notes": "",
+ "number": 2,
+ "order": 8,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 600,
+ "y": 340
+ },
+ "previous_block_type": "",
+ "previous_function": "",
+ "previous_name": "hunt_file_2",
+ "required_params": {
+ "hash": true
+ },
+ "reviewer": "",
+ "showNumber": true,
+ "show_number": true,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 2944
+ },
+ {
+ "action": "get file",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash"
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "",
+ "app_version": "",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "file_source": "",
+ "get_count": "",
+ "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash",
+ "offset": "",
+ "ph_0": "",
+ "sensor_id": ""
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "carbonblack",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success"
+ ]
+ },
+ {
+ "contains": [
+ "file path"
+ ],
+ "data_path": "action_result.parameter.file_source",
+ "data_type": "string",
+ "example_values": [
+ "C:\\\\Windows\\\\CarbonBlack\\\\Sensor.LOG"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.get_count",
+ "data_type": "numeric",
+ "example_values": [
+ 1024
+ ]
+ },
+ {
+ "contains": [
+ "md5",
+ "hash"
+ ],
+ "data_path": "action_result.parameter.hash",
+ "data_type": "string",
+ "example_values": [
+ "75E683BC8284D99F998500162BE4CFE2",
+ "5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.offset",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "contains": [
+ "carbon black sensor id"
+ ],
+ "data_path": "action_result.parameter.sensor_id",
+ "data_type": "numeric",
+ "example_values": [
+ 27
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.file_details.alliance_data_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "5fb30fe90736c7fc77de637021b1ce7c"
+ ]
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.data.*.file_details.alliance_link_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.alliance_score_srstrust",
+ "data_type": "numeric",
+ "example_values": [
+ -100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.alliance_updated_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-07T02:37:28Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.cb_version",
+ "data_type": "numeric",
+ "example_values": [
+ 610,
+ 511
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.company_name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.copied_mod_len",
+ "data_type": "numeric",
+ "example_values": [
+ 489984,
+ 16896
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.digsig_publisher",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.digsig_result",
+ "data_type": "string",
+ "example_values": [
+ "Signed"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.digsig_result_code",
+ "data_type": "string",
+ "example_values": [
+ "0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.digsig_sign_time",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-12T10:14:00Z",
+ "2009-07-14T10:17:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.endpoint",
+ "data_type": "string",
+ "example_values": [
+ "WIN10-TEST-EP|28",
+ "DC1|19"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.event_partition_id",
+ "data_type": "numeric",
+ "example_values": [
+ 99742385111040,
+ 100955696070656
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.facet_id",
+ "data_type": "numeric",
+ "example_values": [
+ 241095,
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.file_desc",
+ "data_type": "string",
+ "example_values": [
+ "WMI Provider Host",
+ "TCP/IP Ping Command"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.file_version",
+ "data_type": "string",
+ "example_values": [
+ "10.0.16299.248 (WinBuild.160101.0800)",
+ "6.1.7600.16385 (win7_rtm.090713-1255)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.group",
+ "data_type": "string",
+ "example_values": [
+ "Default Group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.host_count",
+ "data_type": "numeric",
+ "example_values": [
+ 2,
+ 6
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.icon",
+ "data_type": "string",
+ "example_values": [
+ "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAAAXNSR0IArs4c6QAAAARnQU1BAACx\njwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAzoSURBVGhD1ZhXcFzlFccNPJBg8pIJY554JOGB\nzCQPhMwkDN3JJA6BkECSwYCFe5MtyepdWvW60kpa9dVKK61WWvXed9Ulq3fLEjZ2jCxjGxtcsPnn\nnKO98qp47GGIRM7M8S2r3fv/ne+U73oL/s9t0wASExPF8/JybXfub/n5+cu+2jYcwGDQy5GFT05O\nijNIUFCQ3F/PjEYjLFbr5gOw+OioCNsVRDQDDA8PIzs7+74QDDA5OYGUlBTbnXu2YQDzc58iMyMN\nJ/v7lyFYMPvs7CyuXr0KlWrperUxwJkzn6772YYB5BvyMDo6ugKAjUUNDg4KAIMwREKC2vbpkjHA\npUuX4OzsbLtzzzYMoKDAgPPnz+Py5cvQapOXISIjwmGxtAmAAuHu7iafKcYAvb292L17t+3OPdtw\ngIWFBQxRxBUIq9WyLP7ixYtYXFxERMS9FWIzmUw/DACO7vz8vAiPCA9DS3OTiFacxd+5c+eHCxAa\nGirCLW2tuHLl8grxvDIsfmZmZk2xbirA8PC4RDw8LFSE24tW/ObNm7h+/bqIt1K/D/D3t317yTYF\nQBHOvlr4lStXJNos7MaNGyJcEc+rtLqINwXA08MNNTU16wrv7OzEgQMHsGPHDhHNXllZKe7p4bFG\n6KalEEPwlGXxinAnJycRvtSBrEhKSloWHxgYSPkfYPv2PdvUGmChDHH69Oll4d3d3SJKWYXCwkLE\nxsauK55tUwHYWLRWq10jnO/zBk2lUt1XPNumA7A5OjoKhCKcU+dhxLP9zwG2bNmCRx55RI6PPvqo\nOJ+z25sCoezt+Vyj0dg+vb99JwD/qAQExycjOC4ZIWototN0SMjKQ7LeiKjUbMRn5cK8/Q1sfeyx\nJYAntmLbM8/gp9u24RfPPYdtTz+Nx+gzBYbtHad8vPaxdoXzvQfZQwOw6KDYJBEckZyBdGMJylu7\nYBmeQGP/CMrbupBf3YjMonKosw1IzMnHj378Y7z02pt470MH7Nx7CI8//ji2bt2KZwjml88/j58/\n+yyefPJJWaEdR/QIyj8pHmhYOh5LbLE9/f72UABRKVkIS0xDqsGM0uYOtI1Mo2N8FtaxU2gbnUbr\n0CRahiZQ1zuIuEw9zi0skrCf4Pevvg5dSRUyiysQk54DVXwKfCPi4BkSBbegcDgcOoafPfUUtj7x\nBN4+bhDRTbOXxRWA9dLN3h4IkKQzQEMRbSFxI/Pn0TP9KdonTsMyegqtI1MkfBLNg+M2HxMAh8NO\n+NULLyKt0CxQJS3tKG6ywFjXgtyKWqSbyqDRFyI6VUdA8bIq77oYRXiWZQ4uKVa8+lHK97MC5uoG\n9A2P4Zs7d3H7m7u4fuMmLl65hrnPFzE6fw49UwQzMonGgVHU9w2jtmcQZW2dKKhpQmF9C8otXTA3\nW2BqaKF7jcitrIOurFpWJa2wDNkl1fj1b36Lf3oUo2HmC0SYh8UVAJ/wWPFQjVZErbYHAmSbqzBw\n6iwmP1vA/MIXWLh6DV9+dQNf37pNfkuAFuneGUqb8fmz6J2cgWVoDFXtPQJQ1NRG4lsp+s0wMACt\nQHZpFTKoVrQFZqQWlmL7W3/HTr9SWM9eQ5hpSFwBCIxOQmCMBgHRict1GKZJI6BUeIerHwKgtIby\nnaI8Nkt+Cu2U+91Tcxg8fRZTZy/g7MVLWPzyGq59TVA3b8nx4uWrmDt/AYPTs2jpG6Bib4fRTrxE\n31SKlPxiqHXU76kxfBxUjp4LXyG44KS4AuAXmQjfMDV8wuIREJkA79BYHDzhiz3HPXDI3f/BADll\ntZL3HRNzsJJ4hmilIm4enoJ1YpaKeEpSyEreO3EKI7PzmDl7HmcuLODcxUUp6Llz/8Hw9ClY+gZR\nQemURymUZjRLtwrTpEOVkAqHkCoMLt6Ef24v/PU9dgAc9WS4+Idhn5MXdh0+AYejblL0XDNFveeg\nbZjBLlUl/uVpxu/eTxDxbAKgzs5HfKYBGaYKKkQuxpXOLZS9gbymewDVnX3itV19aOg5idb+IXRS\nSvWNTaJ/fAo9I+Noo1WpplUprKpHJqVQEhX0J6HVGLlyG97ZXeIKgBdFfL+LNz465IxPHN2wx8kT\n++iaAez9lQ+TxdcAcOG1UHfhPq+jgovNyBV3OeYozucM0Do8KR2HxVdYu1Ha2kmA3Hko92k+5FXW\nw0AFXEBNwVTbRN4IE50b6X4etVpegbGr38AjvUNcARDhx9yx19mLhPvggKsfDrr546hnkAh3Trbg\nffciOX/hnSgRrpgA6DmFpubRNX0aXVOz4iy6yGyCnl4FuQDjMvKoyJJowGXRADMiy1wpQ40BuJAN\nVQ3UeWrofgVSaQCq6W8Sc02Iy8qX78am67EruAJT1+/AVWsVVwD2UtrsP+FDov1w2D0AR72C4ewX\nAiefYBGd3jwLx4QWgbCPPpsAZBVVossu/9upoBmA7dT8nAC0j01RYVPBUqpUWLugL6+VtPMMiZUu\nEp6USdsL2moYimi7UQB1Rs6yhySkIZj8o8ByTH91F05JbeIKwCGK9mGPQDh6q6QOjnsHyW6gpNm6\nBuClf2tWDD05yzCVy9RtG52RCWyhIwNkZWoRGkRR2e2ABur/PAPqe4fQeHKYUm6UpvQkurkL0XlZ\nW4dM5CitbkX6uQVHIig+VZzb6OyNb9cAOHqx8HA4+6rgoYqilW2Q2cHfWQ3A37Gf3PJvWkEp7Xem\naMrSxB2YQNPAuIiobKwXZ4Cqjl7xktYOFDdaYapvRT4NsjxKHU6hUrpf09UvMJxq9ukXQh3I0SsI\nH/iWYP424JbaLq4AuAaGS7ok55noty006Q0IScygzpWxBuCNT9KXAcQZQGsoRguJru/nSTtCk3aI\n+nglkpPU4i5+4Sim/ZG5pYMGVhuMtZTzlP/6ijrq+dU0sCqgpbxPyitCAuU+A7Ap6VdHnaqThh+3\nwDN3sKILHVU3EyClC3WslIISRKToEKnNkaNzYMoagD/sy8LLb/usBOAWV987TN1lAJXt/ZTjfSiz\n9CylAonPJaFFFPUC2ucYqprouh46Gn6ZVMhptOdJyTdDk0vidQVUtAYBsE8/3gt5RySIgPPfAr45\nPeIMcDiuUYqfRUenU/ej6LPHZBjwt31qAeChxwDsfP3KexErAdTUKVh4aWs3RbmLOksHCW6HiUTz\nkhrrWilVOOL1MrV5ddIKeZtwL+rcbWJIQGRqjgDYpx8XuhdN2X+4FmKBAEILB8UZYH9UPUU7WwSr\ndYV2bsRfjuol+nxk8fbXKwBiqMWVNHdSLrPYNhTUtlKKNNtEc3usRRYVVTp1q1RjGXWaEom4OqdQ\nhHPkWHg4CQnVZAqAkn4fH3SBe0gc3FWxshu9RABxFePiDLAnvEYinpBjorZbJL+r+J8O5ohgPjKA\n/fUKgEh6cCEJ11c0Iqeco0yCzTWU21W0ESun3Cwl0WZ5QAKJjs8ukIcqwsNYOLVRVUI6AuO18I+l\n1KB+zuK9w+LgpoqBa1CUvH19TgAp9dPiDMDDLVFvopUsRhLVIj8nyeac70l103JkAPtrFs8m/3Kf\nDiMBUWm5snT8Y/xDktci2JYitMzRaXoSrado6+g7WQjRZEiPD4xLFeF+FH3viER40S7SPZTEBy+J\ndwmIxFuOufjsLqBrnxNnAJ4NGkpD5ZlcT+x8zh0ntmxUjgxgf62YAPhGqmXy8dbVJ0JND4+HD+0Q\nA+K0BJeBsGQdIqjIwpI50iSaWlwwRTtIbRMeQ29hJNwnSkPfTYAn5bs75b1rcDRO2MQ7U59fD4Bb\n60qAEhtAsXyuMg7IkQHsrxVbWodVplLzPjwenrTJcldFUxTJKQ04qr6RGhKcLHB+inC6x13Gkz73\n4KhTvov4QBYfASc/mq6+ofJOfPoW1VzZmDgL4ZccDW05lgCWnBtDMkHw1OV2y0cGsL9WbF2A1ca7\nxRMB4TTqg0WQM527kLNIN4o0pwoL52J1JVCJeiBHfUn8MZ9QOPqopPg48vxewM4A3JkSKU01VAdL\nxWui7lYqw4z3PfzqyUcGsL9W7KEAVpvDERcqUn8cdPWV/QtH97hfqIjlVHFil6iz+BD5myO0Qfvj\n/mzEli9Fn4/sXNgJVHfcivkdWkuR9wyNxl/f34kX340R4esdFftOAKvtw/3H6AXEVV5GeB9/hLbB\nvKNkd5RjEN0LxPa9mSJaWQE+57rg95FEEh+VqsO+4+54efsO+V3eOrPg9Y6KfS8Aq83h6Ans3OdI\nK3WCoDxlm8yvhm/uyRDhh+j6AG2f+fzPh/QCwO/CB1w8bb+wZJsGsNoY5oO9R/Hm7iWA3fTycoDe\nefmc02q/syd27j1i++t7tj+yTsTazwG+5u2HYhsCoBgD8H9msXB2Pue0up+98V4IXt9FO1kSrzhf\n833FNhSAH8ydx97txaxnCoTiq/9+QwG+fwP+CyGRvQpx7eyKAAAAAElFTkSuQmCC\n",
+ "iVBORw0KGgoAAAANSUhEUgAAACUAAAAlCAYAAADFniADAAAAAXNSR0IArs4c6QAAAARnQU1BAACx\njwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlz\nAAAewgAAHsIBbtB1PgAAAjJJREFUWEftWEFrGkEYVQIqGtFTjrmF/IEYWLzEgOQQiBCIEPaiEATb\n9CA0eKiFlgqlBw9CI9Yl1kjjIhYPNSgpSkuN4kXPXgr+k9f5Ju7SYoNDaY2UGXh833z7vuHxdnbZ\nHYtFDkEH0un0zbIgEoncMNmXFiYIlUoFtVoNiUSCI5VK8Ui1YrHI83g8jmw2a9aoTjA4lFMfxXK5\n/EudOAaPYjKZRKFQ4DUDmqaBiQIT9Z2L6nQ6SKe72N1N4uAgg729FyaoRtjffw1V/cDrNKd4ePgW\nx8fvcXT0zqzRNZqfnn7jHOqLRutm38nJNedSjTgGzs6qs6K2t78wlc8ZOtNIOeHNNGo/5VR7yvCK\n4Wp6nXKjh9a469vYyEJRPmJt7RG83ifw+z9hc/MZVlYeY2vrGjs7X7G+fgGf7+V9omgxUZCI+dzz\n81v0+33EYjEEg0Get1otuFwulEolPldVlYny/Q1R8wWR6EymjXa7zW5XFIFAgOf1eh1OpxP5fJ7P\nw+HwYkWtrvrZbfPC4XDAZrPx3OPxwGq1wu1287ndbv+9KF2/hab9C1yxdbW5oCd75unTdX1uo8ji\nf8JpNBr81TAjKpfLoVqtotvtLhy9Xu9+UcPhEA8xJpOJFCVkvHRKyCZGkk5Jp0QdEOXJPSWdEnVA\nlCf3lHRK1AFRntxT/6dTzWYTg8EA4/F44RiNRrPf6MZJCZ2WPBTob8r8xQqFQlgWKIpydxTExucl\nw6Xged9iaT8A6ipWINQO9M4AAAAASUVORK5CYII=\n"
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.file_details.internal_name",
+ "data_type": "string",
+ "example_values": [
+ "Wmiprvse.exe",
+ "ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.is_64bit",
+ "data_type": "boolean",
+ "example_values": [
+ false,
+ true
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.is_executable_image",
+ "data_type": "boolean",
+ "example_values": [
+ false,
+ true
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.last_seen",
+ "data_type": "string",
+ "example_values": [
+ "2018-03-25T06:49:27.776Z",
+ "2018-10-26T00:01:41.224Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.legal_copyright",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation. All rights reserved."
+ ]
+ },
+ {
+ "column_name": "MD5",
+ "column_order": 0,
+ "contains": [
+ "md5",
+ "hash"
+ ],
+ "data_path": "action_result.data.*.file_details.md5",
+ "data_type": "string",
+ "example_values": [
+ "75E683BC8284D99F998500162BE4CFE2",
+ "5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.file_details.observed_filename",
+ "data_type": "string",
+ "example_values": [
+ "c:\\windows\\system32\\wbem\\wmiprvse.exe",
+ "c:\\windows\\system32\\ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.orig_mod_len",
+ "data_type": "numeric",
+ "example_values": [
+ 489984,
+ 16896
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.file_details.original_filename",
+ "data_type": "string",
+ "example_values": [
+ "Wmiprvse.exe",
+ "ping.exe.mui"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.os_type",
+ "data_type": "string",
+ "example_values": [
+ "Windows"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.product_name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Windows Operating System"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.product_version",
+ "data_type": "string",
+ "example_values": [
+ "10.0.16299.248",
+ "6.1.7600.16385"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.server_added_timestamp",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-15T01:48:13.517Z",
+ "2015-05-15T07:23:54.846Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.signed",
+ "data_type": "string",
+ "example_values": [
+ "Signed"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.timestamp",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-15T01:48:13.517Z",
+ "2015-05-15T07:23:54.846Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.watchlists.*.value",
+ "data_type": "string",
+ "example_values": [
+ "2015-05-15T07:30:02.843Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.watchlists.*.wid",
+ "data_type": "string",
+ "example_values": [
+ "5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_id",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "contains": [
+ "file name",
+ "file path"
+ ],
+ "data_path": "action_result.data.*.name",
+ "data_type": "string",
+ "example_values": [
+ "wmiprvse.exe",
+ "C:\\Windows\\CarbonBlack\\Sensor.LOG",
+ "ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.session_id",
+ "data_type": "numeric",
+ "example_values": [
+ 101
+ ]
+ },
+ {
+ "column_name": "Vault ID",
+ "column_order": 1,
+ "contains": [
+ "vault id",
+ "sha1"
+ ],
+ "data_path": "action_result.data.*.vault_id",
+ "data_type": "string",
+ "example_values": [
+ "08f57fd06bbd8063d5b828521654225952a8155e",
+ "41c4e1e9abe08b218f5ea60d8ae41a5f523e7534"
+ ]
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.summary.cb_url",
+ "data_type": "string",
+ "example_values": [
+ "https://192.168.0.245/#/binary/75E683BC8284D99F998500162BE4CFE2",
+ "https://10.1.16.170/#/binary/5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "action_result.summary.file_type",
+ "data_type": "string",
+ "example_values": [
+ "pe file"
+ ]
+ },
+ {
+ "contains": [
+ "file name",
+ "file path"
+ ],
+ "data_path": "action_result.summary.name",
+ "data_type": "string",
+ "example_values": [
+ "wmiprvse.exe",
+ "C:\\Windows\\CarbonBlack\\Sensor.LOG",
+ "ping.exe"
+ ]
+ },
+ {
+ "contains": [
+ "vault id",
+ "sha1"
+ ],
+ "data_path": "action_result.summary.vault_id",
+ "data_type": "string",
+ "example_values": [
+ "08f57fd06bbd8063d5b828521654225952a8155e",
+ "41c4e1e9abe08b218f5ea60d8ae41a5f523e7534"
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "File type: pe file\nVault id: 08f57fd06bbd8063d5b828521654225952a8155e\nName: wmiprvse.exe\nCb url: https://192.168.0.245/#/binary/75E683BC8284D99F998500162BE4CFE2",
+ "Vault id: cefbc5c62d7e1f90d250ddcd35bc388a7b01f4d4, Name: C:\\Windows\\CarbonBlack\\Sensor.LOG",
+ "File type: pe file, Vault id: 41c4e1e9abe08b218f5ea60d8ae41a5f523e7534, Name: ping.exe, Cb url: https://10.1.16.170/#/binary/5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "product_name": "",
+ "product_vendor": "",
+ "type": "endpoint"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "get file 3"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#FFFFFF"
+ },
+ "text.icon": {
+ "fill": "#FFFFFF"
+ }
+ },
+ "block_code": "def get_file_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('get_file_3() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'get_file_3' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'get_file_3' call\n for filtered_results_item_1 in filtered_results_data_1:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'ph_0': \"\",\n 'offset': \"\",\n 'get_count': \"\",\n 'sensor_id': \"\",\n 'file_source': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"get file\", parameters=parameters, assets=['carbonblack'], name=\"get_file_3\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#654796",
+ "connected_to_start": true,
+ "connection_name": "file reputation",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": "0",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "e6a1a311-5337-4d44-b8d3-58d8a6cf8be1",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 263,
+ "line_start": 236,
+ "message": "Configuring now",
+ "name": "get file",
+ "notes": "",
+ "number": 3,
+ "order": 9,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 600,
+ "y": 900
+ },
+ "previous_block_type": "",
+ "previous_function": "",
+ "previous_name": "get_file_3",
+ "required_params": {},
+ "reviewer": "",
+ "showNumber": true,
+ "show_number": true,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 2945
+ },
+ {
+ "action": "get file",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash"
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "",
+ "app_version": "",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "file_source": "",
+ "get_count": "",
+ "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash",
+ "offset": "",
+ "ph_0": "",
+ "sensor_id": ""
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "carbonblack",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success"
+ ]
+ },
+ {
+ "contains": [
+ "file path"
+ ],
+ "data_path": "action_result.parameter.file_source",
+ "data_type": "string",
+ "example_values": [
+ "C:\\\\Windows\\\\CarbonBlack\\\\Sensor.LOG"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.get_count",
+ "data_type": "numeric",
+ "example_values": [
+ 1024
+ ]
+ },
+ {
+ "contains": [
+ "md5",
+ "hash"
+ ],
+ "data_path": "action_result.parameter.hash",
+ "data_type": "string",
+ "example_values": [
+ "75E683BC8284D99F998500162BE4CFE2",
+ "5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.offset",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "contains": [
+ "carbon black sensor id"
+ ],
+ "data_path": "action_result.parameter.sensor_id",
+ "data_type": "numeric",
+ "example_values": [
+ 27
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.file_details.alliance_data_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "5fb30fe90736c7fc77de637021b1ce7c"
+ ]
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.data.*.file_details.alliance_link_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.alliance_score_srstrust",
+ "data_type": "numeric",
+ "example_values": [
+ -100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.alliance_updated_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-07T02:37:28Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.cb_version",
+ "data_type": "numeric",
+ "example_values": [
+ 610,
+ 511
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.company_name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.copied_mod_len",
+ "data_type": "numeric",
+ "example_values": [
+ 489984,
+ 16896
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.digsig_publisher",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.digsig_result",
+ "data_type": "string",
+ "example_values": [
+ "Signed"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.digsig_result_code",
+ "data_type": "string",
+ "example_values": [
+ "0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.digsig_sign_time",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-12T10:14:00Z",
+ "2009-07-14T10:17:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.endpoint",
+ "data_type": "string",
+ "example_values": [
+ "WIN10-TEST-EP|28",
+ "DC1|19"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.event_partition_id",
+ "data_type": "numeric",
+ "example_values": [
+ 99742385111040,
+ 100955696070656
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.facet_id",
+ "data_type": "numeric",
+ "example_values": [
+ 241095,
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.file_desc",
+ "data_type": "string",
+ "example_values": [
+ "WMI Provider Host",
+ "TCP/IP Ping Command"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.file_version",
+ "data_type": "string",
+ "example_values": [
+ "10.0.16299.248 (WinBuild.160101.0800)",
+ "6.1.7600.16385 (win7_rtm.090713-1255)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.group",
+ "data_type": "string",
+ "example_values": [
+ "Default Group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.host_count",
+ "data_type": "numeric",
+ "example_values": [
+ 2,
+ 6
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.icon",
+ "data_type": "string",
+ "example_values": [
+ "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAAAXNSR0IArs4c6QAAAARnQU1BAACx\njwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAzoSURBVGhD1ZhXcFzlFccNPJBg8pIJY554JOGB\nzCQPhMwkDN3JJA6BkECSwYCFe5MtyepdWvW60kpa9dVKK61WWvXed9Ulq3fLEjZ2jCxjGxtcsPnn\nnKO98qp47GGIRM7M8S2r3fv/ne+U73oL/s9t0wASExPF8/JybXfub/n5+cu+2jYcwGDQy5GFT05O\nijNIUFCQ3F/PjEYjLFbr5gOw+OioCNsVRDQDDA8PIzs7+74QDDA5OYGUlBTbnXu2YQDzc58iMyMN\nJ/v7lyFYMPvs7CyuXr0KlWrperUxwJkzn6772YYB5BvyMDo6ugKAjUUNDg4KAIMwREKC2vbpkjHA\npUuX4OzsbLtzzzYMoKDAgPPnz+Py5cvQapOXISIjwmGxtAmAAuHu7iafKcYAvb292L17t+3OPdtw\ngIWFBQxRxBUIq9WyLP7ixYtYXFxERMS9FWIzmUw/DACO7vz8vAiPCA9DS3OTiFacxd+5c+eHCxAa\nGirCLW2tuHLl8grxvDIsfmZmZk2xbirA8PC4RDw8LFSE24tW/ObNm7h+/bqIt1K/D/D3t317yTYF\nQBHOvlr4lStXJNos7MaNGyJcEc+rtLqINwXA08MNNTU16wrv7OzEgQMHsGPHDhHNXllZKe7p4bFG\n6KalEEPwlGXxinAnJycRvtSBrEhKSloWHxgYSPkfYPv2PdvUGmChDHH69Oll4d3d3SJKWYXCwkLE\nxsauK55tUwHYWLRWq10jnO/zBk2lUt1XPNumA7A5OjoKhCKcU+dhxLP9zwG2bNmCRx55RI6PPvqo\nOJ+z25sCoezt+Vyj0dg+vb99JwD/qAQExycjOC4ZIWototN0SMjKQ7LeiKjUbMRn5cK8/Q1sfeyx\nJYAntmLbM8/gp9u24RfPPYdtTz+Nx+gzBYbtHad8vPaxdoXzvQfZQwOw6KDYJBEckZyBdGMJylu7\nYBmeQGP/CMrbupBf3YjMonKosw1IzMnHj378Y7z02pt470MH7Nx7CI8//ji2bt2KZwjml88/j58/\n+yyefPJJWaEdR/QIyj8pHmhYOh5LbLE9/f72UABRKVkIS0xDqsGM0uYOtI1Mo2N8FtaxU2gbnUbr\n0CRahiZQ1zuIuEw9zi0skrCf4Pevvg5dSRUyiysQk54DVXwKfCPi4BkSBbegcDgcOoafPfUUtj7x\nBN4+bhDRTbOXxRWA9dLN3h4IkKQzQEMRbSFxI/Pn0TP9KdonTsMyegqtI1MkfBLNg+M2HxMAh8NO\n+NULLyKt0CxQJS3tKG6ywFjXgtyKWqSbyqDRFyI6VUdA8bIq77oYRXiWZQ4uKVa8+lHK97MC5uoG\n9A2P4Zs7d3H7m7u4fuMmLl65hrnPFzE6fw49UwQzMonGgVHU9w2jtmcQZW2dKKhpQmF9C8otXTA3\nW2BqaKF7jcitrIOurFpWJa2wDNkl1fj1b36Lf3oUo2HmC0SYh8UVAJ/wWPFQjVZErbYHAmSbqzBw\n6iwmP1vA/MIXWLh6DV9+dQNf37pNfkuAFuneGUqb8fmz6J2cgWVoDFXtPQJQ1NRG4lsp+s0wMACt\nQHZpFTKoVrQFZqQWlmL7W3/HTr9SWM9eQ5hpSFwBCIxOQmCMBgHRict1GKZJI6BUeIerHwKgtIby\nnaI8Nkt+Cu2U+91Tcxg8fRZTZy/g7MVLWPzyGq59TVA3b8nx4uWrmDt/AYPTs2jpG6Bib4fRTrxE\n31SKlPxiqHXU76kxfBxUjp4LXyG44KS4AuAXmQjfMDV8wuIREJkA79BYHDzhiz3HPXDI3f/BADll\ntZL3HRNzsJJ4hmilIm4enoJ1YpaKeEpSyEreO3EKI7PzmDl7HmcuLODcxUUp6Llz/8Hw9ClY+gZR\nQemURymUZjRLtwrTpEOVkAqHkCoMLt6Ef24v/PU9dgAc9WS4+Idhn5MXdh0+AYejblL0XDNFveeg\nbZjBLlUl/uVpxu/eTxDxbAKgzs5HfKYBGaYKKkQuxpXOLZS9gbymewDVnX3itV19aOg5idb+IXRS\nSvWNTaJ/fAo9I+Noo1WpplUprKpHJqVQEhX0J6HVGLlyG97ZXeIKgBdFfL+LNz465IxPHN2wx8kT\n++iaAez9lQ+TxdcAcOG1UHfhPq+jgovNyBV3OeYozucM0Do8KR2HxVdYu1Ha2kmA3Hko92k+5FXW\nw0AFXEBNwVTbRN4IE50b6X4etVpegbGr38AjvUNcARDhx9yx19mLhPvggKsfDrr546hnkAh3Trbg\nffciOX/hnSgRrpgA6DmFpubRNX0aXVOz4iy6yGyCnl4FuQDjMvKoyJJowGXRADMiy1wpQ40BuJAN\nVQ3UeWrofgVSaQCq6W8Sc02Iy8qX78am67EruAJT1+/AVWsVVwD2UtrsP+FDov1w2D0AR72C4ewX\nAiefYBGd3jwLx4QWgbCPPpsAZBVVossu/9upoBmA7dT8nAC0j01RYVPBUqpUWLugL6+VtPMMiZUu\nEp6USdsL2moYimi7UQB1Rs6yhySkIZj8o8ByTH91F05JbeIKwCGK9mGPQDh6q6QOjnsHyW6gpNm6\nBuClf2tWDD05yzCVy9RtG52RCWyhIwNkZWoRGkRR2e2ABur/PAPqe4fQeHKYUm6UpvQkurkL0XlZ\nW4dM5CitbkX6uQVHIig+VZzb6OyNb9cAOHqx8HA4+6rgoYqilW2Q2cHfWQ3A37Gf3PJvWkEp7Xem\naMrSxB2YQNPAuIiobKwXZ4Cqjl7xktYOFDdaYapvRT4NsjxKHU6hUrpf09UvMJxq9ukXQh3I0SsI\nH/iWYP424JbaLq4AuAaGS7ok55noty006Q0IScygzpWxBuCNT9KXAcQZQGsoRguJru/nSTtCk3aI\n+nglkpPU4i5+4Sim/ZG5pYMGVhuMtZTzlP/6ijrq+dU0sCqgpbxPyitCAuU+A7Ap6VdHnaqThh+3\nwDN3sKILHVU3EyClC3WslIISRKToEKnNkaNzYMoagD/sy8LLb/usBOAWV987TN1lAJXt/ZTjfSiz\n9CylAonPJaFFFPUC2ucYqprouh46Gn6ZVMhptOdJyTdDk0vidQVUtAYBsE8/3gt5RySIgPPfAr45\nPeIMcDiuUYqfRUenU/ej6LPHZBjwt31qAeChxwDsfP3KexErAdTUKVh4aWs3RbmLOksHCW6HiUTz\nkhrrWilVOOL1MrV5ddIKeZtwL+rcbWJIQGRqjgDYpx8XuhdN2X+4FmKBAEILB8UZYH9UPUU7WwSr\ndYV2bsRfjuol+nxk8fbXKwBiqMWVNHdSLrPYNhTUtlKKNNtEc3usRRYVVTp1q1RjGXWaEom4OqdQ\nhHPkWHg4CQnVZAqAkn4fH3SBe0gc3FWxshu9RABxFePiDLAnvEYinpBjorZbJL+r+J8O5ohgPjKA\n/fUKgEh6cCEJ11c0Iqeco0yCzTWU21W0ESun3Cwl0WZ5QAKJjs8ukIcqwsNYOLVRVUI6AuO18I+l\n1KB+zuK9w+LgpoqBa1CUvH19TgAp9dPiDMDDLVFvopUsRhLVIj8nyeac70l103JkAPtrFs8m/3Kf\nDiMBUWm5snT8Y/xDktci2JYitMzRaXoSrado6+g7WQjRZEiPD4xLFeF+FH3viER40S7SPZTEBy+J\ndwmIxFuOufjsLqBrnxNnAJ4NGkpD5ZlcT+x8zh0ntmxUjgxgf62YAPhGqmXy8dbVJ0JND4+HD+0Q\nA+K0BJeBsGQdIqjIwpI50iSaWlwwRTtIbRMeQ29hJNwnSkPfTYAn5bs75b1rcDRO2MQ7U59fD4Bb\n60qAEhtAsXyuMg7IkQHsrxVbWodVplLzPjwenrTJcldFUxTJKQ04qr6RGhKcLHB+inC6x13Gkz73\n4KhTvov4QBYfASc/mq6+ofJOfPoW1VzZmDgL4ZccDW05lgCWnBtDMkHw1OV2y0cGsL9WbF2A1ca7\nxRMB4TTqg0WQM527kLNIN4o0pwoL52J1JVCJeiBHfUn8MZ9QOPqopPg48vxewM4A3JkSKU01VAdL\nxWui7lYqw4z3PfzqyUcGsL9W7KEAVpvDERcqUn8cdPWV/QtH97hfqIjlVHFil6iz+BD5myO0Qfvj\n/mzEli9Fn4/sXNgJVHfcivkdWkuR9wyNxl/f34kX340R4esdFftOAKvtw/3H6AXEVV5GeB9/hLbB\nvKNkd5RjEN0LxPa9mSJaWQE+57rg95FEEh+VqsO+4+54efsO+V3eOrPg9Y6KfS8Aq83h6Ans3OdI\nK3WCoDxlm8yvhm/uyRDhh+j6AG2f+fzPh/QCwO/CB1w8bb+wZJsGsNoY5oO9R/Hm7iWA3fTycoDe\nefmc02q/syd27j1i++t7tj+yTsTazwG+5u2HYhsCoBgD8H9msXB2Pue0up+98V4IXt9FO1kSrzhf\n833FNhSAH8ydx97txaxnCoTiq/9+QwG+fwP+CyGRvQpx7eyKAAAAAElFTkSuQmCC\n",
+ "iVBORw0KGgoAAAANSUhEUgAAACUAAAAlCAYAAADFniADAAAAAXNSR0IArs4c6QAAAARnQU1BAACx\njwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlz\nAAAewgAAHsIBbtB1PgAAAjJJREFUWEftWEFrGkEYVQIqGtFTjrmF/IEYWLzEgOQQiBCIEPaiEATb\n9CA0eKiFlgqlBw9CI9Yl1kjjIhYPNSgpSkuN4kXPXgr+k9f5Ju7SYoNDaY2UGXh833z7vuHxdnbZ\nHYtFDkEH0un0zbIgEoncMNmXFiYIlUoFtVoNiUSCI5VK8Ui1YrHI83g8jmw2a9aoTjA4lFMfxXK5\n/EudOAaPYjKZRKFQ4DUDmqaBiQIT9Z2L6nQ6SKe72N1N4uAgg729FyaoRtjffw1V/cDrNKd4ePgW\nx8fvcXT0zqzRNZqfnn7jHOqLRutm38nJNedSjTgGzs6qs6K2t78wlc8ZOtNIOeHNNGo/5VR7yvCK\n4Wp6nXKjh9a469vYyEJRPmJt7RG83ifw+z9hc/MZVlYeY2vrGjs7X7G+fgGf7+V9omgxUZCI+dzz\n81v0+33EYjEEg0Get1otuFwulEolPldVlYny/Q1R8wWR6EymjXa7zW5XFIFAgOf1eh1OpxP5fJ7P\nw+HwYkWtrvrZbfPC4XDAZrPx3OPxwGq1wu1287ndbv+9KF2/hab9C1yxdbW5oCd75unTdX1uo8ji\nf8JpNBr81TAjKpfLoVqtotvtLhy9Xu9+UcPhEA8xJpOJFCVkvHRKyCZGkk5Jp0QdEOXJPSWdEnVA\nlCf3lHRK1AFRntxT/6dTzWYTg8EA4/F44RiNRrPf6MZJCZ2WPBTob8r8xQqFQlgWKIpydxTExucl\nw6Xged9iaT8A6ipWINQO9M4AAAAASUVORK5CYII=\n"
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.file_details.internal_name",
+ "data_type": "string",
+ "example_values": [
+ "Wmiprvse.exe",
+ "ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.is_64bit",
+ "data_type": "boolean",
+ "example_values": [
+ false,
+ true
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.is_executable_image",
+ "data_type": "boolean",
+ "example_values": [
+ false,
+ true
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.last_seen",
+ "data_type": "string",
+ "example_values": [
+ "2018-03-25T06:49:27.776Z",
+ "2018-10-26T00:01:41.224Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.legal_copyright",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation. All rights reserved."
+ ]
+ },
+ {
+ "column_name": "MD5",
+ "column_order": 0,
+ "contains": [
+ "md5",
+ "hash"
+ ],
+ "data_path": "action_result.data.*.file_details.md5",
+ "data_type": "string",
+ "example_values": [
+ "75E683BC8284D99F998500162BE4CFE2",
+ "5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.file_details.observed_filename",
+ "data_type": "string",
+ "example_values": [
+ "c:\\windows\\system32\\wbem\\wmiprvse.exe",
+ "c:\\windows\\system32\\ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.orig_mod_len",
+ "data_type": "numeric",
+ "example_values": [
+ 489984,
+ 16896
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.file_details.original_filename",
+ "data_type": "string",
+ "example_values": [
+ "Wmiprvse.exe",
+ "ping.exe.mui"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.os_type",
+ "data_type": "string",
+ "example_values": [
+ "Windows"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.product_name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Windows Operating System"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.product_version",
+ "data_type": "string",
+ "example_values": [
+ "10.0.16299.248",
+ "6.1.7600.16385"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.server_added_timestamp",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-15T01:48:13.517Z",
+ "2015-05-15T07:23:54.846Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.signed",
+ "data_type": "string",
+ "example_values": [
+ "Signed"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.timestamp",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-15T01:48:13.517Z",
+ "2015-05-15T07:23:54.846Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.watchlists.*.value",
+ "data_type": "string",
+ "example_values": [
+ "2015-05-15T07:30:02.843Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_details.watchlists.*.wid",
+ "data_type": "string",
+ "example_values": [
+ "5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.file_id",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "contains": [
+ "file name",
+ "file path"
+ ],
+ "data_path": "action_result.data.*.name",
+ "data_type": "string",
+ "example_values": [
+ "wmiprvse.exe",
+ "C:\\Windows\\CarbonBlack\\Sensor.LOG",
+ "ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.session_id",
+ "data_type": "numeric",
+ "example_values": [
+ 101
+ ]
+ },
+ {
+ "column_name": "Vault ID",
+ "column_order": 1,
+ "contains": [
+ "vault id",
+ "sha1"
+ ],
+ "data_path": "action_result.data.*.vault_id",
+ "data_type": "string",
+ "example_values": [
+ "08f57fd06bbd8063d5b828521654225952a8155e",
+ "41c4e1e9abe08b218f5ea60d8ae41a5f523e7534"
+ ]
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.summary.cb_url",
+ "data_type": "string",
+ "example_values": [
+ "https://192.168.0.245/#/binary/75E683BC8284D99F998500162BE4CFE2",
+ "https://10.1.16.170/#/binary/5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "action_result.summary.file_type",
+ "data_type": "string",
+ "example_values": [
+ "pe file"
+ ]
+ },
+ {
+ "contains": [
+ "file name",
+ "file path"
+ ],
+ "data_path": "action_result.summary.name",
+ "data_type": "string",
+ "example_values": [
+ "wmiprvse.exe",
+ "C:\\Windows\\CarbonBlack\\Sensor.LOG",
+ "ping.exe"
+ ]
+ },
+ {
+ "contains": [
+ "vault id",
+ "sha1"
+ ],
+ "data_path": "action_result.summary.vault_id",
+ "data_type": "string",
+ "example_values": [
+ "08f57fd06bbd8063d5b828521654225952a8155e",
+ "41c4e1e9abe08b218f5ea60d8ae41a5f523e7534"
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "File type: pe file\nVault id: 08f57fd06bbd8063d5b828521654225952a8155e\nName: wmiprvse.exe\nCb url: https://192.168.0.245/#/binary/75E683BC8284D99F998500162BE4CFE2",
+ "Vault id: cefbc5c62d7e1f90d250ddcd35bc388a7b01f4d4, Name: C:\\Windows\\CarbonBlack\\Sensor.LOG",
+ "File type: pe file, Vault id: 41c4e1e9abe08b218f5ea60d8ae41a5f523e7534, Name: ping.exe, Cb url: https://10.1.16.170/#/binary/5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "product_name": "",
+ "product_vendor": "",
+ "type": "endpoint"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "get file 2"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#FFFFFF"
+ },
+ "text.icon": {
+ "fill": "#FFFFFF"
+ }
+ },
+ "block_code": "def get_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('get_file_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'get_file_2' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'get_file_2' call\n for filtered_results_item_1 in filtered_results_data_1:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'ph_0': \"\",\n 'offset': \"\",\n 'get_count': \"\",\n 'sensor_id': \"\",\n 'file_source': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"get file\", parameters=parameters, assets=['carbonblack'], name=\"get_file_2\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#654796",
+ "connected_to_start": true,
+ "connection_name": "file reputation",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": "0",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "91866693-2720-43a1-a437-f65f19382b9a",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 290,
+ "line_start": 263,
+ "message": "Configuring now",
+ "name": "get file",
+ "notes": "",
+ "number": 2,
+ "order": 10,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 600,
+ "y": 200
+ },
+ "previous_block_type": "",
+ "previous_function": "",
+ "previous_name": "get_file_2",
+ "required_params": {},
+ "reviewer": "",
+ "showNumber": true,
+ "show_number": true,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 2947
+ },
+ {
+ "action": "create ticket",
+ "action_type": "generic",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "description": "block_hash_2:action_result.message",
+ "fields": "block_hash_2:action_result.message",
+ "short_description": "block_hash_2:action_result.message"
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "",
+ "app_version": "",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "description": "block_hash_2:action_result.message",
+ "fields": "block_hash_2:action_result.message",
+ "short_description": "block_hash_2:action_result.message",
+ "table": "",
+ "vault_id": ""
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "servicenow",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.short_description",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "servicenow table"
+ ],
+ "data_path": "action_result.parameter.table",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.fields",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.description",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "servicenow ticket id"
+ ],
+ "data_path": "action_result.summary.created_ticket_id",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "vault id"
+ ],
+ "data_path": "action_result.parameter.vault_id",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_updated_on",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_updated_by",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.escalation",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.watch_list",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.follow_up",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.made_sla",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.delivery_task",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sla_due",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Number",
+ "column_order": 0,
+ "data_path": "action_result.data.*.number",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.caller_id",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.correlation_id",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_mod_count",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.notify",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.resolved_by",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Closed On",
+ "column_order": 6,
+ "data_path": "action_result.data.*.closed_at",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_tags",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.cmdb_ci",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.subcategory",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.category",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.close_notes",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.expected_start",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.knowledge",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.opened_by.link",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.opened_by.value",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.impact",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.calendar_stc",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.caused_by",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.comments",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.problem_id",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.activity_due",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.state",
+ "data_type": "string"
+ },
+ {
+ "column_name": "ID",
+ "column_order": 4,
+ "contains": [
+ "servicenow ticket id"
+ ],
+ "data_path": "action_result.data.*.sys_id",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Opened On",
+ "column_order": 5,
+ "data_path": "action_result.data.*.opened_at",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.child_incidents",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.work_notes",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Short Description",
+ "column_order": 0,
+ "data_path": "action_result.data.*.short_description",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.comments_and_work_notes",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.time_worked",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_created_by",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.upon_reject",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.reassignment_count",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.business_stc",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.due_date",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_class_name",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.delivery_plan",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Description",
+ "column_order": 1,
+ "data_path": "action_result.data.*.description",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.parent",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.business_duration",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.rfc",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.company",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.assigned_to",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.approval_history",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.user_input",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.work_start",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_domain.link",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_domain.value",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.resolved_at",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.calendar_duration",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.group_list",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.active",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.approval",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.parent_incident",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_domain_path",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.closed_by",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Severity",
+ "column_order": 2,
+ "data_path": "action_result.data.*.severity",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.upon_approval",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.incident_state",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.reopen_count",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.contact_type",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.work_end",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.work_notes_list",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sys_created_on",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.location",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.correlation_display",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.close_code",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.assignment_group",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.approval_set",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.order",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.urgency",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Priority",
+ "column_order": 2,
+ "data_path": "action_result.data.*.priority",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.hold_reason",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.business_service",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.sys_id",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.sys_tags",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.attachment_details.*.file_name",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.compressed",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.size_bytes",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.table_name",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.image_width",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.content_type",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.image_height",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.table_sys_id",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.data.*.attachment_details.*.download_link",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.sys_mod_count",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.sys_created_by",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.sys_created_on",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.sys_updated_by",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.sys_updated_on",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.size_compressed",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.attachment_details.*.average_image_color",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.additional_assignee_list",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary.attachment_id",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary.attachment_added",
+ "data_type": "boolean"
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric"
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric"
+ }
+ ],
+ "product_name": "",
+ "product_vendor": "",
+ "type": "ticketing"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "create ticket 3"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Utilities"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg"
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_generic.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#FFFFFF"
+ },
+ "text.icon": {
+ "fill": "#FFFFFF"
+ }
+ },
+ "block_code": "# read-only block view not available",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#5094D4",
+ "connected_to_start": false,
+ "connection_name": "block hash 2",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "def create_ticket_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'create_ticket_2' call\n\n file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash', \n 'file_reputation_1:filtered-action_result.summary.positives'])\n blocked_hashes = set(phantom.collect2(datapath='block_hash_2:action_result.parameter.hash'))\n detected_users = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.username'))\n detected_systems = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.hostname'))\n \n title = \"Virus Detected on {0} devices\".format(len(detected_systems))\n \n description = \"Hashes sumbitted with detections:\\n{0}\\n\\n\".format(\", \".join([\"{0} ({1})\".format(*fr) for fr in file_reputation]))\n description += \"File was found on {0} devices:\\n{1}\\n\\n\".format(len(detected_systems), ', '.join(detected_systems))\n description += \"This impacts at least {0} users:\\n{1}\\n\\n\".format(len(detected_users), ', '.join(detected_users))\n if len(blocked_hashes):\n description += \"{0} hashes were submitted for blocking:\\n{1}\\n\\n\".format(len(blocked_hashes), \", \".join(blocked_hashes))\n\n parameters = []\n \n # build parameters list for 'create_ticket_2' call\n parameters.append({\n 'short_description': title,\n 'description': description,\n 'fields': \"\",\n })\n\n if parameters:\n phantom.act(\"create ticket\", parameters=parameters, assets=['servicenow'], name=\"create_ticket_3\", parent_action=action) \n else:\n phantom.error(\"'create_ticket_3' will not be executed due to lack of parameters\")\n \n return",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": "0",
+ "description": "",
+ "has_custom": true,
+ "has_custom_block": true,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "72f13962-4d43-44be-9710-d2ed60cbbf00",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 326,
+ "line_start": 290,
+ "message": "Configuring now",
+ "name": "create ticket",
+ "notes": "",
+ "number": 3,
+ "order": 11,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1220,
+ "y": 80
+ },
+ "previous_block_type": "",
+ "previous_function": "",
+ "previous_name": "create_ticket_3",
+ "required_params": {},
+ "reviewer": "",
+ "showNumber": true,
+ "show_number": true,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Utilities",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 2948
+ },
+ {
+ "action": "disable user",
+ "action_type": "contain",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "username": "hunt_file_2:action_result.data.*.process.results.*.username"
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "",
+ "app_version": "",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "username": "hunt_file_2:action_result.data.*.process.results.*.username"
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "domainctrl1",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success",
+ "failed"
+ ]
+ },
+ {
+ "column_name": "Username",
+ "column_order": 0,
+ "contains": [
+ "user name",
+ "ldap distinguished name"
+ ],
+ "data_path": "action_result.parameter.username",
+ "data_type": "string",
+ "example_values": [
+ "test_user3"
+ ]
+ },
+ {
+ "data_path": "action_result.data",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Message",
+ "column_order": 1,
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "User state changed"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "product_name": "",
+ "product_vendor": "",
+ "type": "directory service"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "disable user"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Contain"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_contain.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#FFFFFF"
+ },
+ "text.icon": {
+ "fill": "#FFFFFF"
+ }
+ },
+ "block_code": "def disable_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('disable_user_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'disable_user_1' call\n results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.username', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'disable_user_1' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'username': results_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"disable user\", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name=\"disable_user_1\", parent_action=action)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#3D9959",
+ "connected_to_start": false,
+ "connection_name": "hunt file 2",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": "0",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "34bd4b5e-7b04-43a8-9fa7-dff28adb98dc",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 349,
+ "line_start": 326,
+ "message": "Configuring now",
+ "name": "disable user",
+ "notes": "",
+ "number": 1,
+ "order": 12,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 840,
+ "y": 480
+ },
+ "previous_block_type": "",
+ "previous_function": "",
+ "previous_name": "disable_user_1",
+ "required_params": {
+ "username": true
+ },
+ "reviewer": "",
+ "showNumber": false,
+ "show_number": false,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Contain",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 2949
+ },
+ {
+ "action": "hunt file",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash",
+ "range": "",
+ "type": "binary"
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "",
+ "app_version": "",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash",
+ "range": "",
+ "type": "binary"
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "carbonblack",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success"
+ ]
+ },
+ {
+ "contains": [
+ "hash",
+ "md5"
+ ],
+ "data_path": "action_result.parameter.hash",
+ "data_type": "string",
+ "example_values": [
+ "4fb491ac8d46aaf22ba8bc5c73dabef7",
+ "13ded573464ba7f43fe640479b309e09",
+ "9bf50324444c46997c2492d505b47f2d",
+ "5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.range",
+ "data_type": "string",
+ "example_values": [
+ "0-10",
+ "0-2",
+ "5-8"
+ ]
+ },
+ {
+ "contains": [
+ "carbon black query type"
+ ],
+ "data_path": "action_result.parameter.type",
+ "data_type": "string",
+ "example_values": [
+ "process",
+ "binary"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.elapsed",
+ "data_type": "numeric",
+ "example_values": [
+ 0.1120398044586182,
+ 0.04952096939086914,
+ 0.1234798431396484,
+ 0.05507302284240723,
+ 0.05384993553161621
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_result.*.name",
+ "data_type": "string",
+ "example_values": [
+ "Signed"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_result.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-01T00:00:00Z",
+ "2015-01-01T00:00:00Z",
+ "2013-11-01T00:00:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1,
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "16.0.10827.20181",
+ "4.7.0205.0",
+ "6.1.7600.16385 (win7_rtm.090713-1255)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.group.*.name",
+ "data_type": "string",
+ "example_values": [
+ "default group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.group.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.group.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.group.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.host_count.*.name",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.host_count.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1,
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.hostname.*.name",
+ "data_type": "string",
+ "example_values": [
+ "CB-TEST-02",
+ "WIN7-CLIENT1",
+ "ACCOUNTING-PC"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.hostname.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.hostname.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0",
+ "16.7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.hostname.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe",
+ "c:\\program files\\microsoft security client\\nissrv.exe",
+ "C:\\Windows\\system32\\ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0",
+ "50.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Office",
+ "Microsoft Malware Protection"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-19T00:00:00Z",
+ "2018-09-29T00:00:00Z",
+ "2018-10-02T00:00:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1,
+ 0
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.binary.highlights.*.ids",
+ "data_type": "string",
+ "example_values": [
+ "13DED573464BA7F43FE640479B309E09",
+ "9BF50324444C46997C2492D505B47F2D",
+ "5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.highlights.*.name",
+ "data_type": "string",
+ "example_values": [
+ "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST",
+ "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST",
+ "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST"
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "5fb30fe90736c7fc77de637021b1ce7c"
+ ]
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust",
+ "data_type": "numeric",
+ "example_values": [
+ -100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-07T02:37:28Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.cb_version",
+ "data_type": "numeric",
+ "example_values": [
+ 610,
+ 510,
+ 511
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.company_name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.copied_mod_len",
+ "data_type": "numeric",
+ "example_values": [
+ 9683736,
+ 366512,
+ 16896
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_issuer",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Code Signing PCA"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_prog_name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Office",
+ "Microsoft Corp."
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_publisher",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_result",
+ "data_type": "string",
+ "example_values": [
+ "Signed"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_result_code",
+ "data_type": "string",
+ "example_values": [
+ "0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_sign_time",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-14T20:23:00Z",
+ "2015-01-30T19:14:00Z",
+ "2009-07-14T10:17:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.digsig_subject",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.endpoint",
+ "data_type": "string",
+ "example_values": [
+ "CB-TEST-02|27",
+ "WIN7-CLIENT1|15",
+ "DC1|19"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.event_partition_id",
+ "data_type": "numeric",
+ "example_values": [
+ 100972684312576,
+ 100955696070656
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.facet_id",
+ "data_type": "numeric",
+ "example_values": [
+ 883737,
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.file_desc",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Office Click-to-Run (SxS)",
+ "Microsoft Network Realtime Inspection Service",
+ "TCP/IP Ping Command"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.file_version",
+ "data_type": "string",
+ "example_values": [
+ "16.0.10827.20181",
+ "4.7.0205.0",
+ "6.1.7600.16385 (win7_rtm.090713-1255)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.group",
+ "data_type": "string",
+ "example_values": [
+ "Default Group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.host_count",
+ "data_type": "numeric",
+ "example_values": [
+ 1,
+ 6
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.internal_name",
+ "data_type": "string",
+ "example_values": [
+ "OfficeClickToRun.exe",
+ "NisSrv.exe",
+ "ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.is_64bit",
+ "data_type": "boolean",
+ "example_values": [
+ false,
+ true
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.is_executable_image",
+ "data_type": "boolean",
+ "example_values": [
+ false,
+ true
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.last_seen",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-28T10:06:02.456Z",
+ "2018-10-28T10:06:42.455Z",
+ "2018-10-26T00:01:41.224Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.legal_copyright",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Corporation. All rights reserved."
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.md5",
+ "data_type": "string",
+ "example_values": [
+ "13DED573464BA7F43FE640479B309E09",
+ "9BF50324444C46997C2492D505B47F2D",
+ "5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.observed_filename",
+ "data_type": "string",
+ "example_values": [
+ "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe",
+ "c:\\program files\\microsoft security client\\nissrv.exe",
+ "c:\\windows\\system32\\ping.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.orig_mod_len",
+ "data_type": "numeric",
+ "example_values": [
+ 9683736,
+ 366512,
+ 16896
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.binary.results.*.original_filename",
+ "data_type": "string",
+ "example_values": [
+ "OfficeClickToRun.exe",
+ "NisSrv.exe",
+ "ping.exe.mui"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.os_type",
+ "data_type": "string",
+ "example_values": [
+ "Windows"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.product_name",
+ "data_type": "string",
+ "example_values": [
+ "Microsoft Office",
+ "Microsoft Malware Protection"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.product_version",
+ "data_type": "string",
+ "example_values": [
+ "16.0.10827.20181",
+ "4.7.0205.0",
+ "6.1.7600.16385"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.server_added_timestamp",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-19T17:04:47.906Z",
+ "2015-07-01T02:12:21.783Z",
+ "2015-05-15T07:23:54.846Z"
+ ]
+ },
+ {
+ "column_name": "Signed",
+ "column_order": 1,
+ "data_path": "action_result.data.*.binary.results.*.signed",
+ "data_type": "string",
+ "example_values": [
+ "Signed"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.timestamp",
+ "data_type": "string",
+ "example_values": [
+ "2018-10-19T17:04:47.906Z",
+ "2015-07-01T02:12:21.783Z",
+ "2015-05-15T07:23:54.846Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.watchlists.*.value",
+ "data_type": "string",
+ "example_values": [
+ "2015-07-01T02:20:02.062Z",
+ "2015-05-15T07:30:02.843Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid",
+ "data_type": "string",
+ "example_values": [
+ "5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.start",
+ "data_type": "numeric",
+ "example_values": [
+ 0,
+ 5
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.terms",
+ "data_type": "string",
+ "example_values": [
+ "md5:13ded573464ba7f43fe640479b309e09",
+ "md5:9bf50324444c46997c2492d505b47f2d",
+ "md5:5FB30FE90736C7FC77DE637021B1CE7C"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.binary.total_results",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.all_segments",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.comprehensive_search",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.elapsed",
+ "data_type": "numeric",
+ "example_values": [
+ 0.2200779914855957
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.day_of_week.*.name",
+ "data_type": "string",
+ "example_values": [
+ "0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.day_of_week.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 1566
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.group.*.name",
+ "data_type": "string",
+ "example_values": [
+ "default group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.group.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.group.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.group.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 10128
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.host_type.*.name",
+ "data_type": "string",
+ "example_values": [
+ "domain_controller"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.host_type.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.host_type.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "100.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.host_type.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 10123
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hostname.*.name",
+ "data_type": "string",
+ "example_values": [
+ "dc2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hostname.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hostname.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "51.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hostname.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 5185
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hour_of_day.*.name",
+ "data_type": "string",
+ "example_values": [
+ "0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.hour_of_day.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 411
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.facets.parent_name.*.name",
+ "data_type": "string",
+ "example_values": [
+ "svchost.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.parent_name.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.parent_name.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.parent_name.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9971
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.facets.path_full.*.name",
+ "data_type": "string",
+ "example_values": [
+ "c:\\windows\\syswow64\\wbem\\wmiprvse.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.path_full.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.path_full.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.path_full.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9971
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.process.facets.process_md5.*.name",
+ "data_type": "string",
+ "example_values": [
+ "4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_md5.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_md5.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_md5.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9971
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.facets.process_name.*.name",
+ "data_type": "string",
+ "example_values": [
+ "wmiprvse.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_name.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_name.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.process_name.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9971
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.start.*.name",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-24T00:00:00Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.start.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 324
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.username_full.*.name",
+ "data_type": "string",
+ "example_values": [
+ "LOCAL SERVICE"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.username_full.*.percent",
+ "data_type": "numeric",
+ "example_values": [
+ 100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.username_full.*.ratio",
+ "data_type": "string",
+ "example_values": [
+ "98.4"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.facets.username_full.*.value",
+ "data_type": "numeric",
+ "example_values": [
+ 9966
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.incomplete_results",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust",
+ "data_type": "numeric",
+ "example_values": [
+ -100
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust",
+ "data_type": "string",
+ "example_values": [
+ "2018-02-07T02:37:28Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.childproc_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "contains": [
+ "file path"
+ ],
+ "data_path": "action_result.data.*.process.results.*.cmdline",
+ "data_type": "string",
+ "example_values": [
+ "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.comms_ip",
+ "data_type": "numeric",
+ "example_values": [
+ 168886572
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.crossproc_count",
+ "data_type": "numeric",
+ "example_values": [
+ 2
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.emet_config",
+ "data_type": "string",
+ "example_values": [
+ ""
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.emet_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.filemod_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.filtering_known_dlls",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.group",
+ "data_type": "string",
+ "example_values": [
+ "default group"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.host_type",
+ "data_type": "string",
+ "example_values": [
+ "workstation"
+ ]
+ },
+ {
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.hostname",
+ "data_type": "string",
+ "example_values": [
+ "win7-client1"
+ ]
+ },
+ {
+ "contains": [
+ "carbon black process id"
+ ],
+ "data_path": "action_result.data.*.process.results.*.id",
+ "data_type": "string",
+ "example_values": [
+ "0000000f-0000-0688-01d3-27738c9b4243"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.interface_ip",
+ "data_type": "numeric",
+ "example_values": [
+ 168886572
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.last_server_update",
+ "data_type": "string",
+ "example_values": [
+ "2018-03-22T09:21:32.332Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.last_update",
+ "data_type": "string",
+ "example_values": [
+ "2017-09-07T00:52:15.82Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.modload_count",
+ "data_type": "numeric",
+ "example_values": [
+ 43
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.netconn_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.os_type",
+ "data_type": "string",
+ "example_values": [
+ "windows"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.parent_id",
+ "data_type": "string",
+ "example_values": [
+ "0000000f-0000-0258-01d1-ec51b545a19b"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.parent_md5",
+ "data_type": "string",
+ "example_values": [
+ "000000000000000000000000000000"
+ ]
+ },
+ {
+ "contains": [
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.parent_name",
+ "data_type": "string",
+ "example_values": [
+ "svchost.exe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.parent_pid",
+ "data_type": "numeric",
+ "example_values": [
+ 600
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.parent_unique_id",
+ "data_type": "string",
+ "example_values": [
+ "0000000f-0000-0258-01d1-ec51b545a19b-000000000001"
+ ]
+ },
+ {
+ "contains": [
+ "file path",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.path",
+ "data_type": "string",
+ "example_values": [
+ "c:\\windows\\syswow64\\wbem\\wmiprvse.exe"
+ ]
+ },
+ {
+ "contains": [
+ "md5"
+ ],
+ "data_path": "action_result.data.*.process.results.*.process_md5",
+ "data_type": "string",
+ "example_values": [
+ "4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "contains": [
+ "process name",
+ "file name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.process_name",
+ "data_type": "string",
+ "example_values": [
+ "wmiprvse.exe"
+ ]
+ },
+ {
+ "contains": [
+ "pid"
+ ],
+ "data_path": "action_result.data.*.process.results.*.process_pid",
+ "data_type": "numeric",
+ "example_values": [
+ 1672
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.processblock_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.regmod_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.segment_id",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "contains": [
+ "carbon black sensor id"
+ ],
+ "data_path": "action_result.data.*.process.results.*.sensor_id",
+ "data_type": "numeric",
+ "example_values": [
+ 15
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.start",
+ "data_type": "string",
+ "example_values": [
+ "2017-09-07T00:52:15.758Z"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.terminated",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.results.*.unique_id",
+ "data_type": "string",
+ "example_values": [
+ "0000000f-0000-0688-01d3-27738c9b4243-000000000001"
+ ]
+ },
+ {
+ "contains": [
+ "user name"
+ ],
+ "data_path": "action_result.data.*.process.results.*.username",
+ "data_type": "string",
+ "example_values": [
+ "SYSTEM"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.start",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.terms",
+ "data_type": "string",
+ "example_values": [
+ "md5:4fb491ac8d46aaf22ba8bc5c73dabef7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.process.total_results",
+ "data_type": "numeric",
+ "example_values": [
+ 32404
+ ]
+ },
+ {
+ "data_path": "action_result.summary.device_count",
+ "data_type": "numeric",
+ "example_values": [
+ 32404,
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Displaying 10 'process' results of total 32404",
+ "Displaying 1 'binary' results of total 1",
+ "Displaying 0 'binary' results of total 1"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "product_name": "",
+ "product_vendor": "",
+ "type": "endpoint"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "hunt file 1"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#FFFFFF"
+ },
+ "text.icon": {
+ "fill": "#FFFFFF"
+ }
+ },
+ "block_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_1' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_1' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"binary\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=block_hash_2, name=\"hunt_file_1\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#654796",
+ "connected_to_start": true,
+ "connection_name": "file reputation",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": "0",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "0fe35225-af74-44fa-b1a4-433a9c00cadb",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 398,
+ "line_start": 373,
+ "message": "Configuring now",
+ "name": "hunt file",
+ "notes": "",
+ "number": 1,
+ "order": 14,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 600,
+ "y": 80
+ },
+ "previous_block_type": "",
+ "previous_function": "",
+ "previous_name": "hunt_file_1",
+ "required_params": {
+ "hash": true
+ },
+ "reviewer": "",
+ "showNumber": true,
+ "show_number": true,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 2955
+ },
+ {
+ "action": "block hash",
+ "action_type": "contain",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "comment": "",
+ "hash": "hunt_file_1:artifact:*.cef.fileHash"
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "",
+ "app_version": "",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "comment": "",
+ "hash": "hunt_file_1:artifact:*.cef.fileHash"
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "carbonblack",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.comment",
+ "data_type": "string",
+ "example_values": [
+ "Sample comment"
+ ]
+ },
+ {
+ "column_name": "Hash",
+ "column_order": 0,
+ "contains": [
+ "md5",
+ "hash"
+ ],
+ "data_path": "action_result.parameter.hash",
+ "data_type": "string",
+ "example_values": [
+ "180469AE0B239E31DB4C65F02FD70BC1"
+ ]
+ },
+ {
+ "data_path": "action_result.data",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Message",
+ "column_order": 1,
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Block hash action succeeded. It might take some time for blacklisting to take effect."
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "product_name": "",
+ "product_vendor": "",
+ "type": "endpoint"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "block hash 2"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Contain"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_contain.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#FFFFFF"
+ },
+ "text.icon": {
+ "fill": "#FFFFFF"
+ }
+ },
+ "block_code": "def block_hash_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_hash_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'block_hash_2' call\n inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:artifact:*.cef.fileHash', 'hunt_file_1:artifact:*.id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'block_hash_2' call\n for inputs_item_1 in inputs_data_1:\n if inputs_item_1[0]:\n parameters.append({\n 'hash': inputs_item_1[0],\n 'comment': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': inputs_item_1[1]},\n })\n\n phantom.act(action=\"block hash\", parameters=parameters, assets=['carbonblack'], callback=filter_3, name=\"block_hash_2\", parent_action=action)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#3D9959",
+ "connected_to_start": false,
+ "connection_name": "hunt file 1",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": "0",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "f8ca6cc8-63fc-4ccf-b4cb-1a5ed1941c4d",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 422,
+ "line_start": 398,
+ "message": "Configuring now",
+ "name": "block hash",
+ "notes": "",
+ "number": 2,
+ "order": 15,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 840,
+ "y": 80
+ },
+ "previous_block_type": "",
+ "previous_function": "",
+ "previous_name": "block_hash_2",
+ "required_params": {
+ "hash": true
+ },
+ "reviewer": "",
+ "showNumber": true,
+ "show_delay": false,
+ "show_number": true,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Contain",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 2956
+ },
+ {
+ "action": "file reputation",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "hash": "artifact:*.cef.fileHash"
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "file reputation",
+ "active": true,
+ "app_name": "VirusTotal",
+ "app_version": "1.2.40",
+ "appid": "",
+ "asset_name": "virustotal",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "hash": "artifact:*.cef.fileHash"
+ },
+ "has_app": true,
+ "id": 142,
+ "loaded": false,
+ "missing": false,
+ "name": "virustotal",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success"
+ ]
+ },
+ {
+ "contains": [
+ "hash",
+ "sha256",
+ "sha1",
+ "md5"
+ ],
+ "data_path": "action_result.parameter.hash",
+ "data_type": "string",
+ "example_values": [
+ "6c1948f7edf115cd1f13cd170b882077930be150"
+ ]
+ },
+ {
+ "contains": [
+ "hash",
+ "md5"
+ ],
+ "data_path": "action_result.data.*.md5",
+ "data_type": "string",
+ "example_values": [
+ "494303294715f5ffad7ad3f43b73b00b"
+ ]
+ },
+ {
+ "contains": [
+ "url"
+ ],
+ "data_path": "action_result.data.*.permalink",
+ "data_type": "string",
+ "example_values": [
+ "https://www.test.com/file/27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7/analysis/1548112684/"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.positives",
+ "data_type": "numeric",
+ "example_values": [
+ 64
+ ]
+ },
+ {
+ "contains": [
+ "sha1"
+ ],
+ "data_path": "action_result.data.*.resource",
+ "data_type": "string",
+ "example_values": [
+ "6c1948f7edf115cd1f13cd170b882077930be150"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.response_code",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scan_date",
+ "data_type": "string",
+ "example_values": [
+ "2019-01-21 23:18:04"
+ ]
+ },
+ {
+ "contains": [
+ "virustotal scan id"
+ ],
+ "data_path": "action_result.data.*.scan_id",
+ "data_type": "string",
+ "example_values": [
+ "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7-1548112684"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.*.detected",
+ "data_type": "boolean"
+ },
+ {
+ "data_path": "action_result.data.*.scans.*.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.*.update",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.*.version",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.ALYac.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ALYac.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ALYac.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.ALYac.version",
+ "data_type": "string",
+ "example_values": [
+ "1.1.1.5"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AVG.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AVG.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32:Parite"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AVG.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AVG.version",
+ "data_type": "string",
+ "example_values": [
+ "18.4.3895.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AVware.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AVware.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.b (v)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AVware.update",
+ "data_type": "string",
+ "example_values": [
+ "20180925"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.AVware.version",
+ "data_type": "string",
+ "example_values": [
+ "1.6.0.52"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Acronis.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Acronis.result",
+ "data_type": "string",
+ "example_values": [
+ "suspicious"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Acronis.update",
+ "data_type": "string",
+ "example_values": [
+ "20190119"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Acronis.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0.1.37"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Ad-Aware.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Ad-Aware.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Ad-Aware.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Ad-Aware.version",
+ "data_type": "string",
+ "example_values": [
+ "3.0.5.370"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AegisLab.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AegisLab.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.AegisLab.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AegisLab.version",
+ "data_type": "string",
+ "example_values": [
+ "4.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AhnLab-V3.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AhnLab-V3.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32/Parite"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AhnLab-V3.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.AhnLab-V3.version",
+ "data_type": "string",
+ "example_values": [
+ "3.14.1.22785"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Alibaba.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Alibaba.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.Alibaba.update",
+ "data_type": "string",
+ "example_values": [
+ "20180921"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Alibaba.version",
+ "data_type": "string",
+ "example_values": [
+ "0.1.0.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Antiy-AVL.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Antiy-AVL.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus/Win32.Parite.c"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Antiy-AVL.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Antiy-AVL.version",
+ "data_type": "string",
+ "example_values": [
+ "3.0.0.1"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Arcabit.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Arcabit.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Arcabit.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Arcabit.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0.0.837"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avast-Mobile.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avast-Mobile.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avast-Mobile.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avast-Mobile.version",
+ "data_type": "string",
+ "example_values": [
+ "190121-00"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avast.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avast.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32:Parite"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avast.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avast.version",
+ "data_type": "string",
+ "example_values": [
+ "18.4.3895.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avira.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avira.result",
+ "data_type": "string",
+ "example_values": [
+ "W32/Parite"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Avira.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Avira.version",
+ "data_type": "string",
+ "example_values": [
+ "8.3.3.8"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Babable.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Babable.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.Babable.update",
+ "data_type": "string",
+ "example_values": [
+ "20180918"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Babable.version",
+ "data_type": "string",
+ "example_values": [
+ "9107201"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Baidu.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Baidu.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Virus.Parite.d"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Baidu.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Baidu.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0.0.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.BitDefender.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.BitDefender.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.BitDefender.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.BitDefender.version",
+ "data_type": "string",
+ "example_values": [
+ "7.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Bkav.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Bkav.result",
+ "data_type": "string",
+ "example_values": [
+ "W32.Pinfi.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Bkav.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Bkav.version",
+ "data_type": "string",
+ "example_values": [
+ "1.3.0.9899"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CAT-QuickHeal.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CAT-QuickHeal.result",
+ "data_type": "string",
+ "example_values": [
+ "W32.Perite.A"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CAT-QuickHeal.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CAT-QuickHeal.version",
+ "data_type": "string",
+ "example_values": [
+ "14.00"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CMC.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CMC.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Win32.Parite.b!O"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CMC.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CMC.version",
+ "data_type": "string",
+ "example_values": [
+ "1.1.0.977"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ClamAV.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ClamAV.result",
+ "data_type": "string",
+ "example_values": [
+ "Heuristics.W32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ClamAV.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.ClamAV.version",
+ "data_type": "string",
+ "example_values": [
+ "0.101.1.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Comodo.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Comodo.result",
+ "data_type": "string",
+ "example_values": [
+ "Malware@#1b1651nqd7ivb"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Comodo.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Comodo.version",
+ "data_type": "string",
+ "example_values": [
+ "30310"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CrowdStrike.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CrowdStrike.result",
+ "data_type": "string",
+ "example_values": [
+ "malicious_confidence_100% (W)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CrowdStrike.update",
+ "data_type": "string",
+ "example_values": [
+ "20181023"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.CrowdStrike.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cybereason.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cybereason.result",
+ "data_type": "string",
+ "example_values": [
+ "malicious.94715f"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cybereason.update",
+ "data_type": "string",
+ "example_values": [
+ "20190109"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cybereason.version",
+ "data_type": "string",
+ "example_values": [
+ "1.2.27"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cylance.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cylance.result",
+ "data_type": "string",
+ "example_values": [
+ "Unsafe"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cylance.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Cylance.version",
+ "data_type": "string",
+ "example_values": [
+ "2.3.1.101"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cyren.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cyren.result",
+ "data_type": "string",
+ "example_values": [
+ "W32/Virut.E.gen!Eldorado"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Cyren.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Cyren.version",
+ "data_type": "string",
+ "example_values": [
+ "6.2.0.1"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.DrWeb.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.DrWeb.result",
+ "data_type": "string",
+ "example_values": [
+ "Trojan.DownLoader20.25948"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.DrWeb.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.DrWeb.version",
+ "data_type": "string",
+ "example_values": [
+ "7.0.34.11020"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ESET-NOD32.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ESET-NOD32.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32/Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ESET-NOD32.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ESET-NOD32.version",
+ "data_type": "string",
+ "example_values": [
+ "18744"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Emsisoft.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Emsisoft.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B (B)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Emsisoft.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Emsisoft.version",
+ "data_type": "string",
+ "example_values": [
+ "2018.4.0.1029"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Endgame.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Endgame.result",
+ "data_type": "string",
+ "example_values": [
+ "malicious (high confidence)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Endgame.update",
+ "data_type": "string",
+ "example_values": [
+ "20181108"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Endgame.version",
+ "data_type": "string",
+ "example_values": [
+ "3.0.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.F-Prot.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.F-Prot.result",
+ "data_type": "string",
+ "example_values": [
+ "W32/Virut.E.gen!Eldorado"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.F-Prot.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.F-Prot.version",
+ "data_type": "string",
+ "example_values": [
+ "4.7.1.166"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.F-Secure.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.F-Secure.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.F-Secure.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.F-Secure.version",
+ "data_type": "string",
+ "example_values": [
+ "11.0.19100.45"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Fortinet.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Fortinet.result",
+ "data_type": "string",
+ "example_values": [
+ "W32/Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Fortinet.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Fortinet.version",
+ "data_type": "string",
+ "example_values": [
+ "5.4.247.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.GData.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.GData.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.GData.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.GData.version",
+ "data_type": "string",
+ "example_values": [
+ "A:25.20275B:25.14197"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Ikarus.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Ikarus.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Win32.Virut"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Ikarus.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Ikarus.version",
+ "data_type": "string",
+ "example_values": [
+ "0.1.5.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Invincea.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Invincea.result",
+ "data_type": "string",
+ "example_values": [
+ "heuristic"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Invincea.update",
+ "data_type": "string",
+ "example_values": [
+ "20181128"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Invincea.version",
+ "data_type": "string",
+ "example_values": [
+ "6.3.6.26157"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Jiangmin.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Jiangmin.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32/Parite.b"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Jiangmin.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Jiangmin.version",
+ "data_type": "string",
+ "example_values": [
+ "16.0.100"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.K7AntiVirus.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.K7AntiVirus.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus ( 00001b711 )"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.K7AntiVirus.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.K7AntiVirus.version",
+ "data_type": "string",
+ "example_values": [
+ "11.24.29740"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.K7GW.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.K7GW.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus ( 00001b711 )"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.K7GW.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.K7GW.version",
+ "data_type": "string",
+ "example_values": [
+ "11.24.29740"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Kaspersky.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Kaspersky.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Win32.Parite.b"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Kaspersky.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Kaspersky.version",
+ "data_type": "string",
+ "example_values": [
+ "15.0.1.13"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Kingsoft.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Kingsoft.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.b.5756"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Kingsoft.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Kingsoft.version",
+ "data_type": "string",
+ "example_values": [
+ "2013.8.14.323"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.MAX.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.MAX.result",
+ "data_type": "string",
+ "example_values": [
+ "malware (ai score=100)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.MAX.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.MAX.version",
+ "data_type": "string",
+ "example_values": [
+ "2018.9.12.1"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Malwarebytes.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Malwarebytes.result",
+ "data_type": "string",
+ "example_values": [
+ "Trojan.Agent.QQ"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Malwarebytes.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Malwarebytes.version",
+ "data_type": "string",
+ "example_values": [
+ "2.1.1.1115"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.McAfee-GW-Edition.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.McAfee-GW-Edition.result",
+ "data_type": "string",
+ "example_values": [
+ "BehavesLike.Win32.Pate.hh"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.McAfee-GW-Edition.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.McAfee-GW-Edition.version",
+ "data_type": "string",
+ "example_values": [
+ "v2017.3010"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.McAfee.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.McAfee.result",
+ "data_type": "string",
+ "example_values": [
+ "W32/Pate.b"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.McAfee.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.McAfee.version",
+ "data_type": "string",
+ "example_values": [
+ "6.0.6.653"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.MicroWorld-eScan.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.MicroWorld-eScan.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.MicroWorld-eScan.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.MicroWorld-eScan.version",
+ "data_type": "string",
+ "example_values": [
+ "14.0.297.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Microsoft.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Microsoft.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus:Win32/Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Microsoft.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Microsoft.version",
+ "data_type": "string",
+ "example_values": [
+ "1.1.15500.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.NANO-Antivirus.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.NANO-Antivirus.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Win32.Parite.bgvo"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.NANO-Antivirus.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.NANO-Antivirus.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0.134.24576"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Paloalto.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Paloalto.result",
+ "data_type": "string",
+ "example_values": [
+ "generic.ml"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Paloalto.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Paloalto.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Panda.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Panda.result",
+ "data_type": "string",
+ "example_values": [
+ "W32/Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Panda.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Panda.version",
+ "data_type": "string",
+ "example_values": [
+ "4.6.4.2"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Qihoo-360.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Qihoo-360.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Win32.Parite.H"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Qihoo-360.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Qihoo-360.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0.0.1120"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Rising.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Rising.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Parite!1.9B80 (CLOUD)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Rising.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Rising.version",
+ "data_type": "string",
+ "example_values": [
+ "25.0.0.24"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.SUPERAntiSpyware.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.SUPERAntiSpyware.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.SUPERAntiSpyware.update",
+ "data_type": "string",
+ "example_values": [
+ "20190116"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.SUPERAntiSpyware.version",
+ "data_type": "string",
+ "example_values": [
+ "5.6.0.1032"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.SentinelOne.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.SentinelOne.result",
+ "data_type": "string",
+ "example_values": [
+ "static engine - malicious"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.SentinelOne.update",
+ "data_type": "string",
+ "example_values": [
+ "20190118"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.SentinelOne.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0.21.268"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Sophos.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Sophos.result",
+ "data_type": "string",
+ "example_values": [
+ "W32/Parite-B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Sophos.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Sophos.version",
+ "data_type": "string",
+ "example_values": [
+ "4.98.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Symantec.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Symantec.result",
+ "data_type": "string",
+ "example_values": [
+ "Trojan.Gen.6"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Symantec.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Symantec.version",
+ "data_type": "string",
+ "example_values": [
+ "1.8.0.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TACHYON.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TACHYON.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus/W32.Parite.C"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TACHYON.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TACHYON.version",
+ "data_type": "string",
+ "example_values": [
+ "2019-01-21.02"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Tencent.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Tencent.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Win32.Dropper.c"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Tencent.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Tencent.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0.0.1"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TheHacker.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TheHacker.result",
+ "data_type": "string",
+ "example_values": [
+ "W32/Pate.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TheHacker.update",
+ "data_type": "string",
+ "example_values": [
+ "20190118"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TheHacker.version",
+ "data_type": "string",
+ "example_values": [
+ "6.8.0.5.3962"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TotalDefense.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TotalDefense.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32/Pinfi.A"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TotalDefense.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.TotalDefense.version",
+ "data_type": "string",
+ "example_values": [
+ "37.1.62.1"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Trapmine.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Trapmine.result",
+ "data_type": "string",
+ "example_values": [
+ "malicious.high.ml.score"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Trapmine.update",
+ "data_type": "string",
+ "example_values": [
+ "20190103"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Trapmine.version",
+ "data_type": "string",
+ "example_values": [
+ "3.0.34.707"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.result",
+ "data_type": "string",
+ "example_values": [
+ "PE_PARITE.A"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.version",
+ "data_type": "string",
+ "example_values": [
+ "10.0.0.1040"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TrendMicro.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TrendMicro.result",
+ "data_type": "string",
+ "example_values": [
+ "PE_PARITE.A"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TrendMicro.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.TrendMicro.version",
+ "data_type": "string",
+ "example_values": [
+ "10.0.0.1040"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Trustlook.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Trustlook.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.Trustlook.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Trustlook.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.VBA32.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.VBA32.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Win32.Parite.b"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.VBA32.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.VBA32.version",
+ "data_type": "string",
+ "example_values": [
+ "3.35.1"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.VIPRE.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.VIPRE.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.b (v)"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.VIPRE.update",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.VIPRE.version",
+ "data_type": "string",
+ "example_values": [
+ "None"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ViRobot.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ViRobot.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.A"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ViRobot.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ViRobot.version",
+ "data_type": "string",
+ "example_values": [
+ "2014.3.20.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Webroot.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Webroot.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.Webroot.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Webroot.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0.0.403"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Yandex.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Yandex.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Yandex.update",
+ "data_type": "string",
+ "example_values": [
+ "20190120"
+ ]
+ },
+ {
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.scans.Yandex.version",
+ "data_type": "string",
+ "example_values": [
+ "5.5.1.3"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Zillya.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Zillya.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Parite.Win32.9"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Zillya.update",
+ "data_type": "string",
+ "example_values": [
+ "20190118"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Zillya.version",
+ "data_type": "string",
+ "example_values": [
+ "2.0.0.3733"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ZoneAlarm.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ZoneAlarm.result",
+ "data_type": "string",
+ "example_values": [
+ "Virus.Win32.Parite.b"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ZoneAlarm.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.ZoneAlarm.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Zoner.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Zoner.result",
+ "data_type": "string",
+ "example_values": [
+ "Win32.Parite.B"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Zoner.update",
+ "data_type": "string",
+ "example_values": [
+ "20190121"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.Zoner.version",
+ "data_type": "string",
+ "example_values": [
+ "1.0"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.eGambit.detected",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.eGambit.result",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.scans.eGambit.update",
+ "data_type": "string",
+ "example_values": [
+ "20190122"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.scans.eGambit.version",
+ "data_type": "string",
+ "example_values": [
+ "v4.3.5"
+ ]
+ },
+ {
+ "contains": [
+ "hash",
+ "sha1"
+ ],
+ "data_path": "action_result.data.*.sha1",
+ "data_type": "string",
+ "example_values": [
+ "6c1948f7edf115cd1f13cd170b882077930be150"
+ ]
+ },
+ {
+ "contains": [
+ "hash",
+ "sha256"
+ ],
+ "data_path": "action_result.data.*.sha256",
+ "data_type": "string",
+ "example_values": [
+ "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.total",
+ "data_type": "numeric",
+ "example_values": [
+ 72
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.verbose_msg",
+ "data_type": "string",
+ "example_values": [
+ "Scan finished, information embedded"
+ ]
+ },
+ {
+ "data_path": "action_result.summary.positives",
+ "data_type": "numeric",
+ "example_values": [
+ 64
+ ]
+ },
+ {
+ "data_path": "action_result.summary.total_scans",
+ "data_type": "numeric",
+ "example_values": [
+ 72
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Positives: 64, Total scans: 72"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_positives",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "hash": {
+ "contains": [
+ "hash",
+ "sha256",
+ "sha1",
+ "md5"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "File hash to query",
+ "key": "hash",
+ "order": 0,
+ "primary": true,
+ "required": true
+ }
+ },
+ "product_name": "VirusTotal",
+ "product_vendor": "VirusTotal",
+ "targets": "34",
+ "type": ""
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "file reputation"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#FFFFFF"
+ },
+ "text.icon": {
+ "fill": "#FFFFFF"
+ }
+ },
+ "block_code": "def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('file_reputation_1() called')\n\n # collect data for 'file_reputation_1' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.fileHash', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'file_reputation_1' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'hash': container_item[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n phantom.act(action=\"file reputation\", parameters=parameters, assets=['virustotal'], callback=filter_1, name=\"file_reputation_1\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#654796",
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": "0",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "3c5abd70-80e5-46b8-908e-4eeb0ae4cef5",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 443,
+ "line_start": 422,
+ "message": "Configuring now",
+ "name": "file reputation",
+ "notes": "",
+ "number": 1,
+ "order": 16,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 220,
+ "y": 80
+ },
+ "previous_block_type": "",
+ "previous_function": "",
+ "previous_name": "file_reputation_1",
+ "required_params": {
+ "hash": true
+ },
+ "reviewer": "",
+ "showNumber": false,
+ "show_number": false,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "action_assets",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 2957
+ },
+ {
+ "action": "block hash",
+ "action_type": "contain",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "comment": "",
+ "hash": "hunt_file_2:artifact:*.cef.fileHash"
+ },
+ "angle": 0,
+ "app": "",
+ "approver": "",
+ "assets": [
+ {
+ "action": "",
+ "active": true,
+ "app_name": "",
+ "app_version": "",
+ "appid": "",
+ "config_type": "asset",
+ "fields": {
+ "comment": "",
+ "hash": "hunt_file_2:artifact:*.cef.fileHash"
+ },
+ "has_app": true,
+ "id": "-",
+ "loaded": false,
+ "missing": false,
+ "name": "carbonblack",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.comment",
+ "data_type": "string",
+ "example_values": [
+ "Sample comment"
+ ]
+ },
+ {
+ "column_name": "Hash",
+ "column_order": 0,
+ "contains": [
+ "md5",
+ "hash"
+ ],
+ "data_path": "action_result.parameter.hash",
+ "data_type": "string",
+ "example_values": [
+ "180469AE0B239E31DB4C65F02FD70BC1"
+ ]
+ },
+ {
+ "data_path": "action_result.data",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Message",
+ "column_order": 1,
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Block hash action succeeded. It might take some time for blacklisting to take effect."
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "product_name": "",
+ "product_vendor": "",
+ "type": "endpoint"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "block hash 3"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".border": {
+ "height": 88
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "fill": "#FFFFFF",
+ "font-size": 12,
+ "font-weight": 300,
+ "opacity": 0,
+ "ref": ".background",
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Contain"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_contain.svg"
+ },
+ "g.notes": {
+ "display": "block",
+ "opacity": 1
+ },
+ "g.notes image": {
+ "opacity": 1
+ },
+ "g.timer image": {
+ "opacity": 1
+ },
+ "rect.warn-background": {
+ "fill": "#FFFFFF"
+ },
+ "text.icon": {
+ "fill": "#FFFFFF"
+ }
+ },
+ "block_code": "def block_hash_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('block_hash_3() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'block_hash_3' call\n inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:artifact:*.cef.fileHash', 'hunt_file_2:artifact:*.id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'block_hash_3' call\n for inputs_item_1 in inputs_data_1:\n if inputs_item_1[0]:\n parameters.append({\n 'hash': inputs_item_1[0],\n 'comment': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': inputs_item_1[1]},\n })\n\n phantom.act(action=\"block hash\", parameters=parameters, assets=['carbonblack'], callback=join_filter_2, name=\"block_hash_3\", parent_action=action)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "#3D9959",
+ "connected_to_start": false,
+ "connection_name": "hunt file 2",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": "0",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "4aa9e1f2-fc69-4439-ae54-3eb215adec8f",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 373,
+ "line_start": 349,
+ "message": "Configuring now",
+ "name": "block hash",
+ "notes": "",
+ "number": 3,
+ "order": 13,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 840,
+ "y": 340
+ },
+ "previous_block_type": "",
+ "previous_function": "",
+ "previous_name": "block_hash_3",
+ "required_params": {
+ "hash": true
+ },
+ "reviewer": "",
+ "showNumber": true,
+ "show_number": true,
+ "size": {
+ "height": 112,
+ "width": 168
+ },
+ "state": "asset",
+ "status": "",
+ "title": "Contain",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 2958
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773",
+ "transform": "rotate(45 30 70)"
+ },
+ ".border": {
+ "transform": "rotate(45 30 70)"
+ },
+ ".inPorts>.port-0>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".number": {
+ "text": 2
+ },
+ ".outPorts>.port-0": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ },
+ "ref-x": 83,
+ "ref-y": 40
+ },
+ ".outPorts>.port-0>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_2() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">\", 10],\n ],\n name=\"filter_2:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n create_ticket_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": false,
+ "connection_name": "logoff user, shutdown system, disable user, block hash 3",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "",
+ "hasElse": false,
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "def join_filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('join_filter_2() called')\n\n # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n if phantom.completed(action_names=['logoff_user_1', 'shutdown_system_1', 'disable_user_1', 'block_hash_3']):\n \n # call connected block \"filter_2\"\n filter_2(container=container, handle=handle)\n \n return",
+ "join_optional": [],
+ "join_start": 132,
+ "line_end": 143,
+ "line_start": 114,
+ "name": "filter",
+ "notes": "",
+ "number": 2,
+ "order": 5,
+ "outPorts": [
+ "out-1"
+ ],
+ "outputs": [
+ {
+ "conditions": [
+ {
+ "comparison": ">",
+ "data_type": "",
+ "param": "file_reputation_1:action_result.summary.positives",
+ "value": "10"
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1080,
+ "y": 340
+ },
+ "previous_block_type": "",
+ "previous_function": "",
+ "previous_name": "filter_2",
+ "show_number": true,
+ "size": {
+ "height": 82,
+ "width": 82
+ },
+ "state": "filter",
+ "status": "",
+ "type": "coa.Filter",
+ "warn": false,
+ "z": 2959
+ }
+ ]
+ },
+ "notes": ""
+ },
+ "python_version": "3",
+ "schema": 4,
+ "version": "4.10.0.40961"
+ },
+ "create_time": "2021-01-21T21:31:52.515480+00:00",
+ "draft_mode": false,
+ "labels": [
+ "events"
+ ],
+ "tags": [],
+ "misc": {
+ "apps_list": [
+ "LDAP",
+ "ServiceNow",
+ "Carbon Black Response",
+ "VirusTotal"
+ ]
+ }
+}
\ No newline at end of file
diff --git a/playbooks/malware_hunt_and_contain.png b/playbooks/malware_hunt_and_contain.png
new file mode 100644
index 0000000000..784fcde3ab
Binary files /dev/null and b/playbooks/malware_hunt_and_contain.png differ
diff --git a/playbooks/malware_hunt_and_contain.py b/playbooks/malware_hunt_and_contain.py
new file mode 100644
index 0000000000..eb7e2f484f
--- /dev/null
+++ b/playbooks/malware_hunt_and_contain.py
@@ -0,0 +1,456 @@
+"""
+This playbook investigates and remediates malware infections on the endpoint.
+"""
+
+import phantom.rules as phantom
+import json
+from datetime import datetime, timedelta
+##############################
+# Start - Global Code Block
+
+"""Malicous file detected on endpoint"""
+
+# End - Global Code block
+##############################
+
+def on_start(container):
+ phantom.debug('on_start() called')
+
+ # call 'file_reputation_1' block
+ file_reputation_1(container=container)
+
+ return
+
+def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('filter_3() called')
+
+ # collect filtered artifact ids for 'if' condition 1
+ matched_artifacts_1, matched_results_1 = phantom.condition(
+ container=container,
+ action_results=results,
+ conditions=[
+ ["file_reputation_1:action_result.summary.positives", ">", 5],
+ ["file_reputation_1:action_result.summary.positives", "<=", 10],
+ ],
+ logical_operator='and',
+ name="filter_3:condition_1")
+
+ # call connected blocks if filtered artifacts or results
+ if matched_artifacts_1 or matched_results_1:
+ create_ticket_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+ return
+
+def shutdown_system_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('shutdown_system_1() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'shutdown_system_1' call
+ results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)
+
+ parameters = []
+
+ # build parameters list for 'shutdown_system_1' call
+ for results_item_1 in results_data_1:
+ parameters.append({
+ 'ph': "",
+ 'message': "",
+ 'wait_time': "",
+ 'ip_hostname': results_item_1[0],
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': results_item_1[1]},
+ })
+
+ phantom.act(action="shutdown system", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name="shutdown_system_1", parent_action=action)
+
+ return
+
+def create_ticket_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'create_ticket_2' call
+
+ disabled_users = set(phantom.collect2(datapath='disable_user_1:action_result.parameter.username'))
+ blocked_hashes = set(phantom.collect2(datapath='block_hash_3:action_result.parameter.hash'))
+ loggedoff_users = set(phantom.collect2(datapath='logoff_user_1:action_result.parameter.username'))
+ shutdown_systems = set(phantom.collect2(datapath='shutdown_system_1:action_result.parameter.ip_hostname'))
+ file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash',
+ 'file_reputation_1:filtered-action_result.summary.positives'])
+ detected_users = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.username'))
+ detected_systems = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.hostname'))
+
+ title = "Virus Detected on {0} devices".format(len(detected_systems))
+
+ description = "Hashes sumbitted with detections:\n{0}\n\n".format(", ".join(["{0} ({1})".format(*fr) for fr in file_reputation]))
+ description += "File was found on {0} devices:\n{1}\n\n".format(len(detected_systems), ', '.join(detected_systems))
+ description += "This impacts at least {0} users:\n{1}\n\n".format(len(detected_users), ', '.join(detected_users))
+ if len(blocked_hashes):
+ description += "{0} hashes were submitted for blocking:\n{1}\n\n".format(len(blocked_hashes), ", ".join(blocked_hashes))
+ if len(loggedoff_users):
+ description += "{0} users were forced to logoff:\n{1}\n\n".format(len(loggedoff_users), ", ".join(loggedoff_users))
+ if len(disabled_users):
+ description += "{0} user accounts were disabled:\n{1}\n\n".format(len(disabled_users), ", ".join(disabled_users))
+ if len(shutdown_systems):
+ description += "{0} systems were shutdown:\n{1}\n\n".format(len(shutdown_systems), ", ".join(shutdown_systems))
+
+ parameters = []
+
+ # build parameters list for 'create_ticket_2' call
+ parameters.append({
+ 'short_description': title,
+ 'description': description,
+ 'fields': "",
+ })
+
+ if parameters:
+ phantom.act("create ticket", parameters=parameters, assets=['servicenow'], name="create_ticket_2", parent_action=action)
+ else:
+ phantom.error("'create_ticket_2' will not be executed due to lack of parameters")
+
+ return
+
+def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('filter_2() called')
+
+ # collect filtered artifact ids for 'if' condition 1
+ matched_artifacts_1, matched_results_1 = phantom.condition(
+ container=container,
+ action_results=results,
+ conditions=[
+ ["file_reputation_1:action_result.summary.positives", ">", 10],
+ ],
+ name="filter_2:condition_1")
+
+ # call connected blocks if filtered artifacts or results
+ if matched_artifacts_1 or matched_results_1:
+ create_ticket_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+ return
+
+def join_filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):
+ phantom.debug('join_filter_2() called')
+
+ # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed
+ if phantom.completed(action_names=['logoff_user_1', 'shutdown_system_1', 'disable_user_1', 'block_hash_3']):
+
+ # call connected block "filter_2"
+ filter_2(container=container, handle=handle)
+
+ return
+
+def logoff_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('logoff_user_1() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'logoff_user_1' call
+ results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)
+
+ parameters = []
+
+ # build parameters list for 'logoff_user_1' call
+ for results_item_1 in results_data_1:
+ parameters.append({
+ 'username': "",
+ 'ip_hostname': results_item_1[0],
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': results_item_1[1]},
+ })
+
+ phantom.act(action="logoff user", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name="logoff_user_1", parent_action=action)
+
+ return
+
+def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('filter_1() called')
+
+ # collect filtered artifact ids for 'if' condition 1
+ matched_artifacts_1, matched_results_1 = phantom.condition(
+ container=container,
+ action_results=results,
+ conditions=[
+ ["file_reputation_1:action_result.summary.positives", ">", 5],
+ ["file_reputation_1:action_result.summary.positives", "<=", 10],
+ ],
+ logical_operator='and',
+ name="filter_1:condition_1")
+
+ # call connected blocks if filtered artifacts or results
+ if matched_artifacts_1 or matched_results_1:
+ hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+ get_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+ # collect filtered artifact ids for 'if' condition 2
+ matched_artifacts_2, matched_results_2 = phantom.condition(
+ container=container,
+ action_results=results,
+ conditions=[
+ ["file_reputation_1:action_result.summary.positives", ">", 10],
+ ],
+ name="filter_1:condition_2")
+
+ # call connected blocks if filtered artifacts or results
+ if matched_artifacts_2 or matched_results_2:
+ hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)
+ get_file_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)
+
+ return
+
+def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('hunt_file_2() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'hunt_file_2' call
+ filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id"])
+
+ parameters = []
+
+ # build parameters list for 'hunt_file_2' call
+ for filtered_results_item_1 in filtered_results_data_1:
+ if filtered_results_item_1[0]:
+ parameters.append({
+ 'hash': filtered_results_item_1[0],
+ 'type': "",
+ 'range': "",
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': filtered_results_item_1[1]},
+ })
+
+ phantom.act(action="hunt file", parameters=parameters, assets=['carbonblack'], callback=hunt_file_2_callback, name="hunt_file_2")
+
+ return
+
+def hunt_file_2_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):
+ phantom.debug('hunt_file_2_callback() called')
+
+ disable_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+ logoff_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+ shutdown_system_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+ block_hash_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+
+ return
+
+def get_file_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('get_file_3() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'get_file_3' call
+ filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id"])
+
+ parameters = []
+
+ # build parameters list for 'get_file_3' call
+ for filtered_results_item_1 in filtered_results_data_1:
+ parameters.append({
+ 'hash': filtered_results_item_1[0],
+ 'ph_0': "",
+ 'offset': "",
+ 'get_count': "",
+ 'sensor_id': "",
+ 'file_source': "",
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': filtered_results_item_1[1]},
+ })
+
+ phantom.act(action="get file", parameters=parameters, assets=['carbonblack'], name="get_file_3")
+
+ return
+
+def get_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('get_file_2() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'get_file_2' call
+ filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id"])
+
+ parameters = []
+
+ # build parameters list for 'get_file_2' call
+ for filtered_results_item_1 in filtered_results_data_1:
+ parameters.append({
+ 'hash': filtered_results_item_1[0],
+ 'ph_0': "",
+ 'offset': "",
+ 'get_count': "",
+ 'sensor_id': "",
+ 'file_source': "",
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': filtered_results_item_1[1]},
+ })
+
+ phantom.act(action="get file", parameters=parameters, assets=['carbonblack'], name="get_file_2")
+
+ return
+
+def create_ticket_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'create_ticket_2' call
+
+ file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash',
+ 'file_reputation_1:filtered-action_result.summary.positives'])
+ blocked_hashes = set(phantom.collect2(datapath='block_hash_2:action_result.parameter.hash'))
+ detected_users = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.username'))
+ detected_systems = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.hostname'))
+
+ title = "Virus Detected on {0} devices".format(len(detected_systems))
+
+ description = "Hashes sumbitted with detections:\n{0}\n\n".format(", ".join(["{0} ({1})".format(*fr) for fr in file_reputation]))
+ description += "File was found on {0} devices:\n{1}\n\n".format(len(detected_systems), ', '.join(detected_systems))
+ description += "This impacts at least {0} users:\n{1}\n\n".format(len(detected_users), ', '.join(detected_users))
+ if len(blocked_hashes):
+ description += "{0} hashes were submitted for blocking:\n{1}\n\n".format(len(blocked_hashes), ", ".join(blocked_hashes))
+
+ parameters = []
+
+ # build parameters list for 'create_ticket_2' call
+ parameters.append({
+ 'short_description': title,
+ 'description': description,
+ 'fields': "",
+ })
+
+ if parameters:
+ phantom.act("create ticket", parameters=parameters, assets=['servicenow'], name="create_ticket_3", parent_action=action)
+ else:
+ phantom.error("'create_ticket_3' will not be executed due to lack of parameters")
+
+ return
+
+def disable_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('disable_user_1() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'disable_user_1' call
+ results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.username', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)
+
+ parameters = []
+
+ # build parameters list for 'disable_user_1' call
+ for results_item_1 in results_data_1:
+ if results_item_1[0]:
+ parameters.append({
+ 'username': results_item_1[0],
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': results_item_1[1]},
+ })
+
+ phantom.act(action="disable user", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name="disable_user_1", parent_action=action)
+
+ return
+
+def block_hash_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('block_hash_3() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'block_hash_3' call
+ inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:artifact:*.cef.fileHash', 'hunt_file_2:artifact:*.id'], action_results=results)
+
+ parameters = []
+
+ # build parameters list for 'block_hash_3' call
+ for inputs_item_1 in inputs_data_1:
+ if inputs_item_1[0]:
+ parameters.append({
+ 'hash': inputs_item_1[0],
+ 'comment': "",
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': inputs_item_1[1]},
+ })
+
+ phantom.act(action="block hash", parameters=parameters, assets=['carbonblack'], callback=join_filter_2, name="block_hash_3", parent_action=action)
+
+ return
+
+def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('hunt_file_1() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'hunt_file_1' call
+ filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash", "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id"])
+
+ parameters = []
+
+ # build parameters list for 'hunt_file_1' call
+ for filtered_results_item_1 in filtered_results_data_1:
+ if filtered_results_item_1[0]:
+ parameters.append({
+ 'hash': filtered_results_item_1[0],
+ 'type': "binary",
+ 'range': "",
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': filtered_results_item_1[1]},
+ })
+
+ phantom.act(action="hunt file", parameters=parameters, assets=['carbonblack'], callback=block_hash_2, name="hunt_file_1")
+
+ return
+
+def block_hash_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('block_hash_2() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'block_hash_2' call
+ inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:artifact:*.cef.fileHash', 'hunt_file_1:artifact:*.id'], action_results=results)
+
+ parameters = []
+
+ # build parameters list for 'block_hash_2' call
+ for inputs_item_1 in inputs_data_1:
+ if inputs_item_1[0]:
+ parameters.append({
+ 'hash': inputs_item_1[0],
+ 'comment': "",
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': inputs_item_1[1]},
+ })
+
+ phantom.act(action="block hash", parameters=parameters, assets=['carbonblack'], callback=filter_3, name="block_hash_2", parent_action=action)
+
+ return
+
+def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('file_reputation_1() called')
+
+ # collect data for 'file_reputation_1' call
+ container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.fileHash', 'artifact:*.id'])
+
+ parameters = []
+
+ # build parameters list for 'file_reputation_1' call
+ for container_item in container_data:
+ if container_item[0]:
+ parameters.append({
+ 'hash': container_item[0],
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': container_item[1]},
+ })
+
+ phantom.act(action="file reputation", parameters=parameters, assets=['virustotal'], callback=filter_1, name="file_reputation_1")
+
+ return
+
+def on_finish(container, summary):
+ phantom.debug('on_finish() called')
+ # This function is called after all actions are completed.
+ # summary of all the action and/or all details of actions
+ # can be collected here.
+
+ # summary_json = phantom.get_summary()
+ # if 'result' in summary_json:
+ # for action_result in summary_json['result']:
+ # if 'action_run_id' in action_result:
+ # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)
+ # phantom.debug(action_results)
+
+ return
\ No newline at end of file
diff --git a/playbooks/malware_hunt_and_contain.yml b/playbooks/malware_hunt_and_contain.yml
new file mode 100644
index 0000000000..fda6970320
--- /dev/null
+++ b/playbooks/malware_hunt_and_contain.yml
@@ -0,0 +1,22 @@
+name: Malware Hunt and Contain
+id: fb3edc76-ff2b-43c0-5f6f-63da4483fd63
+version: 1
+date: '2021-01-21'
+author: Philip Royer, Splunk
+type: Response
+description: This playbook investigates and remediates malware infections on the endpoint.
+playbook: malware_hunt_and_contain
+how_to_implement: "Be sure to update asset naming to reflect the asset names configured in your environment."
+references: []
+app_list:
+- "LDAP"
+- "ServiceNow"
+- "CarbonBlack Response"
+- "VirusTotal"
+tags:
+ platform_tags:
+ - Response
+ playbook_fields:
+ - fileHash
+ product:
+ - Splunk SOAR
\ No newline at end of file