{ "blockly": false, "blockly_xml": "", "category": "Use Cases", "coa": { "data": { "clean": true, "code_block": "", "description": "This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal \"file reputation\" and PAN WildFire \"detonate file\" are used to determine if a file is malware, and CarbonBlack Response \"hunt file\" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team.", "hash": "cd4b30ce1b1555275490936455ad489a860c1c98", "joint": { "cells": [ { "attrs": { ".connection": { "stroke": "#6C7A89", "stroke-width": 2 }, ".marker-target": { "d": "M 10 0 L 0 5 L 10 10 z", "fill": "#6a6c8a", "stroke": "#6a6c8a" } }, "connector": { "args": { "radius": 5 }, "name": "rounded" }, "endDirections": [ "left" ], "id": "b019e440-ef29-4772-bda2-a9386a65fccb", "router": { "name": "metro" }, "source": { "id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899", "port": "out-1", "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" }, "startDirections": [ "right" ], "target": { "id": "f86960a4-1d0d-4f37-924c-8640149388a8", "selector": ".port-body[type=\"input\"]" }, "type": "link", "z": 32 }, { "attrs": { ".connection": { "stroke": "#6C7A89", "stroke-width": 2 }, ".marker-target": { "d": "M 10 0 L 0 5 L 10 10 z", "fill": "#6a6c8a", "stroke": "#6a6c8a" } }, "connector": { "args": { "radius": 5 }, "name": "rounded" }, "endDirections": [ "left" ], "id": "eaa4fc01-be31-4366-b66d-7aaaa8cd5967", "router": { "name": "metro" }, "source": { "id": "12461935-1aee-4aec-878c-0e2fb1742912", "port": null, "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" }, "startDirections": [ "right" ], "target": { "id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb", "selector": ".port-body[type=\"input\"]" }, "type": "link", "z": 171 }, { "attrs": { ".connection": { "stroke": "#6C7A89", "stroke-width": 2 }, ".marker-target": { "d": "M 10 0 L 0 5 L 10 10 z", "fill": "#6a6c8a", "stroke": "#6a6c8a" } }, "connector": { "args": { "radius": 5 }, "name": "rounded" }, "endDirections": [ "left" ], "id": "74fcb7c5-ea09-4556-90ce-c60cf8681d04", "router": { "name": "metro" }, "source": { "id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb", "port": null, "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" }, "startDirections": [ "right" ], "target": { "id": "cff987f2-2566-44d5-a694-26087dc2a0a2", "port": null, "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" }, "type": "link", "z": 767 }, { "0": "S", "1": "T", "2": "A", "3": "R", "4": "T", "active": false, "angle": 0, "attrs": { ".background": { "fill": "#000000", "stroke": "#5C6773" }, ".color-band": { "fill": "#3C444D" }, ".outPorts>.port-out": { "ref": ".background", "ref-x": 0.5 }, ".outPorts>.port-out>.port-body": { "port": { "id": "out", "type": "out" } }, ".title": { "ref-x": 33, "ref-y": 8, "text": "START" }, "g.delete": { "display": "none" }, "g.error": { "opacity": 0 }, "g.icon image": { "ref-x": 13, "xlink:href": "/inc/coa/img/block_icon_start.svg" }, "g.notes": { "display": "block" } }, "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'filter_1' block\n filter_1(container=container)\n\n return", "callback_code": "# read-only block view not available", "callback_start": 1, "callsback": false, "connected_to_start": true, "connection_name": "", "connection_type": "", "custom_callback": "", "custom_code": "", "custom_join": "", "custom_name": "", "description": "", "has_custom": false, "has_custom_block": false, "has_custom_callback": false, "has_custom_join": false, "id": "4f900fb0-068e-4214-8caa-1b065f7f9bfa", "inPorts": [], "join_code": "# read-only block view not available", "join_optional": [], "join_start": 1, "line_end": 16, "line_start": 8, "name": "", "notes": "", "number": 0, "order": 1, "outPorts": [ "out" ], "ports": { "groups": { "in": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "left" } }, "position": { "name": "left" } }, "out": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "right" } }, "position": { "name": "right" } } } }, "position": { "x": -120, "y": 120 }, "previous_function": "", "previous_name": "", "show_number": true, "size": { "height": 54, "width": 80 }, "status": "", "title": "START", "type": "coa.StartEnd", "warn": false, "z": 1394 }, { "0": "E", "1": "N", "2": "D", "active": false, "angle": 0, "attrs": { ".background": { "fill": "#000000", "stroke": "#5C6773" }, ".color-band": { "fill": "#3C444D" }, ".inPorts>.port-in": { "ref": ".background", "ref-x": 0.5 }, ".inPorts>.port-in>.port-body": { "port": { "id": "in", "type": "in" } }, ".title": { "text": "END" }, "g.delete": { "display": "none" }, "g.error": { "opacity": 0 }, "g.icon image": { "xlink:href": "/inc/coa/img/block_icon_end.svg" }, "g.notes": { "display": "block" } }, "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return", "callback_code": "# read-only block view not available", "callback_start": 1, "callsback": false, "connected_to_start": true, "connection_name": "send email", "connection_type": "action", "custom_callback": "", "custom_code": "", "custom_join": "", "custom_name": "", "description": "", "has_custom": false, "has_custom_block": false, "has_custom_callback": false, "has_custom_join": false, "id": "cff987f2-2566-44d5-a694-26087dc2a0a2", "inPorts": [ "in" ], "join_code": "# read-only block view not available", "join_optional": [], "join_start": 1, "line_end": 338, "line_start": 325, "name": "", "notes": "", "number": 0, "order": 13, "outPorts": [], "ports": { "groups": { "in": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "left" } }, "position": { "name": "left" } }, "out": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "right" } }, "position": { "name": "right" } } } }, "position": { "x": 1880, "y": 120 }, "previous_function": "", "previous_name": "", "show_number": true, "size": { "height": 54, "width": 80 }, "status": "", "title": "END", "type": "coa.StartEnd", "warn": false, "z": 1571 }, { "attrs": { ".connection": { "stroke": "#6C7A89", "stroke-width": 2 }, ".marker-target": { "d": "M 10 0 L 0 5 L 10 10 z", "fill": "#6a6c8a", "stroke": "#6a6c8a" } }, "connector": { "args": { "radius": 5 }, "name": "rounded" }, "endDirections": [ "left" ], "id": "1af67ff6-453c-46aa-87e1-3731e1a659a5", "router": { "name": "metro" }, "source": { "id": "4f900fb0-068e-4214-8caa-1b065f7f9bfa", "port": null, "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" }, "startDirections": [ "right" ], "target": { "id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899", "port": "in", "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" }, "type": "link", "z": 1682 }, { "attrs": { ".connection": { "stroke": "#6C7A89", "stroke-width": 2 }, ".marker-target": { "d": "M 10 0 L 0 5 L 10 10 z", "fill": "#6a6c8a", "stroke": "#6a6c8a" } }, "connector": { "args": { "radius": 5 }, "name": "rounded" }, "endDirections": [ "left" ], "id": "d4f646d5-8ec0-41ef-8519-cd07b8de14f3", "router": { "name": "metro" }, "source": { "id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb", "port": "out-1", "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" }, "startDirections": [ "right" ], "target": { "id": "35f205e2-949e-463e-9057-658f597b1dc9", "port": null, "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" }, "type": "link", "z": 1834 }, { "attrs": { ".connection": { "stroke": "#6C7A89", "stroke-width": 2 }, ".marker-target": { "d": "M 10 0 L 0 5 L 10 10 z", "fill": "#6a6c8a", "stroke": "#6a6c8a" } }, "connector": { "args": { "radius": 5 }, "name": "rounded" }, "endDirections": [ "left" ], "id": "ef8c12b6-f42d-459c-a8b1-b04690b626ee", "router": { "name": "metro" }, "source": { "id": "f86960a4-1d0d-4f37-924c-8640149388a8", "port": null, "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" }, "startDirections": [ "right" ], "target": { "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b", "selector": ".port-body[type=\"input\"]" }, "type": "link", "z": 1951 }, { "attrs": { ".connection": { "stroke": "#6C7A89", "stroke-width": 2 }, ".marker-target": { "d": "M 10 0 L 0 5 L 10 10 z", "fill": "#6a6c8a", "stroke": "#6a6c8a" } }, "connector": { "args": { "radius": 5 }, "name": "rounded" }, "endDirections": [ "left" ], "id": "0b2d5872-1c82-438a-bf42-2ffefc4b4bb1", "router": { "name": "metro" }, "source": { "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b", "port": "out-1", "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" }, "startDirections": [ "right" ], "target": { "id": "214e20f6-a5fb-4409-b2f2-752d24605d9c", "port": null, "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" }, "type": "link", "z": 1954 }, { "attrs": { ".connection": { "stroke": "#6C7A89", "stroke-width": 2 }, ".marker-target": { "d": "M 10 0 L 0 5 L 10 10 z", "fill": "#6a6c8a", "stroke": "#6a6c8a" } }, "connector": { "args": { "radius": 5 }, "name": "rounded" }, "endDirections": [ "left" ], "id": "ca25cb81-1e40-4c53-a811-3fd0be926cca", "router": { "name": "metro" }, "source": { "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b", "port": "out-2", "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)" }, "startDirections": [ "right" ], "target": { "id": "34337267-8e89-4ddf-a601-9040234d2744", "selector": ".port-body[type=\"input\"]" }, "type": "link", "z": 1960 }, { "attrs": { ".connection": { "stroke": "#6C7A89", "stroke-width": 2 }, ".marker-target": { "d": "M 10 0 L 0 5 L 10 10 z", "fill": "#6a6c8a", "stroke": "#6a6c8a" } }, "connector": { "args": { "radius": 5 }, "name": "rounded" }, "endDirections": [ "left" ], "id": "d3d6a860-6f58-4b63-86d5-8c1a7da31e5a", "router": { "name": "metro" }, "source": { "id": "34337267-8e89-4ddf-a601-9040234d2744", "port": "out-1", "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" }, "startDirections": [ "right" ], "target": { "id": "bef1c9d9-aa68-4355-8ea3-66637924fc29", "selector": ".port-body[type=\"input\"]" }, "type": "link", "z": 1967 }, { "attrs": { ".connection": { "stroke": "#6C7A89", "stroke-width": 2 }, ".marker-target": { "d": "M 10 0 L 0 5 L 10 10 z", "fill": "#6a6c8a", "stroke": "#6a6c8a" } }, "connector": { "args": { "radius": 5 }, "name": "rounded" }, "endDirections": [ "left" ], "id": "50e35606-e056-445a-b71e-84a1d6026b43", "router": { "name": "metro" }, "source": { "id": "bef1c9d9-aa68-4355-8ea3-66637924fc29", "port": "out-1", "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" }, "startDirections": [ "right" ], "target": { "id": "12461935-1aee-4aec-878c-0e2fb1742912", "port": null, "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" }, "type": "link", "z": 1969 }, { "action": "file reputation", "action_type": "investigate", "active": false, "active_keys": {}, "active_values": { "hash": "filtered-data:initial_artifact_filter:condition_1:artifact:*.cef.fileHash" }, "angle": 0, "app": "", "approver": "", "assets": [ { "action": "", "active": true, "app_name": "VirusTotal", "app_version": "1.2.37", "appid": "", "config_type": "asset", "fields": { "hash": "filtered-data:filter_1:condition_1:artifact:*.cef.fileHash" }, "has_app": true, "id": "-", "loaded": false, "missing": false, "name": "virustotal", "output": [ { "data_path": "action_result.status", "data_type": "string", "example_values": [ "success" ] }, { "contains": [ "hash", "sha256", "sha1", "md5" ], "data_path": "action_result.parameter.hash", "data_type": "string", "example_values": [ "6c1948f7edf115cd1f13cd170b882077930be150" ] }, { "contains": [ "hash", "md5" ], "data_path": "action_result.data.*.md5", "data_type": "string", "example_values": [ "494303294715f5ffad7ad3f43b73b00b" ] }, { "contains": [ "url" ], "data_path": "action_result.data.*.permalink", "data_type": "string", "example_values": [ "https://www.test.com/file/27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7/analysis/1548112684/" ] }, { "data_path": "action_result.data.*.positives", "data_type": "numeric", "example_values": [ 64 ] }, { "contains": [ "sha1" ], "data_path": "action_result.data.*.resource", "data_type": "string", "example_values": [ "6c1948f7edf115cd1f13cd170b882077930be150" ] }, { "data_path": "action_result.data.*.response_code", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.scan_date", "data_type": "string", "example_values": [ "2019-01-21 23:18:04" ] }, { "contains": [ "virustotal scan id" ], "data_path": "action_result.data.*.scan_id", "data_type": "string", "example_values": [ "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7-1548112684" ] }, { "data_path": "action_result.data.*.scans.*.detected", "data_type": "boolean" }, { "data_path": "action_result.data.*.scans.*.result", "data_type": "string" }, { "data_path": "action_result.data.*.scans.*.update", "data_type": "string" }, { "data_path": "action_result.data.*.scans.*.version", "data_type": "string" }, { "data_path": "action_result.data.*.scans.ALYac.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.ALYac.result", "data_type": "string", "example_values": [ "Win32.Parite.B" ] }, { "data_path": "action_result.data.*.scans.ALYac.update", "data_type": "string", "example_values": [ "20190121" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.ALYac.version", "data_type": "string", "example_values": [ "1.1.1.5" ] }, { "data_path": "action_result.data.*.scans.AVG.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.AVG.result", "data_type": "string", "example_values": [ "Win32:Parite" ] }, { "data_path": "action_result.data.*.scans.AVG.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.AVG.version", "data_type": "string", "example_values": [ "18.4.3895.0" ] }, { "data_path": "action_result.data.*.scans.AVware.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.AVware.result", "data_type": "string", "example_values": [ "Win32.Parite.b (v)" ] }, { "data_path": "action_result.data.*.scans.AVware.update", "data_type": "string", "example_values": [ "20180925" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.AVware.version", "data_type": "string", "example_values": [ "1.6.0.52" ] }, { "data_path": "action_result.data.*.scans.Acronis.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Acronis.result", "data_type": "string", "example_values": [ "suspicious" ] }, { "data_path": "action_result.data.*.scans.Acronis.update", "data_type": "string", "example_values": [ "20190119" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.Acronis.version", "data_type": "string", "example_values": [ "1.0.1.37" ] }, { "data_path": "action_result.data.*.scans.Ad-Aware.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Ad-Aware.result", "data_type": "string", "example_values": [ "Win32.Parite.B" ] }, { "data_path": "action_result.data.*.scans.Ad-Aware.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.Ad-Aware.version", "data_type": "string", "example_values": [ "3.0.5.370" ] }, { "data_path": "action_result.data.*.scans.AegisLab.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.AegisLab.result", "data_type": "string" }, { "data_path": "action_result.data.*.scans.AegisLab.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.AegisLab.version", "data_type": "string", "example_values": [ "4.2" ] }, { "data_path": "action_result.data.*.scans.AhnLab-V3.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.AhnLab-V3.result", "data_type": "string", "example_values": [ "Win32/Parite" ] }, { "data_path": "action_result.data.*.scans.AhnLab-V3.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.AhnLab-V3.version", "data_type": "string", "example_values": [ "3.14.1.22785" ] }, { "data_path": "action_result.data.*.scans.Alibaba.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Alibaba.result", "data_type": "string" }, { "data_path": "action_result.data.*.scans.Alibaba.update", "data_type": "string", "example_values": [ "20180921" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.Alibaba.version", "data_type": "string", "example_values": [ "0.1.0.2" ] }, { "data_path": "action_result.data.*.scans.Antiy-AVL.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Antiy-AVL.result", "data_type": "string", "example_values": [ "Virus/Win32.Parite.c" ] }, { "data_path": "action_result.data.*.scans.Antiy-AVL.update", "data_type": "string", "example_values": [ "20190121" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.Antiy-AVL.version", "data_type": "string", "example_values": [ "3.0.0.1" ] }, { "data_path": "action_result.data.*.scans.Arcabit.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Arcabit.result", "data_type": "string", "example_values": [ "Win32.Parite.B" ] }, { "data_path": "action_result.data.*.scans.Arcabit.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.Arcabit.version", "data_type": "string", "example_values": [ "1.0.0.837" ] }, { "data_path": "action_result.data.*.scans.Avast-Mobile.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Avast-Mobile.result", "data_type": "string" }, { "data_path": "action_result.data.*.scans.Avast-Mobile.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.Avast-Mobile.version", "data_type": "string", "example_values": [ "190121-00" ] }, { "data_path": "action_result.data.*.scans.Avast.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Avast.result", "data_type": "string", "example_values": [ "Win32:Parite" ] }, { "data_path": "action_result.data.*.scans.Avast.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.Avast.version", "data_type": "string", "example_values": [ "18.4.3895.0" ] }, { "data_path": "action_result.data.*.scans.Avira.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Avira.result", "data_type": "string", "example_values": [ "W32/Parite" ] }, { "data_path": "action_result.data.*.scans.Avira.update", "data_type": "string", "example_values": [ "20190121" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.Avira.version", "data_type": "string", "example_values": [ "8.3.3.8" ] }, { "data_path": "action_result.data.*.scans.Babable.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Babable.result", "data_type": "string" }, { "data_path": "action_result.data.*.scans.Babable.update", "data_type": "string", "example_values": [ "20180918" ] }, { "data_path": "action_result.data.*.scans.Babable.version", "data_type": "string", "example_values": [ "9107201" ] }, { "data_path": "action_result.data.*.scans.Baidu.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Baidu.result", "data_type": "string", "example_values": [ "Win32.Virus.Parite.d" ] }, { "data_path": "action_result.data.*.scans.Baidu.update", "data_type": "string", "example_values": [ "20190121" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.Baidu.version", "data_type": "string", "example_values": [ "1.0.0.2" ] }, { "data_path": "action_result.data.*.scans.BitDefender.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.BitDefender.result", "data_type": "string", "example_values": [ "Win32.Parite.B" ] }, { "data_path": "action_result.data.*.scans.BitDefender.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.BitDefender.version", "data_type": "string", "example_values": [ "7.2" ] }, { "data_path": "action_result.data.*.scans.Bkav.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Bkav.result", "data_type": "string", "example_values": [ "W32.Pinfi.B" ] }, { "data_path": "action_result.data.*.scans.Bkav.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.Bkav.version", "data_type": "string", "example_values": [ "1.3.0.9899" ] }, { "data_path": "action_result.data.*.scans.CAT-QuickHeal.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.CAT-QuickHeal.result", "data_type": "string", "example_values": [ "W32.Perite.A" ] }, { "data_path": "action_result.data.*.scans.CAT-QuickHeal.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.CAT-QuickHeal.version", "data_type": "string", "example_values": [ "14.00" ] }, { "data_path": "action_result.data.*.scans.CMC.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.CMC.result", "data_type": "string", "example_values": [ "Virus.Win32.Parite.b!O" ] }, { "data_path": "action_result.data.*.scans.CMC.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.CMC.version", "data_type": "string", "example_values": [ "1.1.0.977" ] }, { "data_path": "action_result.data.*.scans.ClamAV.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.ClamAV.result", "data_type": "string", "example_values": [ "Heuristics.W32.Parite.B" ] }, { "data_path": "action_result.data.*.scans.ClamAV.update", "data_type": "string", "example_values": [ "20190121" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.ClamAV.version", "data_type": "string", "example_values": [ "0.101.1.0" ] }, { "data_path": "action_result.data.*.scans.Comodo.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Comodo.result", "data_type": "string", "example_values": [ "Malware@#1b1651nqd7ivb" ] }, { "data_path": "action_result.data.*.scans.Comodo.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.Comodo.version", "data_type": "string", "example_values": [ "30310" ] }, { "data_path": "action_result.data.*.scans.CrowdStrike.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.CrowdStrike.result", "data_type": "string", "example_values": [ "malicious_confidence_100% (W)" ] }, { "data_path": "action_result.data.*.scans.CrowdStrike.update", "data_type": "string", "example_values": [ "20181023" ] }, { "data_path": "action_result.data.*.scans.CrowdStrike.version", "data_type": "string", "example_values": [ "1.0" ] }, { "data_path": "action_result.data.*.scans.Cybereason.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Cybereason.result", "data_type": "string", "example_values": [ "malicious.94715f" ] }, { "data_path": "action_result.data.*.scans.Cybereason.update", "data_type": "string", "example_values": [ "20190109" ] }, { "data_path": "action_result.data.*.scans.Cybereason.version", "data_type": "string", "example_values": [ "1.2.27" ] }, { "data_path": "action_result.data.*.scans.Cylance.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Cylance.result", "data_type": "string", "example_values": [ "Unsafe" ] }, { "data_path": "action_result.data.*.scans.Cylance.update", "data_type": "string", "example_values": [ "20190122" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.Cylance.version", "data_type": "string", "example_values": [ "2.3.1.101" ] }, { "data_path": "action_result.data.*.scans.Cyren.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Cyren.result", "data_type": "string", "example_values": [ "W32/Virut.E.gen!Eldorado" ] }, { "data_path": "action_result.data.*.scans.Cyren.update", "data_type": "string", "example_values": [ "20190121" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.Cyren.version", "data_type": "string", "example_values": [ "6.2.0.1" ] }, { "data_path": "action_result.data.*.scans.DrWeb.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.DrWeb.result", "data_type": "string", "example_values": [ "Trojan.DownLoader20.25948" ] }, { "data_path": "action_result.data.*.scans.DrWeb.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.DrWeb.version", "data_type": "string", "example_values": [ "7.0.34.11020" ] }, { "data_path": "action_result.data.*.scans.ESET-NOD32.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.ESET-NOD32.result", "data_type": "string", "example_values": [ "Win32/Parite.B" ] }, { "data_path": "action_result.data.*.scans.ESET-NOD32.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.ESET-NOD32.version", "data_type": "string", "example_values": [ "18744" ] }, { "data_path": "action_result.data.*.scans.Emsisoft.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Emsisoft.result", "data_type": "string", "example_values": [ "Win32.Parite.B (B)" ] }, { "data_path": "action_result.data.*.scans.Emsisoft.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.Emsisoft.version", "data_type": "string", "example_values": [ "2018.4.0.1029" ] }, { "data_path": "action_result.data.*.scans.Endgame.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Endgame.result", "data_type": "string", "example_values": [ "malicious (high confidence)" ] }, { "data_path": "action_result.data.*.scans.Endgame.update", "data_type": "string", "example_values": [ "20181108" ] }, { "data_path": "action_result.data.*.scans.Endgame.version", "data_type": "string", "example_values": [ "3.0.2" ] }, { "data_path": "action_result.data.*.scans.F-Prot.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.F-Prot.result", "data_type": "string", "example_values": [ "W32/Virut.E.gen!Eldorado" ] }, { "data_path": "action_result.data.*.scans.F-Prot.update", "data_type": "string", "example_values": [ "20190121" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.F-Prot.version", "data_type": "string", "example_values": [ "4.7.1.166" ] }, { "data_path": "action_result.data.*.scans.F-Secure.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.F-Secure.result", "data_type": "string", "example_values": [ "Win32.Parite.B" ] }, { "data_path": "action_result.data.*.scans.F-Secure.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.F-Secure.version", "data_type": "string", "example_values": [ "11.0.19100.45" ] }, { "data_path": "action_result.data.*.scans.Fortinet.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Fortinet.result", "data_type": "string", "example_values": [ "W32/Parite.B" ] }, { "data_path": "action_result.data.*.scans.Fortinet.update", "data_type": "string", "example_values": [ "20190121" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.Fortinet.version", "data_type": "string", "example_values": [ "5.4.247.0" ] }, { "data_path": "action_result.data.*.scans.GData.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.GData.result", "data_type": "string", "example_values": [ "Win32.Parite.B" ] }, { "data_path": "action_result.data.*.scans.GData.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.GData.version", "data_type": "string", "example_values": [ "A:25.20275B:25.14197" ] }, { "data_path": "action_result.data.*.scans.Ikarus.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Ikarus.result", "data_type": "string", "example_values": [ "Virus.Win32.Virut" ] }, { "data_path": "action_result.data.*.scans.Ikarus.update", "data_type": "string", "example_values": [ "20190121" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.Ikarus.version", "data_type": "string", "example_values": [ "0.1.5.2" ] }, { "data_path": "action_result.data.*.scans.Invincea.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Invincea.result", "data_type": "string", "example_values": [ "heuristic" ] }, { "data_path": "action_result.data.*.scans.Invincea.update", "data_type": "string", "example_values": [ "20181128" ] }, { "data_path": "action_result.data.*.scans.Invincea.version", "data_type": "string", "example_values": [ "6.3.6.26157" ] }, { "data_path": "action_result.data.*.scans.Jiangmin.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Jiangmin.result", "data_type": "string", "example_values": [ "Win32/Parite.b" ] }, { "data_path": "action_result.data.*.scans.Jiangmin.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.Jiangmin.version", "data_type": "string", "example_values": [ "16.0.100" ] }, { "data_path": "action_result.data.*.scans.K7AntiVirus.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.K7AntiVirus.result", "data_type": "string", "example_values": [ "Virus ( 00001b711 )" ] }, { "data_path": "action_result.data.*.scans.K7AntiVirus.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.K7AntiVirus.version", "data_type": "string", "example_values": [ "11.24.29740" ] }, { "data_path": "action_result.data.*.scans.K7GW.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.K7GW.result", "data_type": "string", "example_values": [ "Virus ( 00001b711 )" ] }, { "data_path": "action_result.data.*.scans.K7GW.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.K7GW.version", "data_type": "string", "example_values": [ "11.24.29740" ] }, { "data_path": "action_result.data.*.scans.Kaspersky.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Kaspersky.result", "data_type": "string", "example_values": [ "Virus.Win32.Parite.b" ] }, { "data_path": "action_result.data.*.scans.Kaspersky.update", "data_type": "string", "example_values": [ "20190121" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.Kaspersky.version", "data_type": "string", "example_values": [ "15.0.1.13" ] }, { "data_path": "action_result.data.*.scans.Kingsoft.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Kingsoft.result", "data_type": "string", "example_values": [ "Win32.Parite.b.5756" ] }, { "data_path": "action_result.data.*.scans.Kingsoft.update", "data_type": "string", "example_values": [ "20190122" ] }, { "data_path": "action_result.data.*.scans.Kingsoft.version", "data_type": "string", "example_values": [ "2013.8.14.323" ] }, { "data_path": "action_result.data.*.scans.MAX.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.MAX.result", "data_type": "string", "example_values": [ "malware (ai score=100)" ] }, { "data_path": "action_result.data.*.scans.MAX.update", "data_type": "string", "example_values": [ "20190122" ] }, { "data_path": "action_result.data.*.scans.MAX.version", "data_type": "string", "example_values": [ "2018.9.12.1" ] }, { "data_path": "action_result.data.*.scans.Malwarebytes.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Malwarebytes.result", "data_type": "string", "example_values": [ "Trojan.Agent.QQ" ] }, { "data_path": "action_result.data.*.scans.Malwarebytes.update", "data_type": "string", "example_values": [ "20190122" ] }, { "data_path": "action_result.data.*.scans.Malwarebytes.version", "data_type": "string", "example_values": [ "2.1.1.1115" ] }, { "data_path": "action_result.data.*.scans.McAfee-GW-Edition.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.McAfee-GW-Edition.result", "data_type": "string", "example_values": [ "BehavesLike.Win32.Pate.hh" ] }, { "data_path": "action_result.data.*.scans.McAfee-GW-Edition.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.McAfee-GW-Edition.version", "data_type": "string", "example_values": [ "v2017.3010" ] }, { "data_path": "action_result.data.*.scans.McAfee.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.McAfee.result", "data_type": "string", "example_values": [ "W32/Pate.b" ] }, { "data_path": "action_result.data.*.scans.McAfee.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.McAfee.version", "data_type": "string", "example_values": [ "6.0.6.653" ] }, { "data_path": "action_result.data.*.scans.MicroWorld-eScan.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.MicroWorld-eScan.result", "data_type": "string", "example_values": [ "Win32.Parite.B" ] }, { "data_path": "action_result.data.*.scans.MicroWorld-eScan.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.MicroWorld-eScan.version", "data_type": "string", "example_values": [ "14.0.297.0" ] }, { "data_path": "action_result.data.*.scans.Microsoft.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Microsoft.result", "data_type": "string", "example_values": [ "Virus:Win32/Parite.B" ] }, { "data_path": "action_result.data.*.scans.Microsoft.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.Microsoft.version", "data_type": "string", "example_values": [ "1.1.15500.2" ] }, { "data_path": "action_result.data.*.scans.NANO-Antivirus.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.NANO-Antivirus.result", "data_type": "string", "example_values": [ "Virus.Win32.Parite.bgvo" ] }, { "data_path": "action_result.data.*.scans.NANO-Antivirus.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.NANO-Antivirus.version", "data_type": "string", "example_values": [ "1.0.134.24576" ] }, { "data_path": "action_result.data.*.scans.Paloalto.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Paloalto.result", "data_type": "string", "example_values": [ "generic.ml" ] }, { "data_path": "action_result.data.*.scans.Paloalto.update", "data_type": "string", "example_values": [ "20190122" ] }, { "data_path": "action_result.data.*.scans.Paloalto.version", "data_type": "string", "example_values": [ "1.0" ] }, { "data_path": "action_result.data.*.scans.Panda.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Panda.result", "data_type": "string", "example_values": [ "W32/Parite.B" ] }, { "data_path": "action_result.data.*.scans.Panda.update", "data_type": "string", "example_values": [ "20190121" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.Panda.version", "data_type": "string", "example_values": [ "4.6.4.2" ] }, { "data_path": "action_result.data.*.scans.Qihoo-360.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Qihoo-360.result", "data_type": "string", "example_values": [ "Virus.Win32.Parite.H" ] }, { "data_path": "action_result.data.*.scans.Qihoo-360.update", "data_type": "string", "example_values": [ "20190122" ] }, { "data_path": "action_result.data.*.scans.Qihoo-360.version", "data_type": "string", "example_values": [ "1.0.0.1120" ] }, { "data_path": "action_result.data.*.scans.Rising.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Rising.result", "data_type": "string", "example_values": [ "Virus.Parite!1.9B80 (CLOUD)" ] }, { "data_path": "action_result.data.*.scans.Rising.update", "data_type": "string", "example_values": [ "20190122" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.Rising.version", "data_type": "string", "example_values": [ "25.0.0.24" ] }, { "data_path": "action_result.data.*.scans.SUPERAntiSpyware.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.SUPERAntiSpyware.result", "data_type": "string" }, { "data_path": "action_result.data.*.scans.SUPERAntiSpyware.update", "data_type": "string", "example_values": [ "20190116" ] }, { "data_path": "action_result.data.*.scans.SUPERAntiSpyware.version", "data_type": "string", "example_values": [ "5.6.0.1032" ] }, { "data_path": "action_result.data.*.scans.SentinelOne.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.SentinelOne.result", "data_type": "string", "example_values": [ "static engine - malicious" ] }, { "data_path": "action_result.data.*.scans.SentinelOne.update", "data_type": "string", "example_values": [ "20190118" ] }, { "data_path": "action_result.data.*.scans.SentinelOne.version", "data_type": "string", "example_values": [ "1.0.21.268" ] }, { "data_path": "action_result.data.*.scans.Sophos.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Sophos.result", "data_type": "string", "example_values": [ "W32/Parite-B" ] }, { "data_path": "action_result.data.*.scans.Sophos.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.Sophos.version", "data_type": "string", "example_values": [ "4.98.0" ] }, { "data_path": "action_result.data.*.scans.Symantec.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Symantec.result", "data_type": "string", "example_values": [ "Trojan.Gen.6" ] }, { "data_path": "action_result.data.*.scans.Symantec.update", "data_type": "string", "example_values": [ "20190121" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.Symantec.version", "data_type": "string", "example_values": [ "1.8.0.0" ] }, { "data_path": "action_result.data.*.scans.TACHYON.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.TACHYON.result", "data_type": "string", "example_values": [ "Virus/W32.Parite.C" ] }, { "data_path": "action_result.data.*.scans.TACHYON.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.TACHYON.version", "data_type": "string", "example_values": [ "2019-01-21.02" ] }, { "data_path": "action_result.data.*.scans.Tencent.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Tencent.result", "data_type": "string", "example_values": [ "Virus.Win32.Dropper.c" ] }, { "data_path": "action_result.data.*.scans.Tencent.update", "data_type": "string", "example_values": [ "20190122" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.Tencent.version", "data_type": "string", "example_values": [ "1.0.0.1" ] }, { "data_path": "action_result.data.*.scans.TheHacker.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.TheHacker.result", "data_type": "string", "example_values": [ "W32/Pate.B" ] }, { "data_path": "action_result.data.*.scans.TheHacker.update", "data_type": "string", "example_values": [ "20190118" ] }, { "data_path": "action_result.data.*.scans.TheHacker.version", "data_type": "string", "example_values": [ "6.8.0.5.3962" ] }, { "data_path": "action_result.data.*.scans.TotalDefense.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.TotalDefense.result", "data_type": "string", "example_values": [ "Win32/Pinfi.A" ] }, { "data_path": "action_result.data.*.scans.TotalDefense.update", "data_type": "string", "example_values": [ "20190121" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.TotalDefense.version", "data_type": "string", "example_values": [ "37.1.62.1" ] }, { "data_path": "action_result.data.*.scans.Trapmine.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Trapmine.result", "data_type": "string", "example_values": [ "malicious.high.ml.score" ] }, { "data_path": "action_result.data.*.scans.Trapmine.update", "data_type": "string", "example_values": [ "20190103" ] }, { "data_path": "action_result.data.*.scans.Trapmine.version", "data_type": "string", "example_values": [ "3.0.34.707" ] }, { "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.result", "data_type": "string", "example_values": [ "PE_PARITE.A" ] }, { "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.version", "data_type": "string", "example_values": [ "10.0.0.1040" ] }, { "data_path": "action_result.data.*.scans.TrendMicro.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.TrendMicro.result", "data_type": "string", "example_values": [ "PE_PARITE.A" ] }, { "data_path": "action_result.data.*.scans.TrendMicro.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.TrendMicro.version", "data_type": "string", "example_values": [ "10.0.0.1040" ] }, { "data_path": "action_result.data.*.scans.Trustlook.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Trustlook.result", "data_type": "string" }, { "data_path": "action_result.data.*.scans.Trustlook.update", "data_type": "string", "example_values": [ "20190122" ] }, { "data_path": "action_result.data.*.scans.Trustlook.version", "data_type": "string", "example_values": [ "1.0" ] }, { "data_path": "action_result.data.*.scans.VBA32.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.VBA32.result", "data_type": "string", "example_values": [ "Virus.Win32.Parite.b" ] }, { "data_path": "action_result.data.*.scans.VBA32.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.VBA32.version", "data_type": "string", "example_values": [ "3.35.1" ] }, { "data_path": "action_result.data.*.scans.VIPRE.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.VIPRE.result", "data_type": "string", "example_values": [ "Win32.Parite.b (v)" ] }, { "data_path": "action_result.data.*.scans.VIPRE.update", "data_type": "string" }, { "data_path": "action_result.data.*.scans.VIPRE.version", "data_type": "string", "example_values": [ "None" ] }, { "data_path": "action_result.data.*.scans.ViRobot.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.ViRobot.result", "data_type": "string", "example_values": [ "Win32.Parite.A" ] }, { "data_path": "action_result.data.*.scans.ViRobot.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.ViRobot.version", "data_type": "string", "example_values": [ "2014.3.20.0" ] }, { "data_path": "action_result.data.*.scans.Webroot.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Webroot.result", "data_type": "string" }, { "data_path": "action_result.data.*.scans.Webroot.update", "data_type": "string", "example_values": [ "20190122" ] }, { "data_path": "action_result.data.*.scans.Webroot.version", "data_type": "string", "example_values": [ "1.0.0.403" ] }, { "data_path": "action_result.data.*.scans.Yandex.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Yandex.result", "data_type": "string", "example_values": [ "Win32.Parite.B" ] }, { "data_path": "action_result.data.*.scans.Yandex.update", "data_type": "string", "example_values": [ "20190120" ] }, { "contains": [ "ip" ], "data_path": "action_result.data.*.scans.Yandex.version", "data_type": "string", "example_values": [ "5.5.1.3" ] }, { "data_path": "action_result.data.*.scans.Zillya.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Zillya.result", "data_type": "string", "example_values": [ "Virus.Parite.Win32.9" ] }, { "data_path": "action_result.data.*.scans.Zillya.update", "data_type": "string", "example_values": [ "20190118" ] }, { "data_path": "action_result.data.*.scans.Zillya.version", "data_type": "string", "example_values": [ "2.0.0.3733" ] }, { "data_path": "action_result.data.*.scans.ZoneAlarm.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.ZoneAlarm.result", "data_type": "string", "example_values": [ "Virus.Win32.Parite.b" ] }, { "data_path": "action_result.data.*.scans.ZoneAlarm.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.ZoneAlarm.version", "data_type": "string", "example_values": [ "1.0" ] }, { "data_path": "action_result.data.*.scans.Zoner.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.Zoner.result", "data_type": "string", "example_values": [ "Win32.Parite.B" ] }, { "data_path": "action_result.data.*.scans.Zoner.update", "data_type": "string", "example_values": [ "20190121" ] }, { "data_path": "action_result.data.*.scans.Zoner.version", "data_type": "string", "example_values": [ "1.0" ] }, { "data_path": "action_result.data.*.scans.eGambit.detected", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.scans.eGambit.result", "data_type": "string" }, { "data_path": "action_result.data.*.scans.eGambit.update", "data_type": "string", "example_values": [ "20190122" ] }, { "data_path": "action_result.data.*.scans.eGambit.version", "data_type": "string", "example_values": [ "v4.3.5" ] }, { "contains": [ "hash", "sha1" ], "data_path": "action_result.data.*.sha1", "data_type": "string", "example_values": [ "6c1948f7edf115cd1f13cd170b882077930be150" ] }, { "contains": [ "hash", "sha256" ], "data_path": "action_result.data.*.sha256", "data_type": "string", "example_values": [ "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7" ] }, { "data_path": "action_result.data.*.total", "data_type": "numeric", "example_values": [ 72 ] }, { "data_path": "action_result.data.*.verbose_msg", "data_type": "string", "example_values": [ "Scan finished, information embedded" ] }, { "data_path": "action_result.summary.positives", "data_type": "numeric", "example_values": [ 64 ] }, { "data_path": "action_result.summary.total_scans", "data_type": "numeric", "example_values": [ 72 ] }, { "data_path": "action_result.message", "data_type": "string", "example_values": [ "Positives: 64, Total scans: 72" ] }, { "data_path": "summary.total_objects", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "summary.total_objects_successful", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "summary.total_positives", "data_type": "numeric", "example_values": [ 1 ] } ], "product_name": "VirusTotal", "product_vendor": "VirusTotal", "type": "" } ], "attrs": { ".action": { "text": "file reputation" }, ".background": { "fill": "#000000", "stroke": "#5C6773" }, ".color-band": { "fill": "#3C444D" }, ".inPorts>.port-in": { "ref": ".background", "ref-x": 0.5 }, ".inPorts>.port-in>.port-body": { "port": { "id": "in", "type": "in" } }, ".message": { "fill": "#FFFFFF", "font-size": 12, "font-weight": 300, "opacity": 0, "ref": ".background", "ref-x": 5, "ref-y": 105, "text": "Configuring now" }, ".outPorts>.port-out": { "ref": ".background", "ref-x": 0.5 }, ".outPorts>.port-out>.port-body": { "port": { "id": "out", "type": "out" } }, ".title": { "text": "Investigate" }, "g.approver image": { "opacity": 1 }, "g.code image": { "opacity": 1 }, "g.delete": { "display": "none" }, "g.error": { "opacity": 0 }, "g.icon image": { "xlink:href": "/inc/coa/img/block_icon_investigate.svg" }, "g.notes": { "display": "block", "opacity": 1 }, "g.notes image": { "opacity": 1, "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" }, "g.timer image": { "opacity": 1 }, "rect.warn-background": { "fill": "#FFFFFF" }, "text.icon": { "fill": "#FFFFFF" } }, "block_code": "def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('file_reputation_1() called')\n\n # collect data for 'file_reputation_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_1:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'file_reputation_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'hash': filtered_artifacts_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"file reputation\", parameters=parameters, assets=['virustotal'], callback=filter_2, name=\"file_reputation_1\")\n\n return", "callback_code": "", "callback_start": 55, "callsback": true, "color": "#654796", "connected_to_start": true, "connection_name": "", "connection_type": "", "custom_callback": "", "custom_code": "", "custom_join": "", "custom_name": "", "delay": 0, "description": "Run a reputation lookup on the fileHash to determine how many antivirus engines recognize it as malware.", "has_custom": false, "has_custom_block": false, "has_custom_callback": false, "has_custom_join": false, "id": "f86960a4-1d0d-4f37-924c-8640149388a8", "inPorts": [ "in" ], "join_code": "", "join_optional": [], "join_start": 1, "line_end": 40, "line_start": 19, "message": "Configuring now", "name": "file reputation", "notes": "Run a reputation lookup on the fileHash to determine how many antivirus engines recognize it as malware.", "number": 1, "order": 2, "outPorts": [ "out" ], "ports": { "groups": { "in": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "left" } }, "position": { "name": "left" } }, "out": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "right" } }, "position": { "name": "right" } } } }, "position": { "x": 160, "y": 100 }, "previous_function": "", "previous_name": "file_reputation_1", "required_params": { "hash": true }, "reviewer": "", "show_number": false, "size": { "height": 112, "width": 168 }, "state": "asset", "status": "", "title": "Investigate", "type": "coa.Action", "warn": false, "z": 1981 }, { "active": false, "angle": 0, "attrs": { ".background": { "fill": "#000000", "stroke": "#5C6773", "transform": "rotate(45 30 70)" }, ".border": { "transform": "rotate(45 30 70)" }, ".inPorts>.port-0>.port-body": { "port": { "id": "in", "type": "in" } }, ".number": { "text": 5 }, ".outPorts>.port-0": { "port": { "id": "out-1", "type": "out" }, "ref-x": 83, "ref-y": 40 }, ".outPorts>.port-0>.port-body": { "port": { "id": "out-1", "type": "out" } }, "g.delete": { "display": "none" }, "g.error": { "opacity": 0 }, "g.notes": { "display": "block", "opacity": 1 }, "g.notes image": { "opacity": 1, "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" } }, "block_code": "def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_5() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"detonate_file_1:action_result.summary.malware\", \"==\", \"yes\"],\n ],\n name=\"filter_5:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", "callback_code": "", "callback_start": 1, "callsback": false, "connected_to_start": true, "connection_name": "detonate file", "connection_type": "action", "custom_callback": "", "custom_code": "", "custom_join": "", "custom_name": "filter 5", "description": "Only hunt files that are considered malware per the sandbox (malware == yes).", "has_custom": false, "has_custom_block": false, "has_custom_callback": false, "has_custom_join": false, "id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb", "inPorts": [ "in" ], "join_code": "", "join_optional": [], "join_start": 1, "line_end": 110, "line_start": 92, "name": "filter", "notes": "Only hunt files that are considered malware per the sandbox (malware == yes).", "number": 5, "order": 5, "outPorts": [ "out-1" ], "outputs": [ { "conditions": [ { "comparison": "==", "data_type": "", "param": "detonate_file_1:action_result.summary.malware", "value": "yes" } ], "display": "If", "logic": "and", "type": "if" } ], "ports": { "groups": { "in": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "left" } }, "position": { "name": "left" } }, "out": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "right" } }, "position": { "name": "right" } } } }, "position": { "x": 1020, "y": 240 }, "previous_function": "", "previous_name": "filter_5", "show_number": true, "size": { "height": 82, "width": 82 }, "state": "filter", "status": "", "type": "coa.Filter", "warn": false, "z": 2020 }, { "active": false, "angle": 0, "attrs": { ".background": { "fill": "#000000", "stroke": "#5C6773", "transform": "rotate(45 30 70)" }, ".border": { "transform": "rotate(45 30 70)" }, ".inPorts>.port-0>.port-body": { "port": { "id": "in", "type": "in" } }, ".number": { "text": 3 }, ".outPorts>.port-0": { "port": { "id": "out-1", "type": "out" }, "ref-x": 83, "ref-y": 40 }, ".outPorts>.port-0>.port-body": { "port": { "id": "out-1", "type": "out" } }, "g.delete": { "display": "none" }, "g.error": { "opacity": 0 }, "g.notes": { "display": "block", "opacity": 1 }, "g.notes image": { "opacity": 1, "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" } }, "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_3() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"filtered-data:filter_2:condition_2:file_reputation_1:action_result.parameter.hash\", \"==\", \"artifact:*.cef.fileHash\"],\n ],\n name=\"filter_3:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", "callback_code": "", "callback_start": 1, "callsback": false, "connected_to_start": true, "connection_name": "file reputation", "connection_type": "action", "custom_callback": "", "custom_code": "", "custom_join": "", "custom_name": "filter 3", "description": "Match hashes with less than 10 positives to artifacts to identify filtered_artifacts.", "has_custom": false, "has_custom_block": false, "has_custom_callback": false, "has_custom_join": false, "id": "34337267-8e89-4ddf-a601-9040234d2744", "inPorts": [ "in" ], "join_code": "", "join_optional": [], "join_start": 1, "line_end": 131, "line_start": 113, "name": "filter", "notes": "Match hashes with less than 10 positives to artifacts to identify filtered_artifacts.", "number": 3, "order": 6, "outPorts": [ "out-1" ], "outputs": [ { "conditions": [ { "comparison": "==", "data_type": "", "param": "filtered-data:filter_2:condition_2:file_reputation_1:action_result.parameter.hash", "value": "artifact:*.cef.fileHash" } ], "display": "If", "logic": "and", "type": "if" } ], "ports": { "groups": { "in": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "left" } }, "position": { "name": "left" } }, "out": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "right" } }, "position": { "name": "right" } } } }, "position": { "x": 500, "y": 240 }, "previous_function": "", "previous_name": "filter_3", "show_number": true, "size": { "height": 82, "width": 82 }, "state": "filter", "status": "", "type": "coa.Filter", "warn": false, "z": 2022 }, { "active": false, "angle": 0, "attrs": { ".background": { "fill": "#000000", "stroke": "#5C6773", "transform": "rotate(45 30 70)" }, ".border": { "transform": "rotate(45 30 70)" }, ".inPorts>.port-0>.port-body": { "port": { "id": "in", "type": "in" } }, ".number": { "text": 2 }, ".outPorts>.port-0": { "port": { "id": "out-1", "type": "out" }, "ref-x": 83, "ref-y": 40 }, ".outPorts>.port-0>.port-body": { "port": { "id": "out-1", "type": "out" } }, ".outPorts>.port-1": { "port": { "id": "out-2", "type": "out" }, "ref-x": 41, "ref-y": 82 }, ".outPorts>.port-1>.port-body": { "port": { "id": "out-2", "type": "out" } }, "g.delete": { "display": "none" }, "g.error": { "opacity": 0 }, "g.notes": { "display": "block", "opacity": 1 }, "g.notes image": { "opacity": 1, "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" } }, "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_2() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">=\", 10],\n ],\n name=\"filter_2:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n # collect filtered artifact ids for 'if' condition 2\n matched_artifacts_2, matched_results_2 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \"<\", 10],\n ],\n name=\"filter_2:condition_2\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_2 or matched_results_2:\n filter_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n\n return", "callback_code": "", "callback_start": 1, "callsback": false, "connected_to_start": true, "connection_name": "file reputation", "connection_type": "action", "custom_callback": "", "custom_code": "", "custom_join": "", "custom_name": "filter 2", "description": "If 10 or more antivirus engines flagged the hash, proceed directly to hunt for the file. Else, use a sandbox to detonate the executable first.", "has_custom": false, "has_custom_block": false, "has_custom_callback": false, "has_custom_join": false, "id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b", "inPorts": [ "in" ], "join_code": "", "join_optional": [], "join_start": 1, "line_end": 165, "line_start": 134, "name": "filter", "notes": "If 10 or more antivirus engines flagged the hash, proceed directly to hunt for the file. Else, use a sandbox to detonate the executable first.", "number": 2, "order": 7, "outPorts": [ "out-1", "out-2" ], "outputs": [ { "conditions": [ { "comparison": ">=", "data_type": "", "param": "file_reputation_1:action_result.summary.positives", "value": "10" } ], "display": "If", "logic": "and", "type": "if" }, { "conditions": [ { "comparison": "<", "data_type": "", "param": "file_reputation_1:action_result.summary.positives", "value": "10" } ], "display": "If", "logic": "and", "type": "if" } ], "ports": { "groups": { "in": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "left" } }, "position": { "name": "left" } }, "out": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "right" } }, "position": { "name": "right" } } } }, "position": { "x": 400, "y": 100 }, "previous_function": "", "previous_name": "filter_2", "show_number": true, "size": { "height": 82, "width": 82 }, "state": "filter", "status": "", "type": "coa.Filter", "warn": false, "z": 2023 }, { "action": "hunt file", "action_type": "investigate", "active": false, "active_keys": {}, "active_values": { "hash": "filtered-data:filter_9:condition_1:file_reputation_1:action_result.parameter.hash", "range": "", "type": "" }, "angle": 0, "app": "", "approver": "", "assets": [ { "action": "", "active": true, "app_name": "Carbon Black Response", "app_version": "1.2.80", "appid": "", "config_type": "asset", "fields": { "hash": "filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.hash", "range": "", "type": "" }, "has_app": true, "id": "-", "loaded": false, "missing": false, "name": "carbonblack", "output": [ { "data_path": "action_result.status", "data_type": "string", "example_values": [ "success" ] }, { "contains": [ "hash", "md5" ], "data_path": "action_result.parameter.hash", "data_type": "string", "example_values": [ "4fb491ac8d46aaf22ba8bc5c73dabef7", "13ded573464ba7f43fe640479b309e09", "9bf50324444c46997c2492d505b47f2d", "5FB30FE90736C7FC77DE637021B1CE7C" ] }, { "data_path": "action_result.parameter.range", "data_type": "string", "example_values": [ "0-10", "0-2", "5-8" ] }, { "contains": [ "carbon black query type" ], "data_path": "action_result.parameter.type", "data_type": "string", "example_values": [ "process", "binary" ] }, { "data_path": "action_result.data.*.binary.elapsed", "data_type": "numeric", "example_values": [ 0.1120398044586182, 0.04952096939086914, 0.1234798431396484, 0.05507302284240723, 0.05384993553161621 ] }, { "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name", "data_type": "numeric", "example_values": [ 0 ] }, { "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value", "data_type": "numeric", "example_values": [ 0 ] }, { "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name", "data_type": "string", "example_values": [ "Microsoft Corporation" ] }, { "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio", "data_type": "string", "example_values": [ "100.0" ] }, { "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name", "data_type": "string", "example_values": [ "Microsoft Corporation" ] }, { "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio", "data_type": "string", "example_values": [ "100.0" ] }, { "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.binary.facets.digsig_result.*.name", "data_type": "string", "example_values": [ "Signed" ] }, { "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio", "data_type": "string", "example_values": [ "100.0" ] }, { "data_path": "action_result.data.*.binary.facets.digsig_result.*.value", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name", "data_type": "string", "example_values": [ "2018-10-01T00:00:00Z", "2015-01-01T00:00:00Z", "2013-11-01T00:00:00Z" ] }, { "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value", "data_type": "numeric", "example_values": [ 1, 0 ] }, { "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name", "data_type": "string", "example_values": [ "16.0.10827.20181", "4.7.0205.0", "6.1.7600.16385 (win7_rtm.090713-1255)" ] }, { "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio", "data_type": "string", "example_values": [ "100.0" ] }, { "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.binary.facets.group.*.name", "data_type": "string", "example_values": [ "default group" ] }, { "data_path": "action_result.data.*.binary.facets.group.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.binary.facets.group.*.ratio", "data_type": "string", "example_values": [ "100.0" ] }, { "data_path": "action_result.data.*.binary.facets.group.*.value", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.binary.facets.host_count.*.name", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.binary.facets.host_count.*.value", "data_type": "numeric", "example_values": [ 1, 0 ] }, { "data_path": "action_result.data.*.binary.facets.hostname.*.name", "data_type": "string", "example_values": [ "CB-TEST-02", "WIN7-CLIENT1", "ACCOUNTING-PC" ] }, { "data_path": "action_result.data.*.binary.facets.hostname.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.binary.facets.hostname.*.ratio", "data_type": "string", "example_values": [ "100.0", "16.7" ] }, { "data_path": "action_result.data.*.binary.facets.hostname.*.value", "data_type": "numeric", "example_values": [ 1 ] }, { "contains": [ "file path", "file name" ], "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name", "data_type": "string", "example_values": [ "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", "c:\\program files\\microsoft security client\\nissrv.exe", "C:\\Windows\\system32\\ping.exe" ] }, { "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio", "data_type": "string", "example_values": [ "100.0", "50.0" ] }, { "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name", "data_type": "string", "example_values": [ "Microsoft Office", "Microsoft Malware Protection" ] }, { "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio", "data_type": "string", "example_values": [ "100.0" ] }, { "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name", "data_type": "string", "example_values": [ "2018-10-19T00:00:00Z", "2018-09-29T00:00:00Z", "2018-10-02T00:00:00Z" ] }, { "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value", "data_type": "numeric", "example_values": [ 1, 0 ] }, { "contains": [ "md5" ], "data_path": "action_result.data.*.binary.highlights.*.ids", "data_type": "string", "example_values": [ "13DED573464BA7F43FE640479B309E09", "9BF50324444C46997C2492D505B47F2D", "5FB30FE90736C7FC77DE637021B1CE7C" ] }, { "data_path": "action_result.data.*.binary.highlights.*.name", "data_type": "string", "example_values": [ "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST", "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST", "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST" ] }, { "contains": [ "md5" ], "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust", "data_type": "string", "example_values": [ "5fb30fe90736c7fc77de637021b1ce7c" ] }, { "contains": [ "url" ], "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust", "data_type": "string", "example_values": [ "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" ] }, { "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust", "data_type": "numeric", "example_values": [ -100 ] }, { "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust", "data_type": "string", "example_values": [ "2018-02-07T02:37:28Z" ] }, { "data_path": "action_result.data.*.binary.results.*.cb_version", "data_type": "numeric", "example_values": [ 610, 510, 511 ] }, { "data_path": "action_result.data.*.binary.results.*.company_name", "data_type": "string", "example_values": [ "Microsoft Corporation" ] }, { "data_path": "action_result.data.*.binary.results.*.copied_mod_len", "data_type": "numeric", "example_values": [ 9683736, 366512, 16896 ] }, { "data_path": "action_result.data.*.binary.results.*.digsig_issuer", "data_type": "string", "example_values": [ "Microsoft Code Signing PCA" ] }, { "data_path": "action_result.data.*.binary.results.*.digsig_prog_name", "data_type": "string", "example_values": [ "Microsoft Office", "Microsoft Corp." ] }, { "data_path": "action_result.data.*.binary.results.*.digsig_publisher", "data_type": "string", "example_values": [ "Microsoft Corporation" ] }, { "data_path": "action_result.data.*.binary.results.*.digsig_result", "data_type": "string", "example_values": [ "Signed" ] }, { "data_path": "action_result.data.*.binary.results.*.digsig_result_code", "data_type": "string", "example_values": [ "0" ] }, { "data_path": "action_result.data.*.binary.results.*.digsig_sign_time", "data_type": "string", "example_values": [ "2018-10-14T20:23:00Z", "2015-01-30T19:14:00Z", "2009-07-14T10:17:00Z" ] }, { "data_path": "action_result.data.*.binary.results.*.digsig_subject", "data_type": "string", "example_values": [ "Microsoft Corporation" ] }, { "data_path": "action_result.data.*.binary.results.*.endpoint", "data_type": "string", "example_values": [ "CB-TEST-02|27", "WIN7-CLIENT1|15", "DC1|19" ] }, { "data_path": "action_result.data.*.binary.results.*.event_partition_id", "data_type": "numeric", "example_values": [ 100972684312576, 100955696070656 ] }, { "data_path": "action_result.data.*.binary.results.*.facet_id", "data_type": "numeric", "example_values": [ 883737, 0 ] }, { "data_path": "action_result.data.*.binary.results.*.file_desc", "data_type": "string", "example_values": [ "Microsoft Office Click-to-Run (SxS)", "Microsoft Network Realtime Inspection Service", "TCP/IP Ping Command" ] }, { "data_path": "action_result.data.*.binary.results.*.file_version", "data_type": "string", "example_values": [ "16.0.10827.20181", "4.7.0205.0", "6.1.7600.16385 (win7_rtm.090713-1255)" ] }, { "data_path": "action_result.data.*.binary.results.*.group", "data_type": "string", "example_values": [ "Default Group" ] }, { "data_path": "action_result.data.*.binary.results.*.host_count", "data_type": "numeric", "example_values": [ 1, 6 ] }, { "contains": [ "file name" ], "data_path": "action_result.data.*.binary.results.*.internal_name", "data_type": "string", "example_values": [ "OfficeClickToRun.exe", "NisSrv.exe", "ping.exe" ] }, { "data_path": "action_result.data.*.binary.results.*.is_64bit", "data_type": "boolean", "example_values": [ false, true ] }, { "data_path": "action_result.data.*.binary.results.*.is_executable_image", "data_type": "boolean", "example_values": [ false, true ] }, { "data_path": "action_result.data.*.binary.results.*.last_seen", "data_type": "string", "example_values": [ "2018-10-28T10:06:02.456Z", "2018-10-28T10:06:42.455Z", "2018-10-26T00:01:41.224Z" ] }, { "data_path": "action_result.data.*.binary.results.*.legal_copyright", "data_type": "string", "example_values": [ "Microsoft Corporation. All rights reserved." ] }, { "contains": [ "md5" ], "data_path": "action_result.data.*.binary.results.*.md5", "data_type": "string", "example_values": [ "13DED573464BA7F43FE640479B309E09", "9BF50324444C46997C2492D505B47F2D", "5FB30FE90736C7FC77DE637021B1CE7C" ] }, { "contains": [ "file path", "file name" ], "data_path": "action_result.data.*.binary.results.*.observed_filename", "data_type": "string", "example_values": [ "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", "c:\\program files\\microsoft security client\\nissrv.exe", "c:\\windows\\system32\\ping.exe" ] }, { "data_path": "action_result.data.*.binary.results.*.orig_mod_len", "data_type": "numeric", "example_values": [ 9683736, 366512, 16896 ] }, { "contains": [ "file name" ], "data_path": "action_result.data.*.binary.results.*.original_filename", "data_type": "string", "example_values": [ "OfficeClickToRun.exe", "NisSrv.exe", "ping.exe.mui" ] }, { "data_path": "action_result.data.*.binary.results.*.os_type", "data_type": "string", "example_values": [ "Windows" ] }, { "data_path": "action_result.data.*.binary.results.*.product_name", "data_type": "string", "example_values": [ "Microsoft Office", "Microsoft Malware Protection" ] }, { "data_path": "action_result.data.*.binary.results.*.product_version", "data_type": "string", "example_values": [ "16.0.10827.20181", "4.7.0205.0", "6.1.7600.16385" ] }, { "data_path": "action_result.data.*.binary.results.*.server_added_timestamp", "data_type": "string", "example_values": [ "2018-10-19T17:04:47.906Z", "2015-07-01T02:12:21.783Z", "2015-05-15T07:23:54.846Z" ] }, { "column_name": "Signed", "column_order": 1, "data_path": "action_result.data.*.binary.results.*.signed", "data_type": "string", "example_values": [ "Signed" ] }, { "data_path": "action_result.data.*.binary.results.*.timestamp", "data_type": "string", "example_values": [ "2018-10-19T17:04:47.906Z", "2015-07-01T02:12:21.783Z", "2015-05-15T07:23:54.846Z" ] }, { "data_path": "action_result.data.*.binary.results.*.watchlists.*.value", "data_type": "string", "example_values": [ "2015-07-01T02:20:02.062Z", "2015-05-15T07:30:02.843Z" ] }, { "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid", "data_type": "string", "example_values": [ "5" ] }, { "data_path": "action_result.data.*.binary.start", "data_type": "numeric", "example_values": [ 0, 5 ] }, { "data_path": "action_result.data.*.binary.terms", "data_type": "string", "example_values": [ "md5:13ded573464ba7f43fe640479b309e09", "md5:9bf50324444c46997c2492d505b47f2d", "md5:5FB30FE90736C7FC77DE637021B1CE7C" ] }, { "data_path": "action_result.data.*.binary.total_results", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.process.all_segments", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.process.comprehensive_search", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.process.elapsed", "data_type": "numeric", "example_values": [ 0.2200779914855957 ] }, { "data_path": "action_result.data.*.process.facets.day_of_week.*.name", "data_type": "string", "example_values": [ "0" ] }, { "data_path": "action_result.data.*.process.facets.day_of_week.*.value", "data_type": "numeric", "example_values": [ 1566 ] }, { "data_path": "action_result.data.*.process.facets.group.*.name", "data_type": "string", "example_values": [ "default group" ] }, { "data_path": "action_result.data.*.process.facets.group.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.process.facets.group.*.ratio", "data_type": "string", "example_values": [ "100.0" ] }, { "data_path": "action_result.data.*.process.facets.group.*.value", "data_type": "numeric", "example_values": [ 10128 ] }, { "data_path": "action_result.data.*.process.facets.host_type.*.name", "data_type": "string", "example_values": [ "domain_controller" ] }, { "data_path": "action_result.data.*.process.facets.host_type.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.process.facets.host_type.*.ratio", "data_type": "string", "example_values": [ "100.0" ] }, { "data_path": "action_result.data.*.process.facets.host_type.*.value", "data_type": "numeric", "example_values": [ 10123 ] }, { "data_path": "action_result.data.*.process.facets.hostname.*.name", "data_type": "string", "example_values": [ "dc2" ] }, { "data_path": "action_result.data.*.process.facets.hostname.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.process.facets.hostname.*.ratio", "data_type": "string", "example_values": [ "51.2" ] }, { "data_path": "action_result.data.*.process.facets.hostname.*.value", "data_type": "numeric", "example_values": [ 5185 ] }, { "data_path": "action_result.data.*.process.facets.hour_of_day.*.name", "data_type": "string", "example_values": [ "0" ] }, { "data_path": "action_result.data.*.process.facets.hour_of_day.*.value", "data_type": "numeric", "example_values": [ 411 ] }, { "contains": [ "file name" ], "data_path": "action_result.data.*.process.facets.parent_name.*.name", "data_type": "string", "example_values": [ "svchost.exe" ] }, { "data_path": "action_result.data.*.process.facets.parent_name.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.process.facets.parent_name.*.ratio", "data_type": "string", "example_values": [ "98.5" ] }, { "data_path": "action_result.data.*.process.facets.parent_name.*.value", "data_type": "numeric", "example_values": [ 9971 ] }, { "contains": [ "file path", "file name" ], "data_path": "action_result.data.*.process.facets.path_full.*.name", "data_type": "string", "example_values": [ "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" ] }, { "data_path": "action_result.data.*.process.facets.path_full.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.process.facets.path_full.*.ratio", "data_type": "string", "example_values": [ "98.5" ] }, { "data_path": "action_result.data.*.process.facets.path_full.*.value", "data_type": "numeric", "example_values": [ 9971 ] }, { "contains": [ "md5" ], "data_path": "action_result.data.*.process.facets.process_md5.*.name", "data_type": "string", "example_values": [ "4fb491ac8d46aaf22ba8bc5c73dabef7" ] }, { "data_path": "action_result.data.*.process.facets.process_md5.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.process.facets.process_md5.*.ratio", "data_type": "string", "example_values": [ "98.5" ] }, { "data_path": "action_result.data.*.process.facets.process_md5.*.value", "data_type": "numeric", "example_values": [ 9971 ] }, { "contains": [ "file name" ], "data_path": "action_result.data.*.process.facets.process_name.*.name", "data_type": "string", "example_values": [ "wmiprvse.exe" ] }, { "data_path": "action_result.data.*.process.facets.process_name.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.process.facets.process_name.*.ratio", "data_type": "string", "example_values": [ "98.5" ] }, { "data_path": "action_result.data.*.process.facets.process_name.*.value", "data_type": "numeric", "example_values": [ 9971 ] }, { "data_path": "action_result.data.*.process.facets.start.*.name", "data_type": "string", "example_values": [ "2018-02-24T00:00:00Z" ] }, { "data_path": "action_result.data.*.process.facets.start.*.value", "data_type": "numeric", "example_values": [ 324 ] }, { "data_path": "action_result.data.*.process.facets.username_full.*.name", "data_type": "string", "example_values": [ "LOCAL SERVICE" ] }, { "data_path": "action_result.data.*.process.facets.username_full.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.process.facets.username_full.*.ratio", "data_type": "string", "example_values": [ "98.4" ] }, { "data_path": "action_result.data.*.process.facets.username_full.*.value", "data_type": "numeric", "example_values": [ 9966 ] }, { "data_path": "action_result.data.*.process.incomplete_results", "data_type": "boolean", "example_values": [ true, false ] }, { "contains": [ "md5" ], "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust", "data_type": "string", "example_values": [ "4fb491ac8d46aaf22ba8bc5c73dabef7" ] }, { "contains": [ "url" ], "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust", "data_type": "string", "example_values": [ "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7" ] }, { "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust", "data_type": "numeric", "example_values": [ -100 ] }, { "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust", "data_type": "string", "example_values": [ "2018-02-07T02:37:28Z" ] }, { "data_path": "action_result.data.*.process.results.*.childproc_count", "data_type": "numeric", "example_values": [ 0 ] }, { "contains": [ "file path" ], "data_path": "action_result.data.*.process.results.*.cmdline", "data_type": "string", "example_values": [ "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding" ] }, { "data_path": "action_result.data.*.process.results.*.comms_ip", "data_type": "numeric", "example_values": [ 168886572 ] }, { "data_path": "action_result.data.*.process.results.*.crossproc_count", "data_type": "numeric", "example_values": [ 2 ] }, { "data_path": "action_result.data.*.process.results.*.emet_config", "data_type": "string", "example_values": [ "" ] }, { "data_path": "action_result.data.*.process.results.*.emet_count", "data_type": "numeric", "example_values": [ 0 ] }, { "data_path": "action_result.data.*.process.results.*.filemod_count", "data_type": "numeric", "example_values": [ 0 ] }, { "data_path": "action_result.data.*.process.results.*.filtering_known_dlls", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.process.results.*.group", "data_type": "string", "example_values": [ "default group" ] }, { "data_path": "action_result.data.*.process.results.*.host_type", "data_type": "string", "example_values": [ "workstation" ] }, { "contains": [ "host name" ], "data_path": "action_result.data.*.process.results.*.hostname", "data_type": "string", "example_values": [ "win7-client1" ] }, { "contains": [ "carbon black process id" ], "data_path": "action_result.data.*.process.results.*.id", "data_type": "string", "example_values": [ "0000000f-0000-0688-01d3-27738c9b4243" ] }, { "data_path": "action_result.data.*.process.results.*.interface_ip", "data_type": "numeric", "example_values": [ 168886572 ] }, { "data_path": "action_result.data.*.process.results.*.last_server_update", "data_type": "string", "example_values": [ "2018-03-22T09:21:32.332Z" ] }, { "data_path": "action_result.data.*.process.results.*.last_update", "data_type": "string", "example_values": [ "2017-09-07T00:52:15.82Z" ] }, { "data_path": "action_result.data.*.process.results.*.modload_count", "data_type": "numeric", "example_values": [ 43 ] }, { "data_path": "action_result.data.*.process.results.*.netconn_count", "data_type": "numeric", "example_values": [ 0 ] }, { "data_path": "action_result.data.*.process.results.*.os_type", "data_type": "string", "example_values": [ "windows" ] }, { "data_path": "action_result.data.*.process.results.*.parent_id", "data_type": "string", "example_values": [ "0000000f-0000-0258-01d1-ec51b545a19b" ] }, { "data_path": "action_result.data.*.process.results.*.parent_md5", "data_type": "string", "example_values": [ "000000000000000000000000000000" ] }, { "contains": [ "file name" ], "data_path": "action_result.data.*.process.results.*.parent_name", "data_type": "string", "example_values": [ "svchost.exe" ] }, { "data_path": "action_result.data.*.process.results.*.parent_pid", "data_type": "numeric", "example_values": [ 600 ] }, { "data_path": "action_result.data.*.process.results.*.parent_unique_id", "data_type": "string", "example_values": [ "0000000f-0000-0258-01d1-ec51b545a19b-000000000001" ] }, { "contains": [ "file path", "file name" ], "data_path": "action_result.data.*.process.results.*.path", "data_type": "string", "example_values": [ "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" ] }, { "contains": [ "md5" ], "data_path": "action_result.data.*.process.results.*.process_md5", "data_type": "string", "example_values": [ "4fb491ac8d46aaf22ba8bc5c73dabef7" ] }, { "contains": [ "process name", "file name" ], "data_path": "action_result.data.*.process.results.*.process_name", "data_type": "string", "example_values": [ "wmiprvse.exe" ] }, { "contains": [ "pid" ], "data_path": "action_result.data.*.process.results.*.process_pid", "data_type": "numeric", "example_values": [ 1672 ] }, { "data_path": "action_result.data.*.process.results.*.processblock_count", "data_type": "numeric", "example_values": [ 0 ] }, { "data_path": "action_result.data.*.process.results.*.regmod_count", "data_type": "numeric", "example_values": [ 0 ] }, { "data_path": "action_result.data.*.process.results.*.segment_id", "data_type": "numeric", "example_values": [ 1 ] }, { "contains": [ "carbon black sensor id" ], "data_path": "action_result.data.*.process.results.*.sensor_id", "data_type": "numeric", "example_values": [ 15 ] }, { "data_path": "action_result.data.*.process.results.*.start", "data_type": "string", "example_values": [ "2017-09-07T00:52:15.758Z" ] }, { "data_path": "action_result.data.*.process.results.*.terminated", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.process.results.*.unique_id", "data_type": "string", "example_values": [ "0000000f-0000-0688-01d3-27738c9b4243-000000000001" ] }, { "contains": [ "user name" ], "data_path": "action_result.data.*.process.results.*.username", "data_type": "string", "example_values": [ "SYSTEM" ] }, { "data_path": "action_result.data.*.process.start", "data_type": "numeric", "example_values": [ 0 ] }, { "data_path": "action_result.data.*.process.terms", "data_type": "string", "example_values": [ "md5:4fb491ac8d46aaf22ba8bc5c73dabef7" ] }, { "data_path": "action_result.data.*.process.total_results", "data_type": "numeric", "example_values": [ 32404 ] }, { "data_path": "action_result.summary.device_count", "data_type": "numeric", "example_values": [ 32404, 1 ] }, { "data_path": "action_result.message", "data_type": "string", "example_values": [ "Displaying 10 'process' results of total 32404", "Displaying 1 'binary' results of total 1", "Displaying 0 'binary' results of total 1" ] }, { "data_path": "summary.total_objects", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "summary.total_objects_successful", "data_type": "numeric", "example_values": [ 1 ] } ], "product_name": "Carbon Black", "product_vendor": "Bit9", "type": "endpoint" } ], "attrs": { ".action": { "text": "hunt file 1" }, ".background": { "fill": "#000000", "stroke": "#5C6773" }, ".border": { "height": 88 }, ".color-band": { "fill": "#3C444D" }, ".inPorts>.port-in": { "ref": ".background", "ref-x": 0.5 }, ".inPorts>.port-in>.port-body": { "port": { "id": "in", "type": "in" } }, ".message": { "fill": "#FFFFFF", "font-size": 12, "font-weight": 300, "opacity": 0, "ref": ".background", "ref-x": 5, "ref-y": 105, "text": "Configuring now" }, ".outPorts>.port-out": { "ref": ".background", "ref-x": 0.5 }, ".outPorts>.port-out>.port-body": { "port": { "id": "out", "type": "out" } }, ".title": { "text": "Investigate" }, "g.approver image": { "opacity": 1 }, "g.code image": { "opacity": 1 }, "g.delete": { "display": "none" }, "g.error": { "opacity": 0 }, "g.icon image": { "xlink:href": "/inc/coa/img/block_icon_investigate.svg" }, "g.notes": { "display": "block", "opacity": 1 }, "g.notes image": { "opacity": 1, "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" }, "g.timer image": { "opacity": 1 }, "rect.warn-background": { "fill": "#FFFFFF" }, "text.icon": { "fill": "#FFFFFF" } }, "block_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_1' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_1' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name=\"hunt_file_1\")\n\n return", "callback_code": "", "callback_start": 193, "callsback": true, "color": "#654796", "connected_to_start": true, "connection_name": "file reputation", "connection_type": "action", "custom_callback": "", "custom_code": "", "custom_join": "", "custom_name": "", "delay": 0, "description": "Hunt for binaries with the malicious fileHash across endpoints.", "has_custom": false, "has_custom_block": false, "has_custom_callback": false, "has_custom_join": false, "id": "214e20f6-a5fb-4409-b2f2-752d24605d9c", "inPorts": [ "in" ], "join_code": "", "join_optional": [], "join_start": 112, "line_end": 193, "line_start": 168, "message": "Configuring now", "name": "hunt file", "notes": "Hunt for binaries with the malicious fileHash across endpoints.", "number": 1, "order": 8, "outPorts": [ "out" ], "ports": { "groups": { "in": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "left" } }, "position": { "name": "left" } }, "out": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "right" } }, "position": { "name": "right" } } } }, "position": { "x": 780, "y": 100 }, "previous_function": "", "previous_name": "hunt_file_1", "required_params": { "hash": true }, "reviewer": "", "show_number": true, "size": { "height": 112, "width": 168 }, "state": "asset", "status": "", "title": "Investigate", "type": "coa.Action", "warn": false, "z": 2024 }, { "active": false, "angle": 0, "attrs": { ".background": { "fill": "#000000", "stroke": "#5C6773", "transform": "rotate(45 30 70)" }, ".border": { "transform": "rotate(45 30 70)" }, ".inPorts>.port-0>.port-body": { "port": { "id": "in", "type": "in" } }, ".number": { "text": 1 }, ".outPorts>.port-0": { "port": { "id": "out-1", "type": "out" }, "ref-x": 83, "ref-y": 40 }, ".outPorts>.port-0>.port-body": { "port": { "id": "out-1", "type": "out" } }, "g.delete": { "display": "none" }, "g.error": { "opacity": 0 }, "g.notes": { "display": "block", "opacity": 1 }, "g.notes image": { "opacity": 1, "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" } }, "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_1() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.fileHash\", \"!=\", \"\"],\n ],\n name=\"filter_1:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n file_reputation_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", "callback_code": "", "callback_start": 1, "callsback": false, "connected_to_start": true, "connection_name": "", "connection_type": "", "custom_callback": "", "custom_code": "", "custom_join": "", "custom_name": "filter 1", "description": "Only process artifacts that have a CEF fileHash.", "has_custom": false, "has_custom_block": false, "has_custom_callback": false, "has_custom_join": false, "id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899", "inPorts": [ "in" ], "join_code": "", "join_optional": [], "join_start": 37, "line_end": 213, "line_start": 196, "name": "filter", "notes": "Only process artifacts that have a CEF fileHash.", "number": 1, "order": 9, "outPorts": [ "out-1" ], "outputs": [ { "conditions": [ { "comparison": "!=", "data_type": "", "param": "artifact:*.cef.fileHash", "value": "" } ], "display": "If", "logic": "and", "type": "if" } ], "ports": { "groups": { "in": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "left" } }, "position": { "name": "left" } }, "out": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "right" } }, "position": { "name": "right" } } } }, "position": { "x": 20, "y": 100 }, "previous_function": "", "previous_name": "filter_1", "show_number": true, "size": { "height": 82, "width": 82 }, "state": "filter", "status": "", "type": "coa.Filter", "warn": false, "z": 2025 }, { "action": "detonate file", "action_type": "investigate", "active": false, "active_keys": {}, "active_values": { "file_name": "", "force_analysis": "", "private": "", "vault_id": "filtered-data:filter_11:condition_1:artifact:*.cef.vaultId", "vm": "" }, "angle": 0, "app": "", "approver": "", "assets": [ { "action": "", "active": true, "app_name": "WildFire", "app_version": "1.0.24", "appid": "", "config_type": "asset", "fields": { "file_name": "", "vault_id": "filtered-data:filter_4:condition_1:artifact:*.cef.vaultId" }, "has_app": true, "id": "-", "loaded": false, "missing": false, "name": "wildfire", "output": [ { "data_path": "action_result.status", "data_type": "string" }, { "contains": [ "file name" ], "data_path": "action_result.parameter.file_name", "data_type": "string" }, { "contains": [ "pe file", "pdf", "flash", "apk", "jar", "doc", "xls", "ppt" ], "data_path": "action_result.parameter.vault_id", "data_type": "string" }, { "data_path": "action_result.data.*.file_info.filetype", "data_type": "string" }, { "data_path": "action_result.data.*.file_info.malware", "data_type": "string" }, { "contains": [ "md5", "hash" ], "data_path": "action_result.data.*.file_info.md5", "data_type": "string" }, { "contains": [ "sha1", "hash" ], "data_path": "action_result.data.*.file_info.sha1", "data_type": "string" }, { "contains": [ "sha256", "hash" ], "data_path": "action_result.data.*.file_info.sha256", "data_type": "string" }, { "data_path": "action_result.data.*.file_info.size", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.#text", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.#text", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@behavior_id", "data_type": "string" }, { "contains": [ "md5", "hash" ], "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@md5", "data_type": "string" }, { "contains": [ "sha1", "hash" ], "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha1", "data_type": "string" }, { "contains": [ "sha256", "hash" ], "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha256", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@behavior_id", "data_type": "string" }, { "contains": [ "md5", "hash" ], "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@md5", "data_type": "string" }, { "contains": [ "sha1", "hash" ], "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha1", "data_type": "string" }, { "contains": [ "sha256", "hash" ], "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha256", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@deleted_file", "data_type": "string" }, { "contains": [ "pid" ], "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@pid", "data_type": "string" }, { "contains": [ "process name" ], "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@process_image", "data_type": "string" }, { "contains": [ "pid" ], "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@pid", "data_type": "string" }, { "contains": [ "process name" ], "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@process_image", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@written_file", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.malware", "data_type": "string" }, { "contains": [ "md5", "hash" ], "data_path": "action_result.data.*.task_info.report.*.md5", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@query", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@response", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@type", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@country", "data_type": "string" }, { "contains": [ "ip" ], "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@ip", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@port", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@country", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@ip", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@port", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.network.url.*.@host", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.network.url.*.@method", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.network.url.*.@uri", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.network.url.*.@user_agent", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.platform", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@command", "data_type": "string" }, { "contains": [ "process name" ], "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@name", "data_type": "string" }, { "contains": [ "pid" ], "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@pid", "data_type": "string" }, { "contains": [ "md5", "hash" ], "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@md5", "data_type": "string" }, { "contains": [ "file path" ], "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@name", "data_type": "string" }, { "contains": [ "sha1", "hash" ], "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha1", "data_type": "string" }, { "contains": [ "sha256", "hash" ], "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha256", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@size", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@type", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.mutex.createmutex.*.@name", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@key", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@subkey", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@data", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@key", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@subkey", "data_type": "string" }, { "contains": [ "process name" ], "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@name", "data_type": "string" }, { "contains": [ "pid" ], "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@pid", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@text", "data_type": "string" }, { "contains": [ "pid" ], "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@pid", "data_type": "string" }, { "contains": [ "process name" ], "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@process_image", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@reg_key", "data_type": "string" }, { "contains": [ "pid" ], "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@pid", "data_type": "string" }, { "contains": [ "process name" ], "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@process_image", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@reg_key", "data_type": "string" }, { "contains": [ "pid" ], "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@pid", "data_type": "string" }, { "contains": [ "process name" ], "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@process_image", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@reg_key", "data_type": "string" }, { "contains": [ "sha256", "hash" ], "data_path": "action_result.data.*.task_info.report.*.sha256", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.size", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.software", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.#text", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@details", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@id", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@score", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.task", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.#text", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.@seq", "data_type": "string" }, { "data_path": "action_result.data.*.task_info.report.*.version", "data_type": "string" }, { "data_path": "action_result.data.*.version", "data_type": "string" }, { "data_path": "action_result.summary.malware", "data_type": "string" }, { "data_path": "action_result.message", "data_type": "string" }, { "data_path": "summary.total_objects", "data_type": "numeric" }, { "data_path": "summary.total_objects_successful", "data_type": "numeric" } ], "product_name": "WildFire", "product_vendor": "Palo Alto Networks", "type": "sandbox" } ], "attrs": { ".action": { "text": "detonate file" }, ".background": { "fill": "#000000", "stroke": "#5C6773" }, ".color-band": { "fill": "#3C444D" }, ".inPorts>.port-in": { "ref": ".background", "ref-x": 0.5 }, ".inPorts>.port-in>.port-body": { "port": { "id": "in", "type": "in" } }, ".message": { "fill": "#FFFFFF", "font-size": 12, "font-weight": 300, "opacity": 0, "ref": ".background", "ref-x": 5, "ref-y": 105, "text": "Configuring now" }, ".outPorts>.port-out": { "ref": ".background", "ref-x": 0.5 }, ".outPorts>.port-out>.port-body": { "port": { "id": "out", "type": "out" } }, ".title": { "text": "Investigate" }, "g.approver image": { "opacity": 1 }, "g.code image": { "opacity": 1 }, "g.delete": { "display": "none" }, "g.error": { "opacity": 0 }, "g.icon image": { "xlink:href": "/inc/coa/img/block_icon_investigate.svg" }, "g.notes": { "display": "block", "opacity": 1 }, "g.notes image": { "opacity": 1, "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" }, "g.timer image": { "opacity": 1 }, "rect.warn-background": { "fill": "#FFFFFF" }, "text.icon": { "fill": "#FFFFFF" } }, "block_code": "def detonate_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('detonate_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'detonate_file_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.vaultId', 'filtered-data:filter_4:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'detonate_file_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'vault_id': filtered_artifacts_item_1[0],\n 'file_name': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"detonate file\", parameters=parameters, assets=['wildfire'], callback=filter_5, name=\"detonate_file_1\")\n\n return", "callback_code": "", "callback_start": 1, "callsback": true, "color": "#654796", "connected_to_start": true, "connection_name": "file reputation", "connection_type": "action", "custom_callback": "", "custom_code": "", "custom_join": "", "custom_name": "", "delay": 0, "description": "Detonate the file(s) in the vault.", "has_custom": false, "has_custom_block": false, "has_custom_callback": false, "has_custom_join": false, "id": "12461935-1aee-4aec-878c-0e2fb1742912", "inPorts": [ "in" ], "join_code": "", "join_optional": [], "join_start": 135, "line_end": 240, "line_start": 216, "message": "Configuring now", "name": "detonate file", "notes": "Detonate the file(s) in the vault.", "number": 1, "order": 10, "outPorts": [ "out" ], "ports": { "groups": { "in": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "left" } }, "position": { "name": "left" } }, "out": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "right" } }, "position": { "name": "right" } } } }, "position": { "x": 780, "y": 240 }, "previous_function": "", "previous_name": "detonate_file_1", "required_params": { "vault_id": true }, "reviewer": "", "show_number": false, "size": { "height": 112, "width": 168 }, "state": "asset", "status": "", "title": "Investigate", "type": "coa.Action", "warn": false, "z": 2026 }, { "attrs": { ".connection": { "stroke": "#818D99", "stroke-width": 2 }, ".marker-target": { "d": "M 10 0 L 0 5 L 10 10 z", "fill": "#818D99", "stroke": "#818D99" } }, "connector": { "args": { "radius": 5 }, "name": "rounded" }, "endDirections": [ "left" ], "id": "13fce689-6a47-484b-a70a-aa77e2e79cb1", "router": { "name": "metro" }, "source": { "id": "214e20f6-a5fb-4409-b2f2-752d24605d9c", "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" }, "startDirections": [ "right" ], "target": { "id": "f989d5e9-9586-408e-b424-8a3a5384936a", "selector": ".port-body[type=\"input\"]" }, "type": "link", "z": 2037 }, { "attrs": { ".connection": { "stroke": "#818D99", "stroke-width": 2 }, ".marker-target": { "d": "M 10 0 L 0 5 L 10 10 z", "fill": "#818D99", "stroke": "#818D99" } }, "connector": { "args": { "radius": 5 }, "name": "rounded" }, "endDirections": [ "left" ], "id": "eeca94e9-2c8b-4474-ad9f-39da792e28a3", "router": { "name": "metro" }, "source": { "id": "35f205e2-949e-463e-9057-658f597b1dc9", "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" }, "startDirections": [ "right" ], "target": { "id": "f989d5e9-9586-408e-b424-8a3a5384936a", "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" }, "type": "link", "z": 2040 }, { "active": false, "angle": 0, "attrs": { ".background": { "fill": "#000000", "stroke": "#5C6773", "transform": "rotate(45 30 70)" }, ".border": { "transform": "rotate(45 30 70)" }, ".inPorts>.port-0>.port-body": { "port": { "id": "in", "type": "in" } }, ".number": { "text": 4 }, ".outPorts>.port-0": { "port": { "id": "out-1", "type": "out" }, "ref-x": 83, "ref-y": 40 }, ".outPorts>.port-0>.port-body": { "port": { "id": "out-1", "type": "out" } }, "g.delete": { "display": "none" }, "g.error": { "opacity": 0 }, "g.notes": { "display": "block", "opacity": 1 }, "g.notes image": { "opacity": 1, "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" } }, "block_code": "def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_4() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"filtered-data:filter_3:condition_1:artifact:*.cef.vaultId\", \"!=\", \"\"],\n ],\n name=\"filter_4:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n detonate_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return", "callback_code": "", "callback_start": 1, "callsback": false, "connected_to_start": true, "connection_name": "file reputation", "connection_type": "action", "custom_callback": "", "custom_code": "", "custom_join": "", "custom_name": "filter 4", "description": "Detonate file requires a Vault file, so only proceed if vaultId is not null.", "has_custom": false, "has_custom_block": false, "has_custom_callback": false, "has_custom_join": false, "id": "bef1c9d9-aa68-4355-8ea3-66637924fc29", "inPorts": [ "in" ], "join_code": "", "join_optional": [], "join_start": 1, "line_end": 89, "line_start": 71, "name": "filter", "notes": "Detonate file requires a Vault file, so only proceed if vaultId is not null.", "number": 4, "order": 4, "outPorts": [ "out-1" ], "outputs": [ { "conditions": [ { "comparison": "!=", "data_type": "", "param": "filtered-data:filter_3:condition_1:artifact:*.cef.vaultId", "value": "" } ], "display": "If", "logic": "and", "type": "if" } ], "ports": { "groups": { "in": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "left" } }, "position": { "name": "left" } }, "out": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "right" } }, "position": { "name": "right" } } } }, "position": { "x": 640, "y": 240 }, "previous_function": "", "previous_name": "filter_4", "show_number": true, "size": { "height": 82, "width": 82 }, "state": "filter", "status": "", "type": "coa.Filter", "warn": false, "z": 2059 }, { "action": "hunt file", "action_type": "investigate", "active": false, "active_keys": {}, "active_values": { "hash": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5", "range": "", "type": "" }, "angle": 0, "app": "", "approver": "", "assets": [ { "action": "", "active": true, "app_name": "", "app_version": "", "appid": "", "config_type": "asset", "fields": { "hash": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5", "range": "", "type": "" }, "has_app": true, "id": "-", "loaded": false, "missing": false, "name": "carbonblack", "output": [ { "data_path": "action_result.status", "data_type": "string", "example_values": [ "success" ] }, { "contains": [ "hash", "md5" ], "data_path": "action_result.parameter.hash", "data_type": "string", "example_values": [ "4fb491ac8d46aaf22ba8bc5c73dabef7", "13ded573464ba7f43fe640479b309e09", "9bf50324444c46997c2492d505b47f2d", "5FB30FE90736C7FC77DE637021B1CE7C" ] }, { "data_path": "action_result.parameter.range", "data_type": "string", "example_values": [ "0-10", "0-2", "5-8" ] }, { "contains": [ "carbon black query type" ], "data_path": "action_result.parameter.type", "data_type": "string", "example_values": [ "process", "binary" ] }, { "data_path": "action_result.data.*.binary.elapsed", "data_type": "numeric", "example_values": [ 0.1120398044586182, 0.04952096939086914, 0.1234798431396484, 0.05507302284240723, 0.05384993553161621 ] }, { "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name", "data_type": "numeric", "example_values": [ 0 ] }, { "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value", "data_type": "numeric", "example_values": [ 0 ] }, { "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name", "data_type": "string", "example_values": [ "Microsoft Corporation" ] }, { "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio", "data_type": "string", "example_values": [ "100.0" ] }, { "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name", "data_type": "string", "example_values": [ "Microsoft Corporation" ] }, { "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio", "data_type": "string", "example_values": [ "100.0" ] }, { "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.binary.facets.digsig_result.*.name", "data_type": "string", "example_values": [ "Signed" ] }, { "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio", "data_type": "string", "example_values": [ "100.0" ] }, { "data_path": "action_result.data.*.binary.facets.digsig_result.*.value", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name", "data_type": "string", "example_values": [ "2018-10-01T00:00:00Z", "2015-01-01T00:00:00Z", "2013-11-01T00:00:00Z" ] }, { "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value", "data_type": "numeric", "example_values": [ 1, 0 ] }, { "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name", "data_type": "string", "example_values": [ "16.0.10827.20181", "4.7.0205.0", "6.1.7600.16385 (win7_rtm.090713-1255)" ] }, { "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio", "data_type": "string", "example_values": [ "100.0" ] }, { "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.binary.facets.group.*.name", "data_type": "string", "example_values": [ "default group" ] }, { "data_path": "action_result.data.*.binary.facets.group.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.binary.facets.group.*.ratio", "data_type": "string", "example_values": [ "100.0" ] }, { "data_path": "action_result.data.*.binary.facets.group.*.value", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.binary.facets.host_count.*.name", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.binary.facets.host_count.*.value", "data_type": "numeric", "example_values": [ 1, 0 ] }, { "data_path": "action_result.data.*.binary.facets.hostname.*.name", "data_type": "string", "example_values": [ "CB-TEST-02", "WIN7-CLIENT1", "ACCOUNTING-PC" ] }, { "data_path": "action_result.data.*.binary.facets.hostname.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.binary.facets.hostname.*.ratio", "data_type": "string", "example_values": [ "100.0", "16.7" ] }, { "data_path": "action_result.data.*.binary.facets.hostname.*.value", "data_type": "numeric", "example_values": [ 1 ] }, { "contains": [ "file path", "file name" ], "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name", "data_type": "string", "example_values": [ "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", "c:\\program files\\microsoft security client\\nissrv.exe", "C:\\Windows\\system32\\ping.exe" ] }, { "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio", "data_type": "string", "example_values": [ "100.0", "50.0" ] }, { "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name", "data_type": "string", "example_values": [ "Microsoft Office", "Microsoft Malware Protection" ] }, { "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio", "data_type": "string", "example_values": [ "100.0" ] }, { "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name", "data_type": "string", "example_values": [ "2018-10-19T00:00:00Z", "2018-09-29T00:00:00Z", "2018-10-02T00:00:00Z" ] }, { "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value", "data_type": "numeric", "example_values": [ 1, 0 ] }, { "contains": [ "md5" ], "data_path": "action_result.data.*.binary.highlights.*.ids", "data_type": "string", "example_values": [ "13DED573464BA7F43FE640479B309E09", "9BF50324444C46997C2492D505B47F2D", "5FB30FE90736C7FC77DE637021B1CE7C" ] }, { "data_path": "action_result.data.*.binary.highlights.*.name", "data_type": "string", "example_values": [ "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST", "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST", "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST" ] }, { "contains": [ "md5" ], "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust", "data_type": "string", "example_values": [ "5fb30fe90736c7fc77de637021b1ce7c" ] }, { "contains": [ "url" ], "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust", "data_type": "string", "example_values": [ "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c" ] }, { "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust", "data_type": "numeric", "example_values": [ -100 ] }, { "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust", "data_type": "string", "example_values": [ "2018-02-07T02:37:28Z" ] }, { "data_path": "action_result.data.*.binary.results.*.cb_version", "data_type": "numeric", "example_values": [ 610, 510, 511 ] }, { "data_path": "action_result.data.*.binary.results.*.company_name", "data_type": "string", "example_values": [ "Microsoft Corporation" ] }, { "data_path": "action_result.data.*.binary.results.*.copied_mod_len", "data_type": "numeric", "example_values": [ 9683736, 366512, 16896 ] }, { "data_path": "action_result.data.*.binary.results.*.digsig_issuer", "data_type": "string", "example_values": [ "Microsoft Code Signing PCA" ] }, { "data_path": "action_result.data.*.binary.results.*.digsig_prog_name", "data_type": "string", "example_values": [ "Microsoft Office", "Microsoft Corp." ] }, { "data_path": "action_result.data.*.binary.results.*.digsig_publisher", "data_type": "string", "example_values": [ "Microsoft Corporation" ] }, { "data_path": "action_result.data.*.binary.results.*.digsig_result", "data_type": "string", "example_values": [ "Signed" ] }, { "data_path": "action_result.data.*.binary.results.*.digsig_result_code", "data_type": "string", "example_values": [ "0" ] }, { "data_path": "action_result.data.*.binary.results.*.digsig_sign_time", "data_type": "string", "example_values": [ "2018-10-14T20:23:00Z", "2015-01-30T19:14:00Z", "2009-07-14T10:17:00Z" ] }, { "data_path": "action_result.data.*.binary.results.*.digsig_subject", "data_type": "string", "example_values": [ "Microsoft Corporation" ] }, { "data_path": "action_result.data.*.binary.results.*.endpoint", "data_type": "string", "example_values": [ "CB-TEST-02|27", "WIN7-CLIENT1|15", "DC1|19" ] }, { "data_path": "action_result.data.*.binary.results.*.event_partition_id", "data_type": "numeric", "example_values": [ 100972684312576, 100955696070656 ] }, { "data_path": "action_result.data.*.binary.results.*.facet_id", "data_type": "numeric", "example_values": [ 883737, 0 ] }, { "data_path": "action_result.data.*.binary.results.*.file_desc", "data_type": "string", "example_values": [ "Microsoft Office Click-to-Run (SxS)", "Microsoft Network Realtime Inspection Service", "TCP/IP Ping Command" ] }, { "data_path": "action_result.data.*.binary.results.*.file_version", "data_type": "string", "example_values": [ "16.0.10827.20181", "4.7.0205.0", "6.1.7600.16385 (win7_rtm.090713-1255)" ] }, { "data_path": "action_result.data.*.binary.results.*.group", "data_type": "string", "example_values": [ "Default Group" ] }, { "data_path": "action_result.data.*.binary.results.*.host_count", "data_type": "numeric", "example_values": [ 1, 6 ] }, { "contains": [ "file name" ], "data_path": "action_result.data.*.binary.results.*.internal_name", "data_type": "string", "example_values": [ "OfficeClickToRun.exe", "NisSrv.exe", "ping.exe" ] }, { "data_path": "action_result.data.*.binary.results.*.is_64bit", "data_type": "boolean", "example_values": [ false, true ] }, { "data_path": "action_result.data.*.binary.results.*.is_executable_image", "data_type": "boolean", "example_values": [ false, true ] }, { "data_path": "action_result.data.*.binary.results.*.last_seen", "data_type": "string", "example_values": [ "2018-10-28T10:06:02.456Z", "2018-10-28T10:06:42.455Z", "2018-10-26T00:01:41.224Z" ] }, { "data_path": "action_result.data.*.binary.results.*.legal_copyright", "data_type": "string", "example_values": [ "Microsoft Corporation. All rights reserved." ] }, { "contains": [ "md5" ], "data_path": "action_result.data.*.binary.results.*.md5", "data_type": "string", "example_values": [ "13DED573464BA7F43FE640479B309E09", "9BF50324444C46997C2492D505B47F2D", "5FB30FE90736C7FC77DE637021B1CE7C" ] }, { "contains": [ "file path", "file name" ], "data_path": "action_result.data.*.binary.results.*.observed_filename", "data_type": "string", "example_values": [ "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe", "c:\\program files\\microsoft security client\\nissrv.exe", "c:\\windows\\system32\\ping.exe" ] }, { "data_path": "action_result.data.*.binary.results.*.orig_mod_len", "data_type": "numeric", "example_values": [ 9683736, 366512, 16896 ] }, { "contains": [ "file name" ], "data_path": "action_result.data.*.binary.results.*.original_filename", "data_type": "string", "example_values": [ "OfficeClickToRun.exe", "NisSrv.exe", "ping.exe.mui" ] }, { "data_path": "action_result.data.*.binary.results.*.os_type", "data_type": "string", "example_values": [ "Windows" ] }, { "data_path": "action_result.data.*.binary.results.*.product_name", "data_type": "string", "example_values": [ "Microsoft Office", "Microsoft Malware Protection" ] }, { "data_path": "action_result.data.*.binary.results.*.product_version", "data_type": "string", "example_values": [ "16.0.10827.20181", "4.7.0205.0", "6.1.7600.16385" ] }, { "data_path": "action_result.data.*.binary.results.*.server_added_timestamp", "data_type": "string", "example_values": [ "2018-10-19T17:04:47.906Z", "2015-07-01T02:12:21.783Z", "2015-05-15T07:23:54.846Z" ] }, { "column_name": "Signed", "column_order": 1, "data_path": "action_result.data.*.binary.results.*.signed", "data_type": "string", "example_values": [ "Signed" ] }, { "data_path": "action_result.data.*.binary.results.*.timestamp", "data_type": "string", "example_values": [ "2018-10-19T17:04:47.906Z", "2015-07-01T02:12:21.783Z", "2015-05-15T07:23:54.846Z" ] }, { "data_path": "action_result.data.*.binary.results.*.watchlists.*.value", "data_type": "string", "example_values": [ "2015-07-01T02:20:02.062Z", "2015-05-15T07:30:02.843Z" ] }, { "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid", "data_type": "string", "example_values": [ "5" ] }, { "data_path": "action_result.data.*.binary.start", "data_type": "numeric", "example_values": [ 0, 5 ] }, { "data_path": "action_result.data.*.binary.terms", "data_type": "string", "example_values": [ "md5:13ded573464ba7f43fe640479b309e09", "md5:9bf50324444c46997c2492d505b47f2d", "md5:5FB30FE90736C7FC77DE637021B1CE7C" ] }, { "data_path": "action_result.data.*.binary.total_results", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "action_result.data.*.process.all_segments", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.process.comprehensive_search", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.process.elapsed", "data_type": "numeric", "example_values": [ 0.2200779914855957 ] }, { "data_path": "action_result.data.*.process.facets.day_of_week.*.name", "data_type": "string", "example_values": [ "0" ] }, { "data_path": "action_result.data.*.process.facets.day_of_week.*.value", "data_type": "numeric", "example_values": [ 1566 ] }, { "data_path": "action_result.data.*.process.facets.group.*.name", "data_type": "string", "example_values": [ "default group" ] }, { "data_path": "action_result.data.*.process.facets.group.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.process.facets.group.*.ratio", "data_type": "string", "example_values": [ "100.0" ] }, { "data_path": "action_result.data.*.process.facets.group.*.value", "data_type": "numeric", "example_values": [ 10128 ] }, { "data_path": "action_result.data.*.process.facets.host_type.*.name", "data_type": "string", "example_values": [ "domain_controller" ] }, { "data_path": "action_result.data.*.process.facets.host_type.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.process.facets.host_type.*.ratio", "data_type": "string", "example_values": [ "100.0" ] }, { "data_path": "action_result.data.*.process.facets.host_type.*.value", "data_type": "numeric", "example_values": [ 10123 ] }, { "data_path": "action_result.data.*.process.facets.hostname.*.name", "data_type": "string", "example_values": [ "dc2" ] }, { "data_path": "action_result.data.*.process.facets.hostname.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.process.facets.hostname.*.ratio", "data_type": "string", "example_values": [ "51.2" ] }, { "data_path": "action_result.data.*.process.facets.hostname.*.value", "data_type": "numeric", "example_values": [ 5185 ] }, { "data_path": "action_result.data.*.process.facets.hour_of_day.*.name", "data_type": "string", "example_values": [ "0" ] }, { "data_path": "action_result.data.*.process.facets.hour_of_day.*.value", "data_type": "numeric", "example_values": [ 411 ] }, { "contains": [ "file name" ], "data_path": "action_result.data.*.process.facets.parent_name.*.name", "data_type": "string", "example_values": [ "svchost.exe" ] }, { "data_path": "action_result.data.*.process.facets.parent_name.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.process.facets.parent_name.*.ratio", "data_type": "string", "example_values": [ "98.5" ] }, { "data_path": "action_result.data.*.process.facets.parent_name.*.value", "data_type": "numeric", "example_values": [ 9971 ] }, { "contains": [ "file path", "file name" ], "data_path": "action_result.data.*.process.facets.path_full.*.name", "data_type": "string", "example_values": [ "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" ] }, { "data_path": "action_result.data.*.process.facets.path_full.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.process.facets.path_full.*.ratio", "data_type": "string", "example_values": [ "98.5" ] }, { "data_path": "action_result.data.*.process.facets.path_full.*.value", "data_type": "numeric", "example_values": [ 9971 ] }, { "contains": [ "md5" ], "data_path": "action_result.data.*.process.facets.process_md5.*.name", "data_type": "string", "example_values": [ "4fb491ac8d46aaf22ba8bc5c73dabef7" ] }, { "data_path": "action_result.data.*.process.facets.process_md5.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.process.facets.process_md5.*.ratio", "data_type": "string", "example_values": [ "98.5" ] }, { "data_path": "action_result.data.*.process.facets.process_md5.*.value", "data_type": "numeric", "example_values": [ 9971 ] }, { "contains": [ "file name" ], "data_path": "action_result.data.*.process.facets.process_name.*.name", "data_type": "string", "example_values": [ "wmiprvse.exe" ] }, { "data_path": "action_result.data.*.process.facets.process_name.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.process.facets.process_name.*.ratio", "data_type": "string", "example_values": [ "98.5" ] }, { "data_path": "action_result.data.*.process.facets.process_name.*.value", "data_type": "numeric", "example_values": [ 9971 ] }, { "data_path": "action_result.data.*.process.facets.start.*.name", "data_type": "string", "example_values": [ "2018-02-24T00:00:00Z" ] }, { "data_path": "action_result.data.*.process.facets.start.*.value", "data_type": "numeric", "example_values": [ 324 ] }, { "data_path": "action_result.data.*.process.facets.username_full.*.name", "data_type": "string", "example_values": [ "LOCAL SERVICE" ] }, { "data_path": "action_result.data.*.process.facets.username_full.*.percent", "data_type": "numeric", "example_values": [ 100 ] }, { "data_path": "action_result.data.*.process.facets.username_full.*.ratio", "data_type": "string", "example_values": [ "98.4" ] }, { "data_path": "action_result.data.*.process.facets.username_full.*.value", "data_type": "numeric", "example_values": [ 9966 ] }, { "data_path": "action_result.data.*.process.incomplete_results", "data_type": "boolean", "example_values": [ true, false ] }, { "contains": [ "md5" ], "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust", "data_type": "string", "example_values": [ "4fb491ac8d46aaf22ba8bc5c73dabef7" ] }, { "contains": [ "url" ], "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust", "data_type": "string", "example_values": [ "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7" ] }, { "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust", "data_type": "numeric", "example_values": [ -100 ] }, { "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust", "data_type": "string", "example_values": [ "2018-02-07T02:37:28Z" ] }, { "data_path": "action_result.data.*.process.results.*.childproc_count", "data_type": "numeric", "example_values": [ 0 ] }, { "contains": [ "file path" ], "data_path": "action_result.data.*.process.results.*.cmdline", "data_type": "string", "example_values": [ "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding" ] }, { "data_path": "action_result.data.*.process.results.*.comms_ip", "data_type": "numeric", "example_values": [ 168886572 ] }, { "data_path": "action_result.data.*.process.results.*.crossproc_count", "data_type": "numeric", "example_values": [ 2 ] }, { "data_path": "action_result.data.*.process.results.*.emet_config", "data_type": "string", "example_values": [ "" ] }, { "data_path": "action_result.data.*.process.results.*.emet_count", "data_type": "numeric", "example_values": [ 0 ] }, { "data_path": "action_result.data.*.process.results.*.filemod_count", "data_type": "numeric", "example_values": [ 0 ] }, { "data_path": "action_result.data.*.process.results.*.filtering_known_dlls", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.process.results.*.group", "data_type": "string", "example_values": [ "default group" ] }, { "data_path": "action_result.data.*.process.results.*.host_type", "data_type": "string", "example_values": [ "workstation" ] }, { "contains": [ "host name" ], "data_path": "action_result.data.*.process.results.*.hostname", "data_type": "string", "example_values": [ "win7-client1" ] }, { "contains": [ "carbon black process id" ], "data_path": "action_result.data.*.process.results.*.id", "data_type": "string", "example_values": [ "0000000f-0000-0688-01d3-27738c9b4243" ] }, { "data_path": "action_result.data.*.process.results.*.interface_ip", "data_type": "numeric", "example_values": [ 168886572 ] }, { "data_path": "action_result.data.*.process.results.*.last_server_update", "data_type": "string", "example_values": [ "2018-03-22T09:21:32.332Z" ] }, { "data_path": "action_result.data.*.process.results.*.last_update", "data_type": "string", "example_values": [ "2017-09-07T00:52:15.82Z" ] }, { "data_path": "action_result.data.*.process.results.*.modload_count", "data_type": "numeric", "example_values": [ 43 ] }, { "data_path": "action_result.data.*.process.results.*.netconn_count", "data_type": "numeric", "example_values": [ 0 ] }, { "data_path": "action_result.data.*.process.results.*.os_type", "data_type": "string", "example_values": [ "windows" ] }, { "data_path": "action_result.data.*.process.results.*.parent_id", "data_type": "string", "example_values": [ "0000000f-0000-0258-01d1-ec51b545a19b" ] }, { "data_path": "action_result.data.*.process.results.*.parent_md5", "data_type": "string", "example_values": [ "000000000000000000000000000000" ] }, { "contains": [ "file name" ], "data_path": "action_result.data.*.process.results.*.parent_name", "data_type": "string", "example_values": [ "svchost.exe" ] }, { "data_path": "action_result.data.*.process.results.*.parent_pid", "data_type": "numeric", "example_values": [ 600 ] }, { "data_path": "action_result.data.*.process.results.*.parent_unique_id", "data_type": "string", "example_values": [ "0000000f-0000-0258-01d1-ec51b545a19b-000000000001" ] }, { "contains": [ "file path", "file name" ], "data_path": "action_result.data.*.process.results.*.path", "data_type": "string", "example_values": [ "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" ] }, { "contains": [ "md5" ], "data_path": "action_result.data.*.process.results.*.process_md5", "data_type": "string", "example_values": [ "4fb491ac8d46aaf22ba8bc5c73dabef7" ] }, { "contains": [ "process name", "file name" ], "data_path": "action_result.data.*.process.results.*.process_name", "data_type": "string", "example_values": [ "wmiprvse.exe" ] }, { "contains": [ "pid" ], "data_path": "action_result.data.*.process.results.*.process_pid", "data_type": "numeric", "example_values": [ 1672 ] }, { "data_path": "action_result.data.*.process.results.*.processblock_count", "data_type": "numeric", "example_values": [ 0 ] }, { "data_path": "action_result.data.*.process.results.*.regmod_count", "data_type": "numeric", "example_values": [ 0 ] }, { "data_path": "action_result.data.*.process.results.*.segment_id", "data_type": "numeric", "example_values": [ 1 ] }, { "contains": [ "carbon black sensor id" ], "data_path": "action_result.data.*.process.results.*.sensor_id", "data_type": "numeric", "example_values": [ 15 ] }, { "data_path": "action_result.data.*.process.results.*.start", "data_type": "string", "example_values": [ "2017-09-07T00:52:15.758Z" ] }, { "data_path": "action_result.data.*.process.results.*.terminated", "data_type": "boolean", "example_values": [ true, false ] }, { "data_path": "action_result.data.*.process.results.*.unique_id", "data_type": "string", "example_values": [ "0000000f-0000-0688-01d3-27738c9b4243-000000000001" ] }, { "contains": [ "user name" ], "data_path": "action_result.data.*.process.results.*.username", "data_type": "string", "example_values": [ "SYSTEM" ] }, { "data_path": "action_result.data.*.process.start", "data_type": "numeric", "example_values": [ 0 ] }, { "data_path": "action_result.data.*.process.terms", "data_type": "string", "example_values": [ "md5:4fb491ac8d46aaf22ba8bc5c73dabef7" ] }, { "data_path": "action_result.data.*.process.total_results", "data_type": "numeric", "example_values": [ 32404 ] }, { "data_path": "action_result.summary.device_count", "data_type": "numeric", "example_values": [ 32404, 1 ] }, { "data_path": "action_result.message", "data_type": "string", "example_values": [ "Displaying 10 'process' results of total 32404", "Displaying 1 'binary' results of total 1", "Displaying 0 'binary' results of total 1" ] }, { "data_path": "summary.total_objects", "data_type": "numeric", "example_values": [ 1 ] }, { "data_path": "summary.total_objects_successful", "data_type": "numeric", "example_values": [ 1 ] } ], "product_name": "", "product_vendor": "", "type": "endpoint" } ], "attrs": { ".action": { "text": "hunt file 2" }, ".background": { "fill": "#000000", "stroke": "#5C6773" }, ".border": { "height": 88 }, ".color-band": { "fill": "#3C444D" }, ".inPorts>.port-in": { "ref": ".background", "ref-x": 0.5 }, ".inPorts>.port-in>.port-body": { "port": { "id": "in", "type": "in" } }, ".message": { "fill": "#FFFFFF", "font-size": 12, "font-weight": 300, "opacity": 0, "ref": ".background", "ref-x": 5, "ref-y": 105, "text": "Configuring now" }, ".outPorts>.port-out": { "ref": ".background", "ref-x": 0.5 }, ".outPorts>.port-out>.port-body": { "port": { "id": "out", "type": "out" } }, ".title": { "text": "Investigate" }, "g.approver image": { "opacity": 1 }, "g.code image": { "opacity": 1 }, "g.delete": { "display": "none" }, "g.error": { "opacity": 0 }, "g.icon image": { "xlink:href": "/inc/coa/img/block_icon_investigate.svg" }, "g.notes": { "display": "block", "opacity": 1 }, "g.notes image": { "opacity": 1, "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" }, "g.timer image": { "opacity": 1 }, "rect.warn-background": { "fill": "#FFFFFF" }, "text.icon": { "fill": "#FFFFFF" } }, "block_code": "def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_2' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5\", \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_2' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name=\"hunt_file_2\")\n\n return", "callback_code": "", "callback_start": 68, "callsback": true, "color": "#654796", "connected_to_start": true, "connection_name": "detonate file", "connection_type": "action", "custom_callback": "", "custom_code": "", "custom_join": "", "custom_name": "", "delay": 0, "description": "Hunt for binaries with the malicious fileHash across endpoints.", "has_custom": false, "has_custom_block": false, "has_custom_callback": false, "has_custom_join": false, "id": "35f205e2-949e-463e-9057-658f597b1dc9", "inPorts": [ "in" ], "join_code": "", "join_optional": [], "join_start": 215, "line_end": 68, "line_start": 43, "message": "Configuring now", "name": "hunt file", "notes": "Hunt for binaries with the malicious fileHash across endpoints.", "number": 2, "order": 3, "outPorts": [ "out" ], "ports": { "groups": { "in": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "left" } }, "position": { "name": "left" } }, "out": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "right" } }, "position": { "name": "right" } } } }, "position": { "x": 1160, "y": 240 }, "previous_function": "", "previous_name": "hunt_file_2", "required_params": { "hash": true }, "reviewer": "", "show_number": true, "size": { "height": 112, "width": 168 }, "state": "asset", "status": "", "title": "Investigate", "type": "coa.Action", "warn": false, "z": 2065 }, { "active": false, "angle": 0, "attrs": { ".background": { "fill": "#000000", "stroke": "#5C6773" }, ".color-band": { "fill": "#3C444D" }, ".format": { "text": "format_for_emailer" }, ".inPorts>.port-in": { "ref": ".background", "ref-x": 0.5 }, ".inPorts>.port-in>.port-body": { "port": { "id": "in", "type": "in" } }, ".message": { "opacity": 0, "text": "Configuring now" }, ".outPorts>.port-out-1": { "ref": ".background", "ref-x": 0.5 }, ".outPorts>.port-out-1>.port-body": { "port": { "id": "out-1", "type": "out" } }, ".title": { "text": "format" }, "g.delete": { "display": "none" }, "g.error": { "opacity": 0 }, "g.error image": { "xlink:href": "/inc/coa/img/block_icon_warn.svg" }, "g.notes": { "display": "block" }, "g.notes image": { "opacity": 1, "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" } }, "block_code": "def format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('format_for_emailer() called')\n \n template = \"\"\"Malware in a security event has been confirmed using file reputation and/or file detonation services.\n\nReputation Results:\nUsing file reputation services, the following file hashes have been identified as malware:\n{0}\n\nEDR tool detects that the above file hashes are present on the following endpoints: \n{1}\n\nDetonation Results:\nUsing sandboxing services, the following file hashes have been identified as malware:\n{2}\n\nThe Phantom Vault ID for the malicious files, as determined by the sandbox service, are as follows:\n{3}\n\nEDR tool detects that the file hashes indicated as positives per the sandbox service are present on the following endpoints: \n{4}\n\nContainer id: {5}\n\n[EOM]\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"hunt_file_1:action_result.parameter.hash\",\n \"hunt_file_1:action_result.data.*.process.results.*.hostname\",\n \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5\",\n \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.vault_id\",\n \"hunt_file_2:action_result.data.*.process.results.*.hostname\",\n \"container:id\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"format_for_emailer\")\n\n send_email_1(container=container)\n\n return", "callback_code": "", "callback_start": 1, "callsback": false, "connected_to_start": true, "connection_name": "hunt file 1, hunt file 2", "connection_type": "action", "custom_callback": "", "custom_code": "", "custom_join": "", "custom_name": "format_for_emailer", "description": "Format all results for an email.", "format": "format", "has_custom": false, "has_custom_block": false, "has_custom_callback": false, "has_custom_join": false, "id": "f989d5e9-9586-408e-b424-8a3a5384936a", "inPorts": [ "in" ], "join_code": "def join_format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('join_format_for_emailer() called')\n\n # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n if phantom.completed(action_names=['hunt_file_1', 'hunt_file_2']):\n \n # call connected block \"format_for_emailer\"\n format_for_emailer(container=container, handle=handle)\n \n return", "join_optional": [], "join_start": 314, "line_end": 325, "line_start": 272, "message": "Configuring now", "name": "format", "notes": "Format all results for an email.", "number": 2, "order": 12, "outPorts": [ "out-1" ], "parameters": [ { "position": 0, "type": "", "value": "hunt_file_1:action_result.parameter.hash" }, { "position": 1, "type": "", "value": "hunt_file_1:action_result.data.*.process.results.*.hostname" }, { "position": 2, "type": "", "value": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5" }, { "position": 3, "type": "", "value": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.vault_id" }, { "position": 4, "type": "", "value": "hunt_file_2:action_result.data.*.process.results.*.hostname" }, { "position": 5, "type": "", "value": "container:id" } ], "ports": { "groups": { "in": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "left" } }, "position": { "name": "left" } }, "out": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "right" } }, "position": { "name": "right" } } } }, "position": { "x": 1400, "y": 100 }, "previous_function": "", "previous_name": "format_for_emailer", "show_number": true, "size": { "height": 100, "width": 180 }, "state": "format", "status": "", "template": "Malware in a security event has been confirmed using file reputation and/or file detonation services.\n\nReputation Results:\nUsing file reputation services, the following file hashes have been identified as malware:\n{0}\n\nEDR tool detects that the above file hashes are present on the following endpoints: \n{1}\n\nDetonation Results:\nUsing sandboxing services, the following file hashes have been identified as malware:\n{2}\n\nThe Phantom Vault ID for the malicious files, as determined by the sandbox service, are as follows:\n{3}\n\nEDR tool detects that the file hashes indicated as positives per the sandbox service are present on the following endpoints: \n{4}\n\n\nContainer id: {5}\n\n[EOM]", "title": "format", "type": "coa.Format", "warn": false, "z": 2067 }, { "attrs": { ".connection": { "stroke": "#818D99", "stroke-width": 2 }, ".marker-target": { "d": "M 10 0 L 0 5 L 10 10 z", "fill": "#818D99", "stroke": "#818D99" } }, "connector": { "args": { "radius": 5 }, "name": "rounded" }, "endDirections": [ "left" ], "id": "24b9331c-ecbd-454d-bdbd-926babd67934", "router": { "name": "metro" }, "source": { "id": "f989d5e9-9586-408e-b424-8a3a5384936a", "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)" }, "startDirections": [ "right" ], "target": { "id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb", "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)" }, "type": "link", "z": 2068 }, { "action": "send email", "action_type": "generic", "active": false, "active_keys": {}, "active_values": { "attachments": "", "bcc": "", "body": "format_for_emailer:formatted_data", "cc": "", "from": "automation@phantom.localhost", "headers": "", "subject": "Malware event confirmed", "to": "recipient@phantom.localhost" }, "angle": 0, "app": "", "approver": "", "assets": [ { "action": "", "active": true, "app_name": "SMTP", "app_version": "1.2.29", "appid": "", "config_type": "asset", "fields": { "attachments": "", "bcc": "", "body": "format_for_emailer:formatted_data", "cc": "", "from": "automation@phantom.localhost", "headers": "", "subject": "Malware event confirmed", "to": "recipient@phantom.localhost" }, "has_app": true, "id": "-", "loaded": false, "missing": false, "name": "smtp", "output": [ { "column_name": "Status", "column_order": 0, "data_path": "action_result.status", "data_type": "string", "example_values": [ "success", "failed" ] }, { "contains": [ "vault id" ], "data_path": "action_result.parameter.attachments", "data_type": "string", "example_values": [ "ab2b2ccfba08ea538ef22f521caa01c3c2b17ccf" ] }, { "contains": [ "email" ], "data_path": "action_result.parameter.bcc", "data_type": "string", "example_values": [ "test1@testdomain.com" ] }, { "data_path": "action_result.parameter.body", "data_type": "string", "example_values": [ "Test body" ] }, { "contains": [ "email" ], "data_path": "action_result.parameter.cc", "data_type": "string", "example_values": [ "test2@testdomain.com" ] }, { "contains": [ "email" ], "data_path": "action_result.parameter.from", "data_type": "string", "example_values": [ "sender@testdomain.com" ] }, { "data_path": "action_result.parameter.headers", "data_type": "string", "example_values": [ "{\"Subject\": \"Test1\", \"To\": \"test3@testdomain.com\"}" ] }, { "data_path": "action_result.parameter.subject", "data_type": "string", "example_values": [ "Test" ] }, { "contains": [ "email" ], "data_path": "action_result.parameter.to", "data_type": "string", "example_values": [ "receiver@testdomain.com" ] }, { "data_path": "action_result.data", "data_type": "string" }, { "data_path": "action_result.summary", "data_type": "string" }, { "column_name": "Message", "column_order": 1, "data_path": "action_result.message", "data_type": "string", "example_values": [ "Email sent" ] }, { "data_path": "summary.total_objects", "data_type": "numeric" }, { "data_path": "summary.total_objects_successful", "data_type": "numeric" } ], "product_name": "SMTP", "product_vendor": "Generic", "type": "email" } ], "attrs": { ".action": { "text": "send email" }, ".background": { "fill": "#000000", "stroke": "#5C6773" }, ".color-band": { "fill": "#3C444D" }, ".inPorts>.port-in": { "ref": ".background", "ref-x": 0.5 }, ".inPorts>.port-in>.port-body": { "port": { "id": "in", "type": "in" } }, ".message": { "fill": "#FFFFFF", "font-size": 12, "font-weight": 300, "opacity": 0, "ref": ".background", "ref-x": 5, "ref-y": 105, "text": "Configuring now" }, ".outPorts>.port-out": { "ref": ".background", "ref-x": 0.5 }, ".outPorts>.port-out>.port-body": { "port": { "id": "out", "type": "out" } }, ".title": { "text": "Generic" }, "g.approver image": { "opacity": 1 }, "g.code image": { "opacity": 1 }, "g.delete": { "display": "none" }, "g.error": { "opacity": 0 }, "g.error image": { "xlink:href": "/inc/coa/img/block_icon_warn.svg" }, "g.icon image": { "xlink:href": "/inc/coa/img/block_icon_generic.svg" }, "g.notes": { "display": "block", "opacity": 1 }, "g.notes image": { "opacity": 1, "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg" }, "g.timer image": { "opacity": 1 }, "rect.warn-background": { "fill": "#FFFFFF" }, "text.icon": { "fill": "#FFFFFF" } }, "block_code": "def send_email_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('send_email_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'send_email_1' call\n formatted_data_1 = phantom.get_format_data(name='format_for_emailer')\n\n parameters = []\n \n # build parameters list for 'send_email_1' call\n parameters.append({\n 'cc': \"\",\n 'to': \"recipient@phantom.localhost\",\n 'bcc': \"\",\n 'body': formatted_data_1,\n 'from': \"automation@phantom.localhost\",\n 'headers': \"\",\n 'subject': \"Malware event confirmed\",\n 'attachments': \"\",\n })\n\n phantom.act(action=\"send email\", parameters=parameters, assets=['smtp'], name=\"send_email_1\")\n\n return", "callback_code": "", "callback_start": 1, "callsback": true, "color": "#5094D4", "connected_to_start": true, "connection_name": "hunt file 1, hunt file 2", "connection_type": "action", "custom_callback": "", "custom_code": "", "custom_join": "", "custom_name": "", "delay": 0, "description": "Send the formatted string as an email.", "has_custom": false, "has_custom_block": false, "has_custom_callback": false, "has_custom_join": false, "id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb", "inPorts": [ "in" ], "join_code": "", "join_optional": [], "join_start": 1, "line_end": 269, "line_start": 243, "message": "Configuring now", "name": "send email", "notes": "Send the formatted string as an email.", "number": 1, "order": 11, "outPorts": [ "out" ], "ports": { "groups": { "in": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "left" } }, "position": { "name": "left" } }, "out": { "attrs": { ".port-body": { "fill": "#fff", "magnet": true, "r": 10, "stroke": "#000" }, ".port-label": { "fill": "#000" } }, "label": { "position": { "args": { "y": 10 }, "name": "right" } }, "position": { "name": "right" } } } }, "position": { "x": 1640, "y": 100 }, "previous_function": "", "previous_name": "send_email_1", "required_params": { "body": true, "to": true }, "reviewer": "", "show_number": false, "size": { "height": 112, "width": 168 }, "state": "action_assets", "status": "", "title": "Generic", "type": "coa.Action", "warn": "", "z": 2069 } ] }, "notes": "The playbook uses the following Apps: \n - Virus Total (file reputation) [asset name = virustotal]\n - Palo Alto Networks Wildfire (detonate file) [asset name = wildfire]\n - Carbon Black (hunt file) [asset name = carbonblack]\n - SMTP (send email) [asset name = smtp]\n\nBe sure to update asset naming to reflect the asset names configured in your environment." }, "python_version": "3", "schema": 4, "version": "4.10.0.40961" }, "create_time": "2021-01-19T21:50:52.204902+00:00", "draft_mode": false, "labels": [ "*" ], "tags": [] }