{ "blockly": false, "blockly_xml": "", "category": "Dynamic Analysis", "coa": { "data": { "description": "Accepts a URL or File_Hash and does reputation analysis on the objects. Generates a global report and a per observable sub-report and normalized score. The score can be customized based on a variety of factors.\n\n", "edges": [ { "id": "port_0_to_port_2", "sourceNode": "0", "sourcePort": "0_out", "targetNode": "2", "targetPort": "2_in" }, { "conditions": [ { "index": 0 } ], "id": "port_2_to_port_3", "sourceNode": "2", "sourcePort": "2_out", "targetNode": "3", "targetPort": "3_in" }, { "id": "port_3_to_port_4", "sourceNode": "3", "sourcePort": "3_out", "targetNode": "4", "targetPort": "4_in" }, { "conditions": [ { "index": 0 } ], "id": "port_4_to_port_5", "sourceNode": "4", "sourcePort": "4_out", "targetNode": "5", "targetPort": "5_in" }, { "id": "port_5_to_port_6", "sourceNode": "5", "sourcePort": "5_out", "targetNode": "6", "targetPort": "6_in" }, { "id": "port_6_to_port_7", "sourceNode": "6", "sourcePort": "6_out", "targetNode": "7", "targetPort": "7_in" }, { "id": "port_7_to_port_1", "sourceNode": "7", "sourcePort": "7_out", "targetNode": "1", "targetPort": "1_in" }, { "conditions": [ { "index": 1 } ], "id": "port_2_to_port_8", "sourceNode": "2", "sourcePort": "2_out", "targetNode": "8", "targetPort": "8_in" }, { "id": "port_10_to_port_11", "sourceNode": "10", "sourcePort": "10_out", "targetNode": "11", "targetPort": "11_in" }, { "conditions": [ { "index": 0 } ], "id": "port_11_to_port_12", "sourceNode": "11", "sourcePort": "11_out", "targetNode": "12", "targetPort": "12_in" }, { "id": "port_12_to_port_14", "sourceNode": "12", "sourcePort": "12_out", "targetNode": "14", "targetPort": "14_in" }, { "id": "port_14_to_port_15", "sourceNode": "14", "sourcePort": "14_out", "targetNode": "15", "targetPort": "15_in" }, { "id": "port_15_to_port_1", "sourceNode": "15", "sourcePort": "15_out", "targetNode": "1", "targetPort": "1_in" }, { "id": "port_8_to_port_32", "sourceNode": "8", "sourcePort": "8_out", "targetNode": "32", "targetPort": "32_in" }, { "id": "port_32_to_port_35", "sourceNode": "32", "sourcePort": "32_out", "targetNode": "35", "targetPort": "35_in" }, { "conditions": [ { "index": 0 } ], "id": "port_35_to_port_10", "sourceNode": "35", "sourcePort": "35_out", "targetNode": "10", "targetPort": "10_in" } ], "globalCustomCode": "\n\n\nimport os", "hash": "f4a238d5963ad546bde73d3ec8b4283699f52a43", "nodes": { "0": { "data": { "advanced": { "join": [] }, "functionName": "on_start", "id": "0", "type": "start" }, "errors": {}, "id": "0", "type": "start", "warnings": {}, "x": 250, "y": -7.034373084024992e-13 }, "1": { "data": { "advanced": { "join": [] }, "functionName": "on_finish", "id": "1", "type": "end" }, "errors": {}, "id": "1", "type": "end", "userCode": "\n # Write your custom code here...\n\n", "warnings": {}, "x": 260, "y": 1920 }, "10": { "data": { "action": "detonate file", "actionType": "generic", "advanced": { "customName": "file detonation", "customNameId": 0, "description": "Queries CrowdStrike for information about the provided vault_id(s)", "join": [], "note": "Queries CrowdStrike for information about the provided vault_id(s)" }, "connector": "CrowdStrike OAuth API", "connectorConfigs": [ "crowdstrike" ], "connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232", "connectorVersion": "v1", "customDatapaths": { "list_demux": { "data.output.sandbox_type": { "contains": [], "isCustomDatapath": true, "isDatapathArray": true, "label": "data.output.sandbox_type", "value": "list_demux:custom_function_result.data.output.sandbox_type" }, "data.output.value": { "contains": [], "isCustomDatapath": true, "isDatapathArray": true, "label": "data.output.value", "value": "list_demux:custom_function_result.data.output.value" } } }, "functionId": 1, "functionName": "file_detonation", "id": "10", "parameters": { "environment": "list_demux:custom_function_result.data.output.sandbox_type", "is_confidential": true, "limit": 50, "vault_id": "list_demux:custom_function_result.data.output.value" }, "requiredParameters": [ { "data_type": "numeric", "default": 50, "field": "limit" }, { "data_type": "string", "field": "vault_id" }, { "data_type": "string", "field": "environment" }, { "data_type": "boolean", "default": true, "field": "is_confidential" } ], "type": "action" }, "errors": {}, "id": "10", "type": "action", "userCode": "\n # Write your custom code here...\n", "warnings": {}, "x": 0, "y": 1000 }, "11": { "data": { "advanced": { "customName": "sandbox filter", "customNameId": 0, "description": "Filters successful file detonation results.", "join": [], "note": "Filters successful file detonation results." }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": "==", "param": "file_detonation:action_result.status", "value": "success" } ], "conditionIndex": 0, "customName": "sandbox_status_filter", "logic": "and" } ], "functionId": 4, "functionName": "sandbox_filter", "id": "11", "type": "filter" }, "errors": {}, "id": "11", "type": "filter", "warnings": {}, "x": 60, "y": 1192 }, "12": { "data": { "advanced": { "customName": "normalized file detonation output", "customNameId": 0, "description": "This block uses custom code for normalizing score. Adjust the logic as desired in the documented sections.", "join": [], "note": "This block uses custom code for normalizing score. Adjust the logic as desired in the documented sections." }, "functionId": 4, "functionName": "normalized_file_detonation_output", "id": "12", "inputParameters": [ "filtered-data:sandbox_filter:condition_1:file_detonation:action_result.parameter.vault_id", "filtered-data:sandbox_filter:condition_1:file_detonation:action_result.data.*.verdict", "filtered-data:sandbox_filter:condition_1:file_detonation:action_result.data.*.sandbox.*.threat_score", "filtered-data:sandbox_filter:condition_1:file_detonation:action_result.data.*.sandbox.*.signatures.*.category", "filtered-data:sandbox_filter:condition_1:file_detonation:action_result.data.*.sandbox.*.verdict" ], "outputVariables": [ "file_score_object", "scores", "categories", "score_id" ], "type": "code" }, "errors": {}, "id": "12", "type": "code", "userCode": "\n # Write your custom code here...\n normalized_file_detonation_output__file_score_object = []\n normalized_file_detonation_output__scores = []\n normalized_file_detonation_output__categories = []\n normalized_file_detonation_output__score_id = []\n ## normalized NoneType value to avoid enumeration failure\n file_detonation_param_list = [(i or \"\") for i in filtered_result_0_parameter_vault_id] \n file_detonation_threat_score_list = [(i or \"\") for i in filtered_result_0_data___sandbox___threat_score] \n file_detonation_category_list = [(i or \"\") for i in filtered_result_0_data___sandbox___signatures___category] \n file_detonation_verdict_list = [(i or \"\") for i in filtered_result_0_data___sandbox___verdict] \n \n score_table = {\n \"0\":\"Unknown\",\n \"1\":\"Very_Safe\",\n \"2\":\"Safe\",\n \"3\":\"Probably_Safe\",\n \"4\":\"Leans_Safe\",\n \"5\":\"May_not_be_Safe\",\n \"6\":\"Exercise_Caution\",\n \"7\":\"Suspicious_or_Risky\",\n \"8\":\"Possibly_Malicious\",\n \"9\":\"Probably_Malicious\",\n \"10\":\"Malicious\"\n }\n \n ## get the set() or unique input vault id parameter.\n \n index_file_dict = {}\n set_vault_id_inputs = set(file_detonation_param_list)\n \n for vault_id_input in set_vault_id_inputs:\n ## crowdstrike detonation can have a multiple phase of score, verdict and category during detonation. we will try to get all the unique values of each\n ## object filed we want to include in report. \n \n file_list = []\n score_list = []\n verdict_list = []\n category_list = []\n \n ## getting the index of each detonation phase of the url/file. group the result for each detonation\n vault_id_input_index = [indx for indx, vault_id_val in enumerate(file_detonation_param_list) if vault_id_val == vault_id_input]\n index_file_dict[vault_id_input] = vault_id_input_index\n #phantom.debug(\"vault_id: {} vault_id_list: {}\".format(vault_id_input, index_file_dict))\n \n for idx,(_vault_id, _score, _verdict, _category) in enumerate(zip(file_detonation_param_list, file_detonation_verdict_list, file_detonation_threat_score_list, file_detonation_category_list)):\n if _vault_id == vault_id_input and idx in index_file_dict[vault_id_input]:\n file_list.append(_vault_id)\n score_list.append(_score)\n verdict_list.append(_verdict)\n category_list.append(_category)\n \n # Attach final object\n score_id = round(list(set(verdict_list))[0] / 10)\n score = score_table[str(score_id)]\n \n normalized_file_detonation_output__file_score_object.append({'score': score, 'score_id': score_id,'confidence': list(set(score_list))[0], 'categories': list(set(category_list))})\n normalized_file_detonation_output__scores.append(score)\n normalized_file_detonation_output__categories.append(list(set(category_list)))\n normalized_file_detonation_output__score_id.append(score_id)\n #phantom.debug(\"normalized_file_detonation_output__file_score_object: {}\".format(normalized_file_detonation_output__file_score_object))\n #phantom.debug(\"normalized_file_detonation_output__scores: {}\".format(normalized_file_detonation_output__scores))\n #phantom.debug(\"normalized_file_detonation_output__categories: {}\".format(normalized_file_detonation_output__categories))\n", "warnings": {}, "x": 0, "y": 1380 }, "14": { "data": { "advanced": { "customName": "format report file", "customNameId": 0, "description": "Format a summary table with the information gathered from the playbook.", "join": [], "note": "Format a summary table with the information gathered from the playbook." }, "functionId": 2, "functionName": "format_report_file", "id": "14", "parameters": [ "filtered-data:sandbox_filter:condition_1:file_detonation:action_result.parameter.vault_id", "normalized_file_detonation_output:custom_function:scores", "normalized_file_detonation_output:custom_function:score_id", "normalized_file_detonation_output:custom_function:categories", "filtered-data:windows_sandbox_filter:condition_1:windows_file_detonation:action_result.data.*.id" ], "template": "SOAR analyzed File(s) using CrowdStrike. The table below shows a summary of the information gathered.\n\n| vault_id | Normalized Score | score id |Categories | Report Link | Source |\n| --- | --- | --- | --- | --- | --- |\n%%\n| `{0}` | {1} | {2} | {3} |https://falcon.crowdstrike.com/intelligence/sandbox/reports/{4} | CrowdStrike OAuth API |\n%%\n\n\n", "type": "format" }, "errors": {}, "id": "14", "type": "format", "userCode": "\n # Write your custom code here...\n #phantom.debug(phantom.format(container=container, template=template, parameters=parameters, name=\"format_report_win_file\"))\n", "warnings": { "config": [ "Reconfigure invalid datapath." ] }, "x": 0, "y": 1560 }, "15": { "data": { "advanced": { "customName": "build file output", "customNameId": 0, "description": "This block uses custom code to generate an observable dictionary to output into the observables data path.", "join": [], "note": "This block uses custom code to generate an observable dictionary to output into the observables data path." }, "functionId": 5, "functionName": "build_file_output", "id": "15", "inputParameters": [ "playbook_input:vault_id", "filtered-data:sandbox_filter:condition_1:file_detonation:action_result.data.*.id", "normalized_file_detonation_output:custom_function:file_score_object" ], "outputVariables": [ "observable_array" ], "type": "code" }, "errors": {}, "id": "15", "type": "code", "userCode": "\n # Write your custom code here...\n build_file_output__observable_array = []\n for _vault_id, external_id, file_object in zip(playbook_input_vault_id_values, filtered_result_0_data___id, normalized_file_detonation_output__file_score_object):\n observable_object = {\n \n \"value\": _vault_id,\n \"type\": \"hash\",\n \"reputation\": {\n \"score\": file_object['score'],\n \"score_id\": file_object['score_id'],\n \"confidence\": file_object['confidence'],\n \"categories\": file_object['categories']\n },\n \"enrichment\": {\n \"provider\": \"CrowdStrike OAuth API\",\n \"type\": \"file\",\n \n },\n \"source\": \"CrowdStrike OAuth API\",\n \"source_link\":f\"https://falcon.crowdstrike.com/intelligence/sandbox/reports/{external_id}\"\n }\n build_file_output__observable_array.append(observable_object)\n #phantom.debug(\"build_file_output__observable_array: {}\".format(build_file_output__observable_array))\n", "warnings": { "config": [ "Reconfigure invalid datapath." ] }, "x": 0, "y": 1740 }, "2": { "data": { "advanced": { "customName": "input filter", "customNameId": 0, "description": "Determine branches based on provided inputs.", "join": [], "note": "Determine branches based on provided inputs." }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": "!=", "param": "playbook_input:url", "value": "" } ], "conditionIndex": 0, "customName": "url_input", "logic": "and" }, { "comparisons": [ { "conditionIndex": 1, "op": "!=", "param": "playbook_input:vault_id", "value": "" } ], "conditionIndex": 1, "customName": "vault_id_input", "logic": "and" } ], "functionId": 1, "functionName": "input_filter", "id": "2", "type": "filter" }, "errors": {}, "id": "2", "type": "filter", "warnings": {}, "x": 290, "y": 148 }, "3": { "data": { "action": "detonate url", "actionType": "generic", "advanced": { "customName": "url detonation", "customNameId": 0, "description": "Queries CrowdStrike for information about the provided URL(s)", "join": [], "note": "Queries CrowdStrike for information about the provided URL(s)" }, "connector": "CrowdStrike OAuth API", "connectorConfigs": [ "crowdstrike" ], "connectorId": "ae971ba5-3117-444a-8ac5-6ce779f3a232", "connectorVersion": "v1", "functionId": 1, "functionName": "url_detonation", "id": "3", "parameters": { "environment": "Windows 7, 64-bit", "limit": 50, "url": "playbook_input:url" }, "requiredParameters": [ { "data_type": "string", "field": "url" }, { "data_type": "numeric", "default": 50, "field": "limit" }, { "data_type": "string", "field": "environment" } ], "type": "action" }, "errors": {}, "id": "3", "type": "action", "warnings": { "config": [ "Reconfigure invalid datapath." ] }, "x": 460, "y": 1000 }, "32": { "data": { "advanced": { "customName": "list demux", "customNameId": 0, "description": "A utility to create a dictionary contains the vault id and sandbox name type that will be used to distinguish sandboxes to be executed depending on the basic file type checking of vault id.", "join": [], "note": "A utility to create a dictionary contains the vault id and sandbox name type that will be used to distinguish sandboxes to be executed depending on the basic file type checking of vault id." }, "customFunction": { "draftMode": false, "name": "list_demux", "repoName": "community" }, "functionId": 1, "functionName": "list_demux", "id": "32", "selectMore": false, "type": "utility", "utilities": { "list_demux": { "description": "Accepts a single list and converts it into multiple custom function output results. All output will be placed in the \"output\" datapath. Sub-items and sub-item variable names are dependent on the input.", "fields": [ { "dataTypes": [ "*" ], "description": "A list of objects. Nested lists are not unpacked.", "inputType": "item", "label": "input_list", "name": "input_list", "placeholder": "[\"list_item_1\", \"list_item_2\", \"list_item_3\"]", "renderType": "datapath", "required": false } ], "label": "list_demux", "name": "list_demux" } }, "utilityType": "custom_function", "values": { "list_demux": { "input_list": "get_vault_id_information:custom_function:sandbox_type" } } }, "errors": {}, "id": "32", "type": "utility", "warnings": {}, "x": 140, "y": 520 }, "35": { "data": { "advanced": { "customName": "list demux filter", "customNameId": 0, "description": "filter check if list demux output exist.", "join": [], "note": "filter check if list demux output exist." }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": "==", "param": "list_demux:custom_function_result.success", "value": "True" }, { "conditionIndex": 0, "op": "!=", "param": "list_demux:custom_function_result.message", "value": "\"Timed out while waiting for the result\"" } ], "conditionIndex": 0, "customName": "sandbox_type_exist", "logic": "and" } ], "functionId": 8, "functionName": "list_demux_filter", "id": "35", "type": "filter" }, "errors": {}, "id": "35", "type": "filter", "warnings": {}, "x": 60, "y": 680 }, "4": { "data": { "advanced": { "customName": "url detonation filter", "customNameId": 0, "description": "Filters successful url detonation results.", "join": [], "note": "Filters successful url detonation results." }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": "==", "param": "url_detonation:action_result.status", "value": "success" } ], "conditionIndex": 0, "customName": "url_detonation_success", "logic": "and" } ], "functionId": 2, "functionName": "url_detonation_filter", "id": "4", "type": "filter" }, "errors": {}, "id": "4", "type": "filter", "warnings": {}, "x": 520, "y": 1192 }, "5": { "customCode": null, "data": { "advanced": { "customName": "normalized url detonation output", "customNameId": 0, "description": "This block uses custom code for normalizing score. Adjust the logic as desired in the documented sections.", "join": [], "note": "This block uses custom code for normalizing score. Adjust the logic as desired in the documented sections." }, "functionId": 1, "functionName": "normalized_url_detonation_output", "id": "5", "inputParameters": [ "filtered-data:url_detonation_filter:condition_1:crowdstrike_url_detonation:action_result.parameter.url", "filtered-data:url_detonation_filter:condition_1:crowdstrike_url_detonation:action_result.data.*.verdict", "filtered-data:url_detonation_filter:condition_1:crowdstrike_url_detonation:action_result.data.*.sandbox.*.threat_score", "filtered-data:url_detonation_filter:condition_1:crowdstrike_url_detonation:action_result.data.*.sandbox.*.signatures.*.category", "filtered-data:url_detonation_filter:condition_1:crowdstrike_url_detonation:action_result.data.*.sandbox.*.verdict" ], "outputVariables": [ "url_score_object", "scores", "categories", "score_id" ], "type": "code" }, "errors": {}, "id": "5", "type": "code", "userCode": "\n # Write your custom code here...\n #phantom.debug(\"filtered_result_0_parameter_url: {}\".format(filtered_result_0_parameter_url))\n #phantom.debug(\"filtered_result_0_data: {}\".format(filtered_result_0_data)) \n #phantom.debug(\"filtered_result_0_data___verdict: {}\".format(filtered_result_0_data___verdict))\n #phantom.debug(\"filtered_result_0_data___sandbox___threat_score: {}\".format(filtered_result_0_data___sandbox___threat_score))\n #phantom.debug(\"filtered_result_0_data___sandbox___signatures___category: {}\".format(filtered_result_0_data___sandbox___signatures___category))\n #phantom.debug(\"filtered_result_0_summary_verdict: {}\".format(filtered_result_0_summary_verdict))\n #phantom.debug(\"filtered_result_0_data___sandbox___verdict: {}\".format(filtered_result_0_data___sandbox___verdict))\n #phantom.debug(\"crowdstrike_url_detonation_result_data: {}\".format(crowdstrike_url_detonation_result_data)) \n \n ## define variables for easy code debugging\n \n normalized_url_detonation_output__url_score_object = []\n normalized_url_detonation_output__scores = []\n normalized_url_detonation_output__categories = []\n normalized_url_detonation_output__score_id = []\n \n url_detonation_param_list = [(i or \"\") for i in filtered_result_0_parameter_url] \n url_detonation_verdict_list = [(i or \"\") for i in filtered_result_0_data___sandbox___verdict] \n url_detonation_threat_score_list = [(i or \"\") for i in filtered_result_0_data___sandbox___threat_score] \n url_detonation_category_list = [(i or \"\") for i in filtered_result_0_data___sandbox___signatures___category] \n\n score_table = {\n \"0\":\"Unknown\",\n \"1\":\"Very_Safe\",\n \"2\":\"Safe\",\n \"3\":\"Probably_Safe\",\n \"4\":\"Leans_Safe\",\n \"5\":\"May_not_be_Safe\",\n \"6\":\"Exercise_Caution\",\n \"7\":\"Suspicious_or_Risky\",\n \"8\":\"Possibly_Malicious\",\n \"9\":\"Probably_Malicious\",\n \"10\":\"Malicious\"\n }\n ## get the set() or unique input url parameter.\n \n index_url_dict = {}\n set_url_inputs = set(url_detonation_param_list)\n \n \n for url_input in set_url_inputs:\n url_list = []\n score_list = []\n verdict_list = []\n category_list = []\n \n ## getting the index of each detonation phase of the url group the result for each url detonation\n url_input_index = [indx for indx, url_val in enumerate(url_detonation_param_list) if url_val == url_input]\n index_url_dict[url_input] = url_input_index\n \n for idx,(_url, _score, _verdict, _category) in enumerate(zip(url_detonation_param_list, url_detonation_verdict_list, url_detonation_threat_score_list, url_detonation_category_list)):\n if _url == url_input and idx in index_url_dict[url_input]:\n url_list.append(_url)\n score_list.append(_score)\n verdict_list.append(_verdict)\n category_list.append(_category)\n \n score_id = round(list(set(verdict_list))[0] / 10)\n score = score_table[str(score_id)]\n \n # Attach final object\n normalized_url_detonation_output__url_score_object.append({'score': score, 'score_id': score_id,'confidence': list(set(score_list))[0], 'categories': list(set(category_list))})\n normalized_url_detonation_output__scores.append(score)\n normalized_url_detonation_output__categories.append(list(set(category_list)))\n normalized_url_detonation_output__score_id.append(score_id)\n #phantom.debug(\"normalized_url_detonation_output__url_score_object: {}\".format(normalized_url_detonation_output__url_score_object))\n #phantom.debug(\"normalized_url_detonation_output__scores: {}\".format(normalized_url_detonation_output__scores))\n #phantom.debug(\"normalized_url_detonation_output__categories: {}\".format(normalized_url_detonation_output__categories))\n \n \n", "warnings": {}, "x": 460, "y": 1380 }, "6": { "data": { "advanced": { "customName": "format report url", "customNameId": 0, "description": "Format a summary table with the information gathered from the playbook.", "join": [], "note": "Format a summary table with the information gathered from the playbook." }, "functionId": 1, "functionName": "format_report_url", "id": "6", "parameters": [ "playbook_input:url", "normalized_url_detonation_output:custom_function:scores", "normalized_url_detonation_output:custom_function:score_id", "normalized_url_detonation_output:custom_function:categories", "url_detonation:action_result.data.*.id" ], "template": "SOAR analyzed URL(s) or File using Crowdstrike. The table below shows a summary of the information gathered.\n\n| URL | Normalized Score | score id |Categories | Report Link | Source |\n| --- | --- | --- | --- | --- | --- |\n%%\n| `{0}` | {1} | {2} | {3} |https://falcon.crowdstrike.com/intelligence/sandbox/reports/{4} | CrowdStrike OAuth API |\n%%\n\n", "type": "format" }, "errors": {}, "id": "6", "type": "format", "userCode": "\n # Write your custom code here...\n #phantom.debug(phantom.format(container=container, template=template, parameters=parameters, name=\"format_report_url\"))\n", "warnings": { "config": [ "Reconfigure invalid datapath." ] }, "x": 460, "y": 1560 }, "7": { "data": { "advanced": { "customName": "build url output", "customNameId": 0, "description": "This block uses custom code to generate an observable dictionary to output into the observables data path.", "join": [], "note": "This block uses custom code to generate an observable dictionary to output into the observables data path." }, "functionId": 2, "functionName": "build_url_output", "id": "7", "inputParameters": [ "playbook_input:url", "url_detonation:action_result.data.*.id", "normalized_url_detonation_output:custom_function:url_score_object" ], "outputVariables": [ "observable_array" ], "type": "code" }, "errors": {}, "id": "7", "type": "code", "userCode": "\n # Write your custom code here...\n# Write your custom code here...\n from urllib.parse import urlparse\n build_url_output__observable_array = []\n \n # Build URL\n for url, external_id, url_object in zip(playbook_input_url_values, url_detonation_result_item_0, normalized_url_detonation_output__url_score_object):\n parsed_url = urlparse(url)\n phantom.debug(\"parsed_url: {}, url_object: {}\".format(parsed_url, url_object))\n observable_object = {\n \"value\": url,\n \"type\": \"url\",\n \"reputation\": {\n \"score\": url_object['score'],\n \"score_id\": url_object['score_id'],\n \"confidence\": url_object['confidence'],\n \"categories\": url_object['categories']\n },\n \"attributes\": {\n \"hostname\": parsed_url.hostname,\n \"scheme\": parsed_url.scheme\n },\n \n \"source\": \"CrowdStrike OAuth API\",\n \"source_link\": f\"https://falcon.crowdstrike.com/intelligence/sandbox/reports/{external_id}\"\n }\n \n if parsed_url.path:\n observable_object['attributes']['path'] = parsed_url.path\n if parsed_url.query:\n observable_object['attributes']['query'] = parsed_url.query\n if parsed_url.port:\n observable_object['attributes']['port'] = parsed_url.port\n \n build_url_output__observable_array.append(observable_object)\n #phantom.debug(\"build_url_output__observable_array: {}\".format(build_url_output__observable_array))\n", "warnings": { "config": [ "Reconfigure invalid datapath." ] }, "x": 460, "y": 1740 }, "8": { "data": { "advanced": { "customName": "get vault_id information", "customNameId": 0, "description": "This block uses custom code for retrieving metadata of vault id that will distinguish what sandbox will be executed.", "join": [], "note": "This block uses custom code for retrieving metadata of vault id that will distinguish what sandbox will be executed." }, "functionId": 3, "functionName": "get_vault_id_information", "id": "8", "inputParameters": [ "playbook_input:vault_id" ], "outputVariables": [ "sandbox_type" ], "type": "code" }, "errors": {}, "id": "8", "type": "code", "userCode": "\n # Write your custom code here...\n get_vault_id_information__sandbox_type = []\n \n for vault_id_value in playbook_input_vault_id_values:\n success, msg, vault_info = phantom.vault_info(vault_id=vault_id_value, file_name=None, container_id=None, trace=False)\n phantom.debug(\"vault_info: {}, success: {}, msg: {}\".format(vault_info, success, msg))\n\n if success == True:\n detonation_file_name = vault_info[0]['name']\n detonation_mime_type = vault_info[0]['mime_type']\n detonation_meta_data = vault_info[0]['contains']\n \n file_name, file_ext = os.path.splitext(detonation_file_name)\n \n if file_ext == \".exe\" or file_ext == \".dll\" or file_ext == \".sys\" or \"pe file\" in detonation_meta_data or \"dosexec\" in detonation_mime_type:\n #get_vault_id_information__sandbox_type.append({vault_id_value: \"Windows 10, 64-bit\"})\n get_vault_id_information__sandbox_type.append({\"value\": vault_id_value, \"sandbox_type\": \"Windows 10, 64-bit\"})\n \n elif file_ext == \".dmg\":\n #get_vault_id_information__sandbox_type.append({vault_id_value: \"Linux Ubuntu 16.04, 64-bit\"})\n get_vault_id_information__sandbox_type.append({\"value\": vault_id_value, \"sandbox_type\": \"Linux Ubuntu 16.04, 64-bit\"})\n \n elif file_ext == \".apk\" and \"application/zip\" in detonation_mime_type:\n #get_vault_id_information__sandbox_type.append({vault_id_value: \"Android (static analysis)\"})\n get_vault_id_information__sandbox_type.append({\"value\": vault_id_value, \"sandbox_type\": \"Android (static analysis)\"})\n \n elif \"x-executable\" in detonation_mime_type:\n #get_vault_id_information__sandbox_type.append({vault_id_value: \"Linux Ubuntu 16.04, 64-bit\"})\n get_vault_id_information__sandbox_type.append({\"value\": vault_id_value, \"sandbox_type\":\"Linux Ubuntu 16.04, 64-bit\"})\n \n else:\n #get_vault_id_information__sandbox_type.append({vault_id_value: \"Windows 10, 64-bit\"})\n get_vault_id_information__sandbox_type.append({\"value\": vault_id_value, \"sandbox_type\": \"Windows 10, 64-bit\"})\n \n\n phantom.debug(\"vaultd_id: {} get_vault_id_information__sandbox_type: {}\".format(vault_id_value, get_vault_id_information__sandbox_type))\n\n", "warnings": {}, "x": 140, "y": 320 } }, "notes": "Inputs: url, vault_id\nInteractions: Crowdstrike\nActions: url detonation, , file detonation\nOutputs: report, observables" }, "input_spec": [ { "contains": [ "url" ], "description": "A URL provided for reputation analysis - crowdstrike", "name": "url" }, { "contains": [ "vault id" ], "description": "A vault_id provided for reputation analysis - crowdstrike", "name": "vault_id" } ], "output_spec": [ { "contains": [], "datapaths": [ "build_file_output:custom_function:observable_array", "build_url_output:custom_function:observable_array" ], "deduplicate": false, "description": "An array of observable dictionaries with value, type, score, score_id, and categories.", "metadata": {}, "name": "observable" }, { "contains": [], "datapaths": [ "format_report_url:formatted_data", "format_report_file:formatted_data" ], "deduplicate": false, "description": "a report with value, score, confidence, and categories.", "metadata": {}, "name": "report" } ], "playbook_type": "data", "python_version": "3.13", "schema": "5.0.9", "version": "6.0.0.114895" }, "create_time": "2023-04-13T14:17:13.149883+00:00", "draft_mode": false, "labels": [ "*" ], "tags": [ "url", "sandbox", "CrowdStrike_OAuth_API", "vault_id", "D3-DA" ] }