admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
contentctl_unit_changes
splunk-security_content/playbooks/email_notification_for_malware.json
T
Lou Stella 6819bb1be7 Added email notification for malware playbook
2022-01-05 13:28:38 -06:00

8672 lines
467 KiB
JSON
Raw Permalink Blame History

{
"blockly": false,
"blockly_xml": "<xml></xml>",
"category": "Use Cases",
"coa": {
"data": {
"clean": true,
"code_block": "",
"description": "This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal \"file reputation\" and PAN WildFire \"detonate file\" are used to determine if a file is malware, and CarbonBlack Response \"hunt file\" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team.",
"hash": "cd4b30ce1b1555275490936455ad489a860c1c98",
"joint": {
"cells": [
{
"attrs": {
".connection": {
"stroke": "#6C7A89",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#6a6c8a",
"stroke": "#6a6c8a"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "b019e440-ef29-4772-bda2-a9386a65fccb",
"router": {
"name": "metro"
},
"source": {
"id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899",
"port": "out-1",
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "f86960a4-1d0d-4f37-924c-8640149388a8",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 32
},
{
"attrs": {
".connection": {
"stroke": "#6C7A89",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#6a6c8a",
"stroke": "#6a6c8a"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "eaa4fc01-be31-4366-b66d-7aaaa8cd5967",
"router": {
"name": "metro"
},
"source": {
"id": "12461935-1aee-4aec-878c-0e2fb1742912",
"port": null,
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 171
},
{
"attrs": {
".connection": {
"stroke": "#6C7A89",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#6a6c8a",
"stroke": "#6a6c8a"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "74fcb7c5-ea09-4556-90ce-c60cf8681d04",
"router": {
"name": "metro"
},
"source": {
"id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb",
"port": null,
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "cff987f2-2566-44d5-a694-26087dc2a0a2",
"port": null,
"selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
},
"type": "link",
"z": 767
},
{
"0": "S",
"1": "T",
"2": "A",
"3": "R",
"4": "T",
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"ref-x": 33,
"ref-y": 8,
"text": "START"
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.icon image": {
"ref-x": 13,
"xlink:href": "/inc/coa/img/block_icon_start.svg"
},
"g.notes": {
"display": "block"
}
},
"block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'filter_1' block\n filter_1(container=container)\n\n return",
"callback_code": "# read-only block view not available",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "",
"connection_type": "",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "",
"description": "",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "4f900fb0-068e-4214-8caa-1b065f7f9bfa",
"inPorts": [],
"join_code": "# read-only block view not available",
"join_optional": [],
"join_start": 1,
"line_end": 16,
"line_start": 8,
"name": "",
"notes": "",
"number": 0,
"order": 1,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": -120,
"y": 120
},
"previous_function": "",
"previous_name": "",
"show_number": true,
"size": {
"height": 54,
"width": 80
},
"status": "",
"title": "START",
"type": "coa.StartEnd",
"warn": false,
"z": 1394
},
{
"0": "E",
"1": "N",
"2": "D",
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".title": {
"text": "END"
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.icon image": {
"xlink:href": "/inc/coa/img/block_icon_end.svg"
},
"g.notes": {
"display": "block"
}
},
"block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return",
"callback_code": "# read-only block view not available",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "send email",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "",
"description": "",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "cff987f2-2566-44d5-a694-26087dc2a0a2",
"inPorts": [
"in"
],
"join_code": "# read-only block view not available",
"join_optional": [],
"join_start": 1,
"line_end": 338,
"line_start": 325,
"name": "",
"notes": "",
"number": 0,
"order": 13,
"outPorts": [],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 1880,
"y": 120
},
"previous_function": "",
"previous_name": "",
"show_number": true,
"size": {
"height": 54,
"width": 80
},
"status": "",
"title": "END",
"type": "coa.StartEnd",
"warn": false,
"z": 1571
},
{
"attrs": {
".connection": {
"stroke": "#6C7A89",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#6a6c8a",
"stroke": "#6a6c8a"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "1af67ff6-453c-46aa-87e1-3731e1a659a5",
"router": {
"name": "metro"
},
"source": {
"id": "4f900fb0-068e-4214-8caa-1b065f7f9bfa",
"port": null,
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899",
"port": "in",
"selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
},
"type": "link",
"z": 1682
},
{
"attrs": {
".connection": {
"stroke": "#6C7A89",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#6a6c8a",
"stroke": "#6a6c8a"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "d4f646d5-8ec0-41ef-8519-cd07b8de14f3",
"router": {
"name": "metro"
},
"source": {
"id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb",
"port": "out-1",
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "35f205e2-949e-463e-9057-658f597b1dc9",
"port": null,
"selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
},
"type": "link",
"z": 1834
},
{
"attrs": {
".connection": {
"stroke": "#6C7A89",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#6a6c8a",
"stroke": "#6a6c8a"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "ef8c12b6-f42d-459c-a8b1-b04690b626ee",
"router": {
"name": "metro"
},
"source": {
"id": "f86960a4-1d0d-4f37-924c-8640149388a8",
"port": null,
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 1951
},
{
"attrs": {
".connection": {
"stroke": "#6C7A89",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#6a6c8a",
"stroke": "#6a6c8a"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "0b2d5872-1c82-438a-bf42-2ffefc4b4bb1",
"router": {
"name": "metro"
},
"source": {
"id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b",
"port": "out-1",
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "214e20f6-a5fb-4409-b2f2-752d24605d9c",
"port": null,
"selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
},
"type": "link",
"z": 1954
},
{
"attrs": {
".connection": {
"stroke": "#6C7A89",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#6a6c8a",
"stroke": "#6a6c8a"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "ca25cb81-1e40-4c53-a811-3fd0be926cca",
"router": {
"name": "metro"
},
"source": {
"id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b",
"port": "out-2",
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "34337267-8e89-4ddf-a601-9040234d2744",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 1960
},
{
"attrs": {
".connection": {
"stroke": "#6C7A89",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#6a6c8a",
"stroke": "#6a6c8a"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "d3d6a860-6f58-4b63-86d5-8c1a7da31e5a",
"router": {
"name": "metro"
},
"source": {
"id": "34337267-8e89-4ddf-a601-9040234d2744",
"port": "out-1",
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "bef1c9d9-aa68-4355-8ea3-66637924fc29",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 1967
},
{
"attrs": {
".connection": {
"stroke": "#6C7A89",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#6a6c8a",
"stroke": "#6a6c8a"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "50e35606-e056-445a-b71e-84a1d6026b43",
"router": {
"name": "metro"
},
"source": {
"id": "bef1c9d9-aa68-4355-8ea3-66637924fc29",
"port": "out-1",
"selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "12461935-1aee-4aec-878c-0e2fb1742912",
"port": null,
"selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
},
"type": "link",
"z": 1969
},
{
"action": "file reputation",
"action_type": "investigate",
"active": false,
"active_keys": {},
"active_values": {
"hash": "filtered-data:initial_artifact_filter:condition_1:artifact:*.cef.fileHash"
},
"angle": 0,
"app": "",
"approver": "",
"assets": [
{
"action": "",
"active": true,
"app_name": "VirusTotal",
"app_version": "1.2.37",
"appid": "",
"config_type": "asset",
"fields": {
"hash": "filtered-data:filter_1:condition_1:artifact:*.cef.fileHash"
},
"has_app": true,
"id": "-",
"loaded": false,
"missing": false,
"name": "virustotal",
"output": [
{
"data_path": "action_result.status",
"data_type": "string",
"example_values": [
"success"
]
},
{
"contains": [
"hash",
"sha256",
"sha1",
"md5"
],
"data_path": "action_result.parameter.hash",
"data_type": "string",
"example_values": [
"6c1948f7edf115cd1f13cd170b882077930be150"
]
},
{
"contains": [
"hash",
"md5"
],
"data_path": "action_result.data.*.md5",
"data_type": "string",
"example_values": [
"494303294715f5ffad7ad3f43b73b00b"
]
},
{
"contains": [
"url"
],
"data_path": "action_result.data.*.permalink",
"data_type": "string",
"example_values": [
"https://www.test.com/file/27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7/analysis/1548112684/"
]
},
{
"data_path": "action_result.data.*.positives",
"data_type": "numeric",
"example_values": [
64
]
},
{
"contains": [
"sha1"
],
"data_path": "action_result.data.*.resource",
"data_type": "string",
"example_values": [
"6c1948f7edf115cd1f13cd170b882077930be150"
]
},
{
"data_path": "action_result.data.*.response_code",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.scan_date",
"data_type": "string",
"example_values": [
"2019-01-21 23:18:04"
]
},
{
"contains": [
"virustotal scan id"
],
"data_path": "action_result.data.*.scan_id",
"data_type": "string",
"example_values": [
"27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7-1548112684"
]
},
{
"data_path": "action_result.data.*.scans.*.detected",
"data_type": "boolean"
},
{
"data_path": "action_result.data.*.scans.*.result",
"data_type": "string"
},
{
"data_path": "action_result.data.*.scans.*.update",
"data_type": "string"
},
{
"data_path": "action_result.data.*.scans.*.version",
"data_type": "string"
},
{
"data_path": "action_result.data.*.scans.ALYac.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.ALYac.result",
"data_type": "string",
"example_values": [
"Win32.Parite.B"
]
},
{
"data_path": "action_result.data.*.scans.ALYac.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.ALYac.version",
"data_type": "string",
"example_values": [
"1.1.1.5"
]
},
{
"data_path": "action_result.data.*.scans.AVG.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.AVG.result",
"data_type": "string",
"example_values": [
"Win32:Parite"
]
},
{
"data_path": "action_result.data.*.scans.AVG.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.AVG.version",
"data_type": "string",
"example_values": [
"18.4.3895.0"
]
},
{
"data_path": "action_result.data.*.scans.AVware.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.AVware.result",
"data_type": "string",
"example_values": [
"Win32.Parite.b (v)"
]
},
{
"data_path": "action_result.data.*.scans.AVware.update",
"data_type": "string",
"example_values": [
"20180925"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.AVware.version",
"data_type": "string",
"example_values": [
"1.6.0.52"
]
},
{
"data_path": "action_result.data.*.scans.Acronis.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Acronis.result",
"data_type": "string",
"example_values": [
"suspicious"
]
},
{
"data_path": "action_result.data.*.scans.Acronis.update",
"data_type": "string",
"example_values": [
"20190119"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.Acronis.version",
"data_type": "string",
"example_values": [
"1.0.1.37"
]
},
{
"data_path": "action_result.data.*.scans.Ad-Aware.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Ad-Aware.result",
"data_type": "string",
"example_values": [
"Win32.Parite.B"
]
},
{
"data_path": "action_result.data.*.scans.Ad-Aware.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.Ad-Aware.version",
"data_type": "string",
"example_values": [
"3.0.5.370"
]
},
{
"data_path": "action_result.data.*.scans.AegisLab.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.AegisLab.result",
"data_type": "string"
},
{
"data_path": "action_result.data.*.scans.AegisLab.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.AegisLab.version",
"data_type": "string",
"example_values": [
"4.2"
]
},
{
"data_path": "action_result.data.*.scans.AhnLab-V3.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.AhnLab-V3.result",
"data_type": "string",
"example_values": [
"Win32/Parite"
]
},
{
"data_path": "action_result.data.*.scans.AhnLab-V3.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.AhnLab-V3.version",
"data_type": "string",
"example_values": [
"3.14.1.22785"
]
},
{
"data_path": "action_result.data.*.scans.Alibaba.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Alibaba.result",
"data_type": "string"
},
{
"data_path": "action_result.data.*.scans.Alibaba.update",
"data_type": "string",
"example_values": [
"20180921"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.Alibaba.version",
"data_type": "string",
"example_values": [
"0.1.0.2"
]
},
{
"data_path": "action_result.data.*.scans.Antiy-AVL.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Antiy-AVL.result",
"data_type": "string",
"example_values": [
"Virus/Win32.Parite.c"
]
},
{
"data_path": "action_result.data.*.scans.Antiy-AVL.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.Antiy-AVL.version",
"data_type": "string",
"example_values": [
"3.0.0.1"
]
},
{
"data_path": "action_result.data.*.scans.Arcabit.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Arcabit.result",
"data_type": "string",
"example_values": [
"Win32.Parite.B"
]
},
{
"data_path": "action_result.data.*.scans.Arcabit.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.Arcabit.version",
"data_type": "string",
"example_values": [
"1.0.0.837"
]
},
{
"data_path": "action_result.data.*.scans.Avast-Mobile.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Avast-Mobile.result",
"data_type": "string"
},
{
"data_path": "action_result.data.*.scans.Avast-Mobile.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.Avast-Mobile.version",
"data_type": "string",
"example_values": [
"190121-00"
]
},
{
"data_path": "action_result.data.*.scans.Avast.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Avast.result",
"data_type": "string",
"example_values": [
"Win32:Parite"
]
},
{
"data_path": "action_result.data.*.scans.Avast.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.Avast.version",
"data_type": "string",
"example_values": [
"18.4.3895.0"
]
},
{
"data_path": "action_result.data.*.scans.Avira.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Avira.result",
"data_type": "string",
"example_values": [
"W32/Parite"
]
},
{
"data_path": "action_result.data.*.scans.Avira.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.Avira.version",
"data_type": "string",
"example_values": [
"8.3.3.8"
]
},
{
"data_path": "action_result.data.*.scans.Babable.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Babable.result",
"data_type": "string"
},
{
"data_path": "action_result.data.*.scans.Babable.update",
"data_type": "string",
"example_values": [
"20180918"
]
},
{
"data_path": "action_result.data.*.scans.Babable.version",
"data_type": "string",
"example_values": [
"9107201"
]
},
{
"data_path": "action_result.data.*.scans.Baidu.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Baidu.result",
"data_type": "string",
"example_values": [
"Win32.Virus.Parite.d"
]
},
{
"data_path": "action_result.data.*.scans.Baidu.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.Baidu.version",
"data_type": "string",
"example_values": [
"1.0.0.2"
]
},
{
"data_path": "action_result.data.*.scans.BitDefender.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.BitDefender.result",
"data_type": "string",
"example_values": [
"Win32.Parite.B"
]
},
{
"data_path": "action_result.data.*.scans.BitDefender.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.BitDefender.version",
"data_type": "string",
"example_values": [
"7.2"
]
},
{
"data_path": "action_result.data.*.scans.Bkav.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Bkav.result",
"data_type": "string",
"example_values": [
"W32.Pinfi.B"
]
},
{
"data_path": "action_result.data.*.scans.Bkav.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.Bkav.version",
"data_type": "string",
"example_values": [
"1.3.0.9899"
]
},
{
"data_path": "action_result.data.*.scans.CAT-QuickHeal.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.CAT-QuickHeal.result",
"data_type": "string",
"example_values": [
"W32.Perite.A"
]
},
{
"data_path": "action_result.data.*.scans.CAT-QuickHeal.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.CAT-QuickHeal.version",
"data_type": "string",
"example_values": [
"14.00"
]
},
{
"data_path": "action_result.data.*.scans.CMC.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.CMC.result",
"data_type": "string",
"example_values": [
"Virus.Win32.Parite.b!O"
]
},
{
"data_path": "action_result.data.*.scans.CMC.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.CMC.version",
"data_type": "string",
"example_values": [
"1.1.0.977"
]
},
{
"data_path": "action_result.data.*.scans.ClamAV.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.ClamAV.result",
"data_type": "string",
"example_values": [
"Heuristics.W32.Parite.B"
]
},
{
"data_path": "action_result.data.*.scans.ClamAV.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.ClamAV.version",
"data_type": "string",
"example_values": [
"0.101.1.0"
]
},
{
"data_path": "action_result.data.*.scans.Comodo.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Comodo.result",
"data_type": "string",
"example_values": [
"Malware@#1b1651nqd7ivb"
]
},
{
"data_path": "action_result.data.*.scans.Comodo.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.Comodo.version",
"data_type": "string",
"example_values": [
"30310"
]
},
{
"data_path": "action_result.data.*.scans.CrowdStrike.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.CrowdStrike.result",
"data_type": "string",
"example_values": [
"malicious_confidence_100% (W)"
]
},
{
"data_path": "action_result.data.*.scans.CrowdStrike.update",
"data_type": "string",
"example_values": [
"20181023"
]
},
{
"data_path": "action_result.data.*.scans.CrowdStrike.version",
"data_type": "string",
"example_values": [
"1.0"
]
},
{
"data_path": "action_result.data.*.scans.Cybereason.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Cybereason.result",
"data_type": "string",
"example_values": [
"malicious.94715f"
]
},
{
"data_path": "action_result.data.*.scans.Cybereason.update",
"data_type": "string",
"example_values": [
"20190109"
]
},
{
"data_path": "action_result.data.*.scans.Cybereason.version",
"data_type": "string",
"example_values": [
"1.2.27"
]
},
{
"data_path": "action_result.data.*.scans.Cylance.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Cylance.result",
"data_type": "string",
"example_values": [
"Unsafe"
]
},
{
"data_path": "action_result.data.*.scans.Cylance.update",
"data_type": "string",
"example_values": [
"20190122"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.Cylance.version",
"data_type": "string",
"example_values": [
"2.3.1.101"
]
},
{
"data_path": "action_result.data.*.scans.Cyren.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Cyren.result",
"data_type": "string",
"example_values": [
"W32/Virut.E.gen!Eldorado"
]
},
{
"data_path": "action_result.data.*.scans.Cyren.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.Cyren.version",
"data_type": "string",
"example_values": [
"6.2.0.1"
]
},
{
"data_path": "action_result.data.*.scans.DrWeb.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.DrWeb.result",
"data_type": "string",
"example_values": [
"Trojan.DownLoader20.25948"
]
},
{
"data_path": "action_result.data.*.scans.DrWeb.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.DrWeb.version",
"data_type": "string",
"example_values": [
"7.0.34.11020"
]
},
{
"data_path": "action_result.data.*.scans.ESET-NOD32.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.ESET-NOD32.result",
"data_type": "string",
"example_values": [
"Win32/Parite.B"
]
},
{
"data_path": "action_result.data.*.scans.ESET-NOD32.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.ESET-NOD32.version",
"data_type": "string",
"example_values": [
"18744"
]
},
{
"data_path": "action_result.data.*.scans.Emsisoft.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Emsisoft.result",
"data_type": "string",
"example_values": [
"Win32.Parite.B (B)"
]
},
{
"data_path": "action_result.data.*.scans.Emsisoft.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.Emsisoft.version",
"data_type": "string",
"example_values": [
"2018.4.0.1029"
]
},
{
"data_path": "action_result.data.*.scans.Endgame.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Endgame.result",
"data_type": "string",
"example_values": [
"malicious (high confidence)"
]
},
{
"data_path": "action_result.data.*.scans.Endgame.update",
"data_type": "string",
"example_values": [
"20181108"
]
},
{
"data_path": "action_result.data.*.scans.Endgame.version",
"data_type": "string",
"example_values": [
"3.0.2"
]
},
{
"data_path": "action_result.data.*.scans.F-Prot.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.F-Prot.result",
"data_type": "string",
"example_values": [
"W32/Virut.E.gen!Eldorado"
]
},
{
"data_path": "action_result.data.*.scans.F-Prot.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.F-Prot.version",
"data_type": "string",
"example_values": [
"4.7.1.166"
]
},
{
"data_path": "action_result.data.*.scans.F-Secure.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.F-Secure.result",
"data_type": "string",
"example_values": [
"Win32.Parite.B"
]
},
{
"data_path": "action_result.data.*.scans.F-Secure.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.F-Secure.version",
"data_type": "string",
"example_values": [
"11.0.19100.45"
]
},
{
"data_path": "action_result.data.*.scans.Fortinet.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Fortinet.result",
"data_type": "string",
"example_values": [
"W32/Parite.B"
]
},
{
"data_path": "action_result.data.*.scans.Fortinet.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.Fortinet.version",
"data_type": "string",
"example_values": [
"5.4.247.0"
]
},
{
"data_path": "action_result.data.*.scans.GData.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.GData.result",
"data_type": "string",
"example_values": [
"Win32.Parite.B"
]
},
{
"data_path": "action_result.data.*.scans.GData.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.GData.version",
"data_type": "string",
"example_values": [
"A:25.20275B:25.14197"
]
},
{
"data_path": "action_result.data.*.scans.Ikarus.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Ikarus.result",
"data_type": "string",
"example_values": [
"Virus.Win32.Virut"
]
},
{
"data_path": "action_result.data.*.scans.Ikarus.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.Ikarus.version",
"data_type": "string",
"example_values": [
"0.1.5.2"
]
},
{
"data_path": "action_result.data.*.scans.Invincea.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Invincea.result",
"data_type": "string",
"example_values": [
"heuristic"
]
},
{
"data_path": "action_result.data.*.scans.Invincea.update",
"data_type": "string",
"example_values": [
"20181128"
]
},
{
"data_path": "action_result.data.*.scans.Invincea.version",
"data_type": "string",
"example_values": [
"6.3.6.26157"
]
},
{
"data_path": "action_result.data.*.scans.Jiangmin.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Jiangmin.result",
"data_type": "string",
"example_values": [
"Win32/Parite.b"
]
},
{
"data_path": "action_result.data.*.scans.Jiangmin.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.Jiangmin.version",
"data_type": "string",
"example_values": [
"16.0.100"
]
},
{
"data_path": "action_result.data.*.scans.K7AntiVirus.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.K7AntiVirus.result",
"data_type": "string",
"example_values": [
"Virus ( 00001b711 )"
]
},
{
"data_path": "action_result.data.*.scans.K7AntiVirus.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.K7AntiVirus.version",
"data_type": "string",
"example_values": [
"11.24.29740"
]
},
{
"data_path": "action_result.data.*.scans.K7GW.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.K7GW.result",
"data_type": "string",
"example_values": [
"Virus ( 00001b711 )"
]
},
{
"data_path": "action_result.data.*.scans.K7GW.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.K7GW.version",
"data_type": "string",
"example_values": [
"11.24.29740"
]
},
{
"data_path": "action_result.data.*.scans.Kaspersky.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Kaspersky.result",
"data_type": "string",
"example_values": [
"Virus.Win32.Parite.b"
]
},
{
"data_path": "action_result.data.*.scans.Kaspersky.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.Kaspersky.version",
"data_type": "string",
"example_values": [
"15.0.1.13"
]
},
{
"data_path": "action_result.data.*.scans.Kingsoft.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Kingsoft.result",
"data_type": "string",
"example_values": [
"Win32.Parite.b.5756"
]
},
{
"data_path": "action_result.data.*.scans.Kingsoft.update",
"data_type": "string",
"example_values": [
"20190122"
]
},
{
"data_path": "action_result.data.*.scans.Kingsoft.version",
"data_type": "string",
"example_values": [
"2013.8.14.323"
]
},
{
"data_path": "action_result.data.*.scans.MAX.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.MAX.result",
"data_type": "string",
"example_values": [
"malware (ai score=100)"
]
},
{
"data_path": "action_result.data.*.scans.MAX.update",
"data_type": "string",
"example_values": [
"20190122"
]
},
{
"data_path": "action_result.data.*.scans.MAX.version",
"data_type": "string",
"example_values": [
"2018.9.12.1"
]
},
{
"data_path": "action_result.data.*.scans.Malwarebytes.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Malwarebytes.result",
"data_type": "string",
"example_values": [
"Trojan.Agent.QQ"
]
},
{
"data_path": "action_result.data.*.scans.Malwarebytes.update",
"data_type": "string",
"example_values": [
"20190122"
]
},
{
"data_path": "action_result.data.*.scans.Malwarebytes.version",
"data_type": "string",
"example_values": [
"2.1.1.1115"
]
},
{
"data_path": "action_result.data.*.scans.McAfee-GW-Edition.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.McAfee-GW-Edition.result",
"data_type": "string",
"example_values": [
"BehavesLike.Win32.Pate.hh"
]
},
{
"data_path": "action_result.data.*.scans.McAfee-GW-Edition.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.McAfee-GW-Edition.version",
"data_type": "string",
"example_values": [
"v2017.3010"
]
},
{
"data_path": "action_result.data.*.scans.McAfee.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.McAfee.result",
"data_type": "string",
"example_values": [
"W32/Pate.b"
]
},
{
"data_path": "action_result.data.*.scans.McAfee.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.McAfee.version",
"data_type": "string",
"example_values": [
"6.0.6.653"
]
},
{
"data_path": "action_result.data.*.scans.MicroWorld-eScan.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.MicroWorld-eScan.result",
"data_type": "string",
"example_values": [
"Win32.Parite.B"
]
},
{
"data_path": "action_result.data.*.scans.MicroWorld-eScan.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.MicroWorld-eScan.version",
"data_type": "string",
"example_values": [
"14.0.297.0"
]
},
{
"data_path": "action_result.data.*.scans.Microsoft.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Microsoft.result",
"data_type": "string",
"example_values": [
"Virus:Win32/Parite.B"
]
},
{
"data_path": "action_result.data.*.scans.Microsoft.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.Microsoft.version",
"data_type": "string",
"example_values": [
"1.1.15500.2"
]
},
{
"data_path": "action_result.data.*.scans.NANO-Antivirus.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.NANO-Antivirus.result",
"data_type": "string",
"example_values": [
"Virus.Win32.Parite.bgvo"
]
},
{
"data_path": "action_result.data.*.scans.NANO-Antivirus.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.NANO-Antivirus.version",
"data_type": "string",
"example_values": [
"1.0.134.24576"
]
},
{
"data_path": "action_result.data.*.scans.Paloalto.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Paloalto.result",
"data_type": "string",
"example_values": [
"generic.ml"
]
},
{
"data_path": "action_result.data.*.scans.Paloalto.update",
"data_type": "string",
"example_values": [
"20190122"
]
},
{
"data_path": "action_result.data.*.scans.Paloalto.version",
"data_type": "string",
"example_values": [
"1.0"
]
},
{
"data_path": "action_result.data.*.scans.Panda.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Panda.result",
"data_type": "string",
"example_values": [
"W32/Parite.B"
]
},
{
"data_path": "action_result.data.*.scans.Panda.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.Panda.version",
"data_type": "string",
"example_values": [
"4.6.4.2"
]
},
{
"data_path": "action_result.data.*.scans.Qihoo-360.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Qihoo-360.result",
"data_type": "string",
"example_values": [
"Virus.Win32.Parite.H"
]
},
{
"data_path": "action_result.data.*.scans.Qihoo-360.update",
"data_type": "string",
"example_values": [
"20190122"
]
},
{
"data_path": "action_result.data.*.scans.Qihoo-360.version",
"data_type": "string",
"example_values": [
"1.0.0.1120"
]
},
{
"data_path": "action_result.data.*.scans.Rising.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Rising.result",
"data_type": "string",
"example_values": [
"Virus.Parite!1.9B80 (CLOUD)"
]
},
{
"data_path": "action_result.data.*.scans.Rising.update",
"data_type": "string",
"example_values": [
"20190122"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.Rising.version",
"data_type": "string",
"example_values": [
"25.0.0.24"
]
},
{
"data_path": "action_result.data.*.scans.SUPERAntiSpyware.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.SUPERAntiSpyware.result",
"data_type": "string"
},
{
"data_path": "action_result.data.*.scans.SUPERAntiSpyware.update",
"data_type": "string",
"example_values": [
"20190116"
]
},
{
"data_path": "action_result.data.*.scans.SUPERAntiSpyware.version",
"data_type": "string",
"example_values": [
"5.6.0.1032"
]
},
{
"data_path": "action_result.data.*.scans.SentinelOne.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.SentinelOne.result",
"data_type": "string",
"example_values": [
"static engine - malicious"
]
},
{
"data_path": "action_result.data.*.scans.SentinelOne.update",
"data_type": "string",
"example_values": [
"20190118"
]
},
{
"data_path": "action_result.data.*.scans.SentinelOne.version",
"data_type": "string",
"example_values": [
"1.0.21.268"
]
},
{
"data_path": "action_result.data.*.scans.Sophos.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Sophos.result",
"data_type": "string",
"example_values": [
"W32/Parite-B"
]
},
{
"data_path": "action_result.data.*.scans.Sophos.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.Sophos.version",
"data_type": "string",
"example_values": [
"4.98.0"
]
},
{
"data_path": "action_result.data.*.scans.Symantec.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Symantec.result",
"data_type": "string",
"example_values": [
"Trojan.Gen.6"
]
},
{
"data_path": "action_result.data.*.scans.Symantec.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.Symantec.version",
"data_type": "string",
"example_values": [
"1.8.0.0"
]
},
{
"data_path": "action_result.data.*.scans.TACHYON.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.TACHYON.result",
"data_type": "string",
"example_values": [
"Virus/W32.Parite.C"
]
},
{
"data_path": "action_result.data.*.scans.TACHYON.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.TACHYON.version",
"data_type": "string",
"example_values": [
"2019-01-21.02"
]
},
{
"data_path": "action_result.data.*.scans.Tencent.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Tencent.result",
"data_type": "string",
"example_values": [
"Virus.Win32.Dropper.c"
]
},
{
"data_path": "action_result.data.*.scans.Tencent.update",
"data_type": "string",
"example_values": [
"20190122"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.Tencent.version",
"data_type": "string",
"example_values": [
"1.0.0.1"
]
},
{
"data_path": "action_result.data.*.scans.TheHacker.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.TheHacker.result",
"data_type": "string",
"example_values": [
"W32/Pate.B"
]
},
{
"data_path": "action_result.data.*.scans.TheHacker.update",
"data_type": "string",
"example_values": [
"20190118"
]
},
{
"data_path": "action_result.data.*.scans.TheHacker.version",
"data_type": "string",
"example_values": [
"6.8.0.5.3962"
]
},
{
"data_path": "action_result.data.*.scans.TotalDefense.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.TotalDefense.result",
"data_type": "string",
"example_values": [
"Win32/Pinfi.A"
]
},
{
"data_path": "action_result.data.*.scans.TotalDefense.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.TotalDefense.version",
"data_type": "string",
"example_values": [
"37.1.62.1"
]
},
{
"data_path": "action_result.data.*.scans.Trapmine.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Trapmine.result",
"data_type": "string",
"example_values": [
"malicious.high.ml.score"
]
},
{
"data_path": "action_result.data.*.scans.Trapmine.update",
"data_type": "string",
"example_values": [
"20190103"
]
},
{
"data_path": "action_result.data.*.scans.Trapmine.version",
"data_type": "string",
"example_values": [
"3.0.34.707"
]
},
{
"data_path": "action_result.data.*.scans.TrendMicro-HouseCall.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.TrendMicro-HouseCall.result",
"data_type": "string",
"example_values": [
"PE_PARITE.A"
]
},
{
"data_path": "action_result.data.*.scans.TrendMicro-HouseCall.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.TrendMicro-HouseCall.version",
"data_type": "string",
"example_values": [
"10.0.0.1040"
]
},
{
"data_path": "action_result.data.*.scans.TrendMicro.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.TrendMicro.result",
"data_type": "string",
"example_values": [
"PE_PARITE.A"
]
},
{
"data_path": "action_result.data.*.scans.TrendMicro.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.TrendMicro.version",
"data_type": "string",
"example_values": [
"10.0.0.1040"
]
},
{
"data_path": "action_result.data.*.scans.Trustlook.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Trustlook.result",
"data_type": "string"
},
{
"data_path": "action_result.data.*.scans.Trustlook.update",
"data_type": "string",
"example_values": [
"20190122"
]
},
{
"data_path": "action_result.data.*.scans.Trustlook.version",
"data_type": "string",
"example_values": [
"1.0"
]
},
{
"data_path": "action_result.data.*.scans.VBA32.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.VBA32.result",
"data_type": "string",
"example_values": [
"Virus.Win32.Parite.b"
]
},
{
"data_path": "action_result.data.*.scans.VBA32.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.VBA32.version",
"data_type": "string",
"example_values": [
"3.35.1"
]
},
{
"data_path": "action_result.data.*.scans.VIPRE.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.VIPRE.result",
"data_type": "string",
"example_values": [
"Win32.Parite.b (v)"
]
},
{
"data_path": "action_result.data.*.scans.VIPRE.update",
"data_type": "string"
},
{
"data_path": "action_result.data.*.scans.VIPRE.version",
"data_type": "string",
"example_values": [
"None"
]
},
{
"data_path": "action_result.data.*.scans.ViRobot.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.ViRobot.result",
"data_type": "string",
"example_values": [
"Win32.Parite.A"
]
},
{
"data_path": "action_result.data.*.scans.ViRobot.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.ViRobot.version",
"data_type": "string",
"example_values": [
"2014.3.20.0"
]
},
{
"data_path": "action_result.data.*.scans.Webroot.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Webroot.result",
"data_type": "string"
},
{
"data_path": "action_result.data.*.scans.Webroot.update",
"data_type": "string",
"example_values": [
"20190122"
]
},
{
"data_path": "action_result.data.*.scans.Webroot.version",
"data_type": "string",
"example_values": [
"1.0.0.403"
]
},
{
"data_path": "action_result.data.*.scans.Yandex.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Yandex.result",
"data_type": "string",
"example_values": [
"Win32.Parite.B"
]
},
{
"data_path": "action_result.data.*.scans.Yandex.update",
"data_type": "string",
"example_values": [
"20190120"
]
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.scans.Yandex.version",
"data_type": "string",
"example_values": [
"5.5.1.3"
]
},
{
"data_path": "action_result.data.*.scans.Zillya.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Zillya.result",
"data_type": "string",
"example_values": [
"Virus.Parite.Win32.9"
]
},
{
"data_path": "action_result.data.*.scans.Zillya.update",
"data_type": "string",
"example_values": [
"20190118"
]
},
{
"data_path": "action_result.data.*.scans.Zillya.version",
"data_type": "string",
"example_values": [
"2.0.0.3733"
]
},
{
"data_path": "action_result.data.*.scans.ZoneAlarm.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.ZoneAlarm.result",
"data_type": "string",
"example_values": [
"Virus.Win32.Parite.b"
]
},
{
"data_path": "action_result.data.*.scans.ZoneAlarm.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.ZoneAlarm.version",
"data_type": "string",
"example_values": [
"1.0"
]
},
{
"data_path": "action_result.data.*.scans.Zoner.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.Zoner.result",
"data_type": "string",
"example_values": [
"Win32.Parite.B"
]
},
{
"data_path": "action_result.data.*.scans.Zoner.update",
"data_type": "string",
"example_values": [
"20190121"
]
},
{
"data_path": "action_result.data.*.scans.Zoner.version",
"data_type": "string",
"example_values": [
"1.0"
]
},
{
"data_path": "action_result.data.*.scans.eGambit.detected",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.scans.eGambit.result",
"data_type": "string"
},
{
"data_path": "action_result.data.*.scans.eGambit.update",
"data_type": "string",
"example_values": [
"20190122"
]
},
{
"data_path": "action_result.data.*.scans.eGambit.version",
"data_type": "string",
"example_values": [
"v4.3.5"
]
},
{
"contains": [
"hash",
"sha1"
],
"data_path": "action_result.data.*.sha1",
"data_type": "string",
"example_values": [
"6c1948f7edf115cd1f13cd170b882077930be150"
]
},
{
"contains": [
"hash",
"sha256"
],
"data_path": "action_result.data.*.sha256",
"data_type": "string",
"example_values": [
"27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7"
]
},
{
"data_path": "action_result.data.*.total",
"data_type": "numeric",
"example_values": [
72
]
},
{
"data_path": "action_result.data.*.verbose_msg",
"data_type": "string",
"example_values": [
"Scan finished, information embedded"
]
},
{
"data_path": "action_result.summary.positives",
"data_type": "numeric",
"example_values": [
64
]
},
{
"data_path": "action_result.summary.total_scans",
"data_type": "numeric",
"example_values": [
72
]
},
{
"data_path": "action_result.message",
"data_type": "string",
"example_values": [
"Positives: 64, Total scans: 72"
]
},
{
"data_path": "summary.total_objects",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "summary.total_objects_successful",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "summary.total_positives",
"data_type": "numeric",
"example_values": [
1
]
}
],
"product_name": "VirusTotal",
"product_vendor": "VirusTotal",
"type": ""
}
],
"attrs": {
".action": {
"text": "file reputation"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"fill": "#FFFFFF",
"font-size": 12,
"font-weight": 300,
"opacity": 0,
"ref": ".background",
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "Investigate"
},
"g.approver image": {
"opacity": 1
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.icon image": {
"xlink:href": "/inc/coa/img/block_icon_investigate.svg"
},
"g.notes": {
"display": "block",
"opacity": 1
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
},
"g.timer image": {
"opacity": 1
},
"rect.warn-background": {
"fill": "#FFFFFF"
},
"text.icon": {
"fill": "#FFFFFF"
}
},
"block_code": "def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('file_reputation_1() called')\n\n # collect data for 'file_reputation_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash', 'filtered-data:filter_1:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'file_reputation_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'hash': filtered_artifacts_item_1[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"file reputation\", parameters=parameters, assets=['virustotal'], callback=filter_2, name=\"file_reputation_1\")\n\n return",
"callback_code": "",
"callback_start": 55,
"callsback": true,
"color": "#654796",
"connected_to_start": true,
"connection_name": "",
"connection_type": "",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "",
"delay": 0,
"description": "Run a reputation lookup on the fileHash to determine how many antivirus engines recognize it as malware.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "f86960a4-1d0d-4f37-924c-8640149388a8",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 40,
"line_start": 19,
"message": "Configuring now",
"name": "file reputation",
"notes": "Run a reputation lookup on the fileHash to determine how many antivirus engines recognize it as malware.",
"number": 1,
"order": 2,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 160,
"y": 100
},
"previous_function": "",
"previous_name": "file_reputation_1",
"required_params": {
"hash": true
},
"reviewer": "",
"show_number": false,
"size": {
"height": 112,
"width": 168
},
"state": "asset",
"status": "",
"title": "Investigate",
"type": "coa.Action",
"warn": false,
"z": 1981
},
{
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#5C6773",
"transform": "rotate(45 30 70)"
},
".border": {
"transform": "rotate(45 30 70)"
},
".inPorts>.port-0>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".number": {
"text": 5
},
".outPorts>.port-0": {
"port": {
"id": "out-1",
"type": "out"
},
"ref-x": 83,
"ref-y": 40
},
".outPorts>.port-0>.port-body": {
"port": {
"id": "out-1",
"type": "out"
}
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.notes": {
"display": "block",
"opacity": 1
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_5() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"detonate_file_1:action_result.summary.malware\", \"==\", \"yes\"],\n ],\n name=\"filter_5:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "detonate file",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "filter 5",
"description": "Only hunt files that are considered malware per the sandbox (malware == yes).",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "5bafe5a5-13ad-4f05-bd01-82e0512816cb",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 110,
"line_start": 92,
"name": "filter",
"notes": "Only hunt files that are considered malware per the sandbox (malware == yes).",
"number": 5,
"order": 5,
"outPorts": [
"out-1"
],
"outputs": [
{
"conditions": [
{
"comparison": "==",
"data_type": "",
"param": "detonate_file_1:action_result.summary.malware",
"value": "yes"
}
],
"display": "If",
"logic": "and",
"type": "if"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 1020,
"y": 240
},
"previous_function": "",
"previous_name": "filter_5",
"show_number": true,
"size": {
"height": 82,
"width": 82
},
"state": "filter",
"status": "",
"type": "coa.Filter",
"warn": false,
"z": 2020
},
{
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#5C6773",
"transform": "rotate(45 30 70)"
},
".border": {
"transform": "rotate(45 30 70)"
},
".inPorts>.port-0>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".number": {
"text": 3
},
".outPorts>.port-0": {
"port": {
"id": "out-1",
"type": "out"
},
"ref-x": 83,
"ref-y": 40
},
".outPorts>.port-0>.port-body": {
"port": {
"id": "out-1",
"type": "out"
}
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.notes": {
"display": "block",
"opacity": 1
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_3() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"filtered-data:filter_2:condition_2:file_reputation_1:action_result.parameter.hash\", \"==\", \"artifact:*.cef.fileHash\"],\n ],\n name=\"filter_3:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "file reputation",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "filter 3",
"description": "Match hashes with less than 10 positives to artifacts to identify filtered_artifacts.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "34337267-8e89-4ddf-a601-9040234d2744",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 131,
"line_start": 113,
"name": "filter",
"notes": "Match hashes with less than 10 positives to artifacts to identify filtered_artifacts.",
"number": 3,
"order": 6,
"outPorts": [
"out-1"
],
"outputs": [
{
"conditions": [
{
"comparison": "==",
"data_type": "",
"param": "filtered-data:filter_2:condition_2:file_reputation_1:action_result.parameter.hash",
"value": "artifact:*.cef.fileHash"
}
],
"display": "If",
"logic": "and",
"type": "if"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 500,
"y": 240
},
"previous_function": "",
"previous_name": "filter_3",
"show_number": true,
"size": {
"height": 82,
"width": 82
},
"state": "filter",
"status": "",
"type": "coa.Filter",
"warn": false,
"z": 2022
},
{
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#5C6773",
"transform": "rotate(45 30 70)"
},
".border": {
"transform": "rotate(45 30 70)"
},
".inPorts>.port-0>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".number": {
"text": 2
},
".outPorts>.port-0": {
"port": {
"id": "out-1",
"type": "out"
},
"ref-x": 83,
"ref-y": 40
},
".outPorts>.port-0>.port-body": {
"port": {
"id": "out-1",
"type": "out"
}
},
".outPorts>.port-1": {
"port": {
"id": "out-2",
"type": "out"
},
"ref-x": 41,
"ref-y": 82
},
".outPorts>.port-1>.port-body": {
"port": {
"id": "out-2",
"type": "out"
}
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.notes": {
"display": "block",
"opacity": 1
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_2() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \">=\", 10],\n ],\n name=\"filter_2:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n # collect filtered artifact ids for 'if' condition 2\n matched_artifacts_2, matched_results_2 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"file_reputation_1:action_result.summary.positives\", \"<\", 10],\n ],\n name=\"filter_2:condition_2\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_2 or matched_results_2:\n filter_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "file reputation",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "filter 2",
"description": "If 10 or more antivirus engines flagged the hash, proceed directly to hunt for the file. Else, use a sandbox to detonate the executable first.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "5ccf6d20-f7b8-4d43-84b4-ed885c548f7b",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 165,
"line_start": 134,
"name": "filter",
"notes": "If 10 or more antivirus engines flagged the hash, proceed directly to hunt for the file. Else, use a sandbox to detonate the executable first.",
"number": 2,
"order": 7,
"outPorts": [
"out-1",
"out-2"
],
"outputs": [
{
"conditions": [
{
"comparison": ">=",
"data_type": "",
"param": "file_reputation_1:action_result.summary.positives",
"value": "10"
}
],
"display": "If",
"logic": "and",
"type": "if"
},
{
"conditions": [
{
"comparison": "<",
"data_type": "",
"param": "file_reputation_1:action_result.summary.positives",
"value": "10"
}
],
"display": "If",
"logic": "and",
"type": "if"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 400,
"y": 100
},
"previous_function": "",
"previous_name": "filter_2",
"show_number": true,
"size": {
"height": 82,
"width": 82
},
"state": "filter",
"status": "",
"type": "coa.Filter",
"warn": false,
"z": 2023
},
{
"action": "hunt file",
"action_type": "investigate",
"active": false,
"active_keys": {},
"active_values": {
"hash": "filtered-data:filter_9:condition_1:file_reputation_1:action_result.parameter.hash",
"range": "",
"type": ""
},
"angle": 0,
"app": "",
"approver": "",
"assets": [
{
"action": "",
"active": true,
"app_name": "Carbon Black Response",
"app_version": "1.2.80",
"appid": "",
"config_type": "asset",
"fields": {
"hash": "filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.hash",
"range": "",
"type": ""
},
"has_app": true,
"id": "-",
"loaded": false,
"missing": false,
"name": "carbonblack",
"output": [
{
"data_path": "action_result.status",
"data_type": "string",
"example_values": [
"success"
]
},
{
"contains": [
"hash",
"md5"
],
"data_path": "action_result.parameter.hash",
"data_type": "string",
"example_values": [
"4fb491ac8d46aaf22ba8bc5c73dabef7",
"13ded573464ba7f43fe640479b309e09",
"9bf50324444c46997c2492d505b47f2d",
"5FB30FE90736C7FC77DE637021B1CE7C"
]
},
{
"data_path": "action_result.parameter.range",
"data_type": "string",
"example_values": [
"0-10",
"0-2",
"5-8"
]
},
{
"contains": [
"carbon black query type"
],
"data_path": "action_result.parameter.type",
"data_type": "string",
"example_values": [
"process",
"binary"
]
},
{
"data_path": "action_result.data.*.binary.elapsed",
"data_type": "numeric",
"example_values": [
0.1120398044586182,
0.04952096939086914,
0.1234798431396484,
0.05507302284240723,
0.05384993553161621
]
},
{
"data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name",
"data_type": "numeric",
"example_values": [
0
]
},
{
"data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value",
"data_type": "numeric",
"example_values": [
0
]
},
{
"data_path": "action_result.data.*.binary.facets.company_name_facet.*.name",
"data_type": "string",
"example_values": [
"Microsoft Corporation"
]
},
{
"data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio",
"data_type": "string",
"example_values": [
"100.0"
]
},
{
"data_path": "action_result.data.*.binary.facets.company_name_facet.*.value",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name",
"data_type": "string",
"example_values": [
"Microsoft Corporation"
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio",
"data_type": "string",
"example_values": [
"100.0"
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_result.*.name",
"data_type": "string",
"example_values": [
"Signed"
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_result.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio",
"data_type": "string",
"example_values": [
"100.0"
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_result.*.value",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name",
"data_type": "string",
"example_values": [
"2018-10-01T00:00:00Z",
"2015-01-01T00:00:00Z",
"2013-11-01T00:00:00Z"
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value",
"data_type": "numeric",
"example_values": [
1,
0
]
},
{
"data_path": "action_result.data.*.binary.facets.file_version_facet.*.name",
"data_type": "string",
"example_values": [
"16.0.10827.20181",
"4.7.0205.0",
"6.1.7600.16385 (win7_rtm.090713-1255)"
]
},
{
"data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio",
"data_type": "string",
"example_values": [
"100.0"
]
},
{
"data_path": "action_result.data.*.binary.facets.file_version_facet.*.value",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.binary.facets.group.*.name",
"data_type": "string",
"example_values": [
"default group"
]
},
{
"data_path": "action_result.data.*.binary.facets.group.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.binary.facets.group.*.ratio",
"data_type": "string",
"example_values": [
"100.0"
]
},
{
"data_path": "action_result.data.*.binary.facets.group.*.value",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.binary.facets.host_count.*.name",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.binary.facets.host_count.*.value",
"data_type": "numeric",
"example_values": [
1,
0
]
},
{
"data_path": "action_result.data.*.binary.facets.hostname.*.name",
"data_type": "string",
"example_values": [
"CB-TEST-02",
"WIN7-CLIENT1",
"ACCOUNTING-PC"
]
},
{
"data_path": "action_result.data.*.binary.facets.hostname.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.binary.facets.hostname.*.ratio",
"data_type": "string",
"example_values": [
"100.0",
"16.7"
]
},
{
"data_path": "action_result.data.*.binary.facets.hostname.*.value",
"data_type": "numeric",
"example_values": [
1
]
},
{
"contains": [
"file path",
"file name"
],
"data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name",
"data_type": "string",
"example_values": [
"c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe",
"c:\\program files\\microsoft security client\\nissrv.exe",
"C:\\Windows\\system32\\ping.exe"
]
},
{
"data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio",
"data_type": "string",
"example_values": [
"100.0",
"50.0"
]
},
{
"data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.binary.facets.product_name_facet.*.name",
"data_type": "string",
"example_values": [
"Microsoft Office",
"Microsoft Malware Protection"
]
},
{
"data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio",
"data_type": "string",
"example_values": [
"100.0"
]
},
{
"data_path": "action_result.data.*.binary.facets.product_name_facet.*.value",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name",
"data_type": "string",
"example_values": [
"2018-10-19T00:00:00Z",
"2018-09-29T00:00:00Z",
"2018-10-02T00:00:00Z"
]
},
{
"data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value",
"data_type": "numeric",
"example_values": [
1,
0
]
},
{
"contains": [
"md5"
],
"data_path": "action_result.data.*.binary.highlights.*.ids",
"data_type": "string",
"example_values": [
"13DED573464BA7F43FE640479B309E09",
"9BF50324444C46997C2492D505B47F2D",
"5FB30FE90736C7FC77DE637021B1CE7C"
]
},
{
"data_path": "action_result.data.*.binary.highlights.*.name",
"data_type": "string",
"example_values": [
"PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST",
"PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST",
"PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST"
]
},
{
"contains": [
"md5"
],
"data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust",
"data_type": "string",
"example_values": [
"5fb30fe90736c7fc77de637021b1ce7c"
]
},
{
"contains": [
"url"
],
"data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust",
"data_type": "string",
"example_values": [
"https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c"
]
},
{
"data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust",
"data_type": "numeric",
"example_values": [
-100
]
},
{
"data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust",
"data_type": "string",
"example_values": [
"2018-02-07T02:37:28Z"
]
},
{
"data_path": "action_result.data.*.binary.results.*.cb_version",
"data_type": "numeric",
"example_values": [
610,
510,
511
]
},
{
"data_path": "action_result.data.*.binary.results.*.company_name",
"data_type": "string",
"example_values": [
"Microsoft Corporation"
]
},
{
"data_path": "action_result.data.*.binary.results.*.copied_mod_len",
"data_type": "numeric",
"example_values": [
9683736,
366512,
16896
]
},
{
"data_path": "action_result.data.*.binary.results.*.digsig_issuer",
"data_type": "string",
"example_values": [
"Microsoft Code Signing PCA"
]
},
{
"data_path": "action_result.data.*.binary.results.*.digsig_prog_name",
"data_type": "string",
"example_values": [
"Microsoft Office",
"Microsoft Corp."
]
},
{
"data_path": "action_result.data.*.binary.results.*.digsig_publisher",
"data_type": "string",
"example_values": [
"Microsoft Corporation"
]
},
{
"data_path": "action_result.data.*.binary.results.*.digsig_result",
"data_type": "string",
"example_values": [
"Signed"
]
},
{
"data_path": "action_result.data.*.binary.results.*.digsig_result_code",
"data_type": "string",
"example_values": [
"0"
]
},
{
"data_path": "action_result.data.*.binary.results.*.digsig_sign_time",
"data_type": "string",
"example_values": [
"2018-10-14T20:23:00Z",
"2015-01-30T19:14:00Z",
"2009-07-14T10:17:00Z"
]
},
{
"data_path": "action_result.data.*.binary.results.*.digsig_subject",
"data_type": "string",
"example_values": [
"Microsoft Corporation"
]
},
{
"data_path": "action_result.data.*.binary.results.*.endpoint",
"data_type": "string",
"example_values": [
"CB-TEST-02|27",
"WIN7-CLIENT1|15",
"DC1|19"
]
},
{
"data_path": "action_result.data.*.binary.results.*.event_partition_id",
"data_type": "numeric",
"example_values": [
100972684312576,
100955696070656
]
},
{
"data_path": "action_result.data.*.binary.results.*.facet_id",
"data_type": "numeric",
"example_values": [
883737,
0
]
},
{
"data_path": "action_result.data.*.binary.results.*.file_desc",
"data_type": "string",
"example_values": [
"Microsoft Office Click-to-Run (SxS)",
"Microsoft Network Realtime Inspection Service",
"TCP/IP Ping Command"
]
},
{
"data_path": "action_result.data.*.binary.results.*.file_version",
"data_type": "string",
"example_values": [
"16.0.10827.20181",
"4.7.0205.0",
"6.1.7600.16385 (win7_rtm.090713-1255)"
]
},
{
"data_path": "action_result.data.*.binary.results.*.group",
"data_type": "string",
"example_values": [
"Default Group"
]
},
{
"data_path": "action_result.data.*.binary.results.*.host_count",
"data_type": "numeric",
"example_values": [
1,
6
]
},
{
"contains": [
"file name"
],
"data_path": "action_result.data.*.binary.results.*.internal_name",
"data_type": "string",
"example_values": [
"OfficeClickToRun.exe",
"NisSrv.exe",
"ping.exe"
]
},
{
"data_path": "action_result.data.*.binary.results.*.is_64bit",
"data_type": "boolean",
"example_values": [
false,
true
]
},
{
"data_path": "action_result.data.*.binary.results.*.is_executable_image",
"data_type": "boolean",
"example_values": [
false,
true
]
},
{
"data_path": "action_result.data.*.binary.results.*.last_seen",
"data_type": "string",
"example_values": [
"2018-10-28T10:06:02.456Z",
"2018-10-28T10:06:42.455Z",
"2018-10-26T00:01:41.224Z"
]
},
{
"data_path": "action_result.data.*.binary.results.*.legal_copyright",
"data_type": "string",
"example_values": [
"Microsoft Corporation. All rights reserved."
]
},
{
"contains": [
"md5"
],
"data_path": "action_result.data.*.binary.results.*.md5",
"data_type": "string",
"example_values": [
"13DED573464BA7F43FE640479B309E09",
"9BF50324444C46997C2492D505B47F2D",
"5FB30FE90736C7FC77DE637021B1CE7C"
]
},
{
"contains": [
"file path",
"file name"
],
"data_path": "action_result.data.*.binary.results.*.observed_filename",
"data_type": "string",
"example_values": [
"c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe",
"c:\\program files\\microsoft security client\\nissrv.exe",
"c:\\windows\\system32\\ping.exe"
]
},
{
"data_path": "action_result.data.*.binary.results.*.orig_mod_len",
"data_type": "numeric",
"example_values": [
9683736,
366512,
16896
]
},
{
"contains": [
"file name"
],
"data_path": "action_result.data.*.binary.results.*.original_filename",
"data_type": "string",
"example_values": [
"OfficeClickToRun.exe",
"NisSrv.exe",
"ping.exe.mui"
]
},
{
"data_path": "action_result.data.*.binary.results.*.os_type",
"data_type": "string",
"example_values": [
"Windows"
]
},
{
"data_path": "action_result.data.*.binary.results.*.product_name",
"data_type": "string",
"example_values": [
"Microsoft Office",
"Microsoft Malware Protection"
]
},
{
"data_path": "action_result.data.*.binary.results.*.product_version",
"data_type": "string",
"example_values": [
"16.0.10827.20181",
"4.7.0205.0",
"6.1.7600.16385"
]
},
{
"data_path": "action_result.data.*.binary.results.*.server_added_timestamp",
"data_type": "string",
"example_values": [
"2018-10-19T17:04:47.906Z",
"2015-07-01T02:12:21.783Z",
"2015-05-15T07:23:54.846Z"
]
},
{
"column_name": "Signed",
"column_order": 1,
"data_path": "action_result.data.*.binary.results.*.signed",
"data_type": "string",
"example_values": [
"Signed"
]
},
{
"data_path": "action_result.data.*.binary.results.*.timestamp",
"data_type": "string",
"example_values": [
"2018-10-19T17:04:47.906Z",
"2015-07-01T02:12:21.783Z",
"2015-05-15T07:23:54.846Z"
]
},
{
"data_path": "action_result.data.*.binary.results.*.watchlists.*.value",
"data_type": "string",
"example_values": [
"2015-07-01T02:20:02.062Z",
"2015-05-15T07:30:02.843Z"
]
},
{
"data_path": "action_result.data.*.binary.results.*.watchlists.*.wid",
"data_type": "string",
"example_values": [
"5"
]
},
{
"data_path": "action_result.data.*.binary.start",
"data_type": "numeric",
"example_values": [
0,
5
]
},
{
"data_path": "action_result.data.*.binary.terms",
"data_type": "string",
"example_values": [
"md5:13ded573464ba7f43fe640479b309e09",
"md5:9bf50324444c46997c2492d505b47f2d",
"md5:5FB30FE90736C7FC77DE637021B1CE7C"
]
},
{
"data_path": "action_result.data.*.binary.total_results",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.process.all_segments",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.process.comprehensive_search",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.process.elapsed",
"data_type": "numeric",
"example_values": [
0.2200779914855957
]
},
{
"data_path": "action_result.data.*.process.facets.day_of_week.*.name",
"data_type": "string",
"example_values": [
"0"
]
},
{
"data_path": "action_result.data.*.process.facets.day_of_week.*.value",
"data_type": "numeric",
"example_values": [
1566
]
},
{
"data_path": "action_result.data.*.process.facets.group.*.name",
"data_type": "string",
"example_values": [
"default group"
]
},
{
"data_path": "action_result.data.*.process.facets.group.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.process.facets.group.*.ratio",
"data_type": "string",
"example_values": [
"100.0"
]
},
{
"data_path": "action_result.data.*.process.facets.group.*.value",
"data_type": "numeric",
"example_values": [
10128
]
},
{
"data_path": "action_result.data.*.process.facets.host_type.*.name",
"data_type": "string",
"example_values": [
"domain_controller"
]
},
{
"data_path": "action_result.data.*.process.facets.host_type.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.process.facets.host_type.*.ratio",
"data_type": "string",
"example_values": [
"100.0"
]
},
{
"data_path": "action_result.data.*.process.facets.host_type.*.value",
"data_type": "numeric",
"example_values": [
10123
]
},
{
"data_path": "action_result.data.*.process.facets.hostname.*.name",
"data_type": "string",
"example_values": [
"dc2"
]
},
{
"data_path": "action_result.data.*.process.facets.hostname.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.process.facets.hostname.*.ratio",
"data_type": "string",
"example_values": [
"51.2"
]
},
{
"data_path": "action_result.data.*.process.facets.hostname.*.value",
"data_type": "numeric",
"example_values": [
5185
]
},
{
"data_path": "action_result.data.*.process.facets.hour_of_day.*.name",
"data_type": "string",
"example_values": [
"0"
]
},
{
"data_path": "action_result.data.*.process.facets.hour_of_day.*.value",
"data_type": "numeric",
"example_values": [
411
]
},
{
"contains": [
"file name"
],
"data_path": "action_result.data.*.process.facets.parent_name.*.name",
"data_type": "string",
"example_values": [
"svchost.exe"
]
},
{
"data_path": "action_result.data.*.process.facets.parent_name.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.process.facets.parent_name.*.ratio",
"data_type": "string",
"example_values": [
"98.5"
]
},
{
"data_path": "action_result.data.*.process.facets.parent_name.*.value",
"data_type": "numeric",
"example_values": [
9971
]
},
{
"contains": [
"file path",
"file name"
],
"data_path": "action_result.data.*.process.facets.path_full.*.name",
"data_type": "string",
"example_values": [
"c:\\windows\\syswow64\\wbem\\wmiprvse.exe"
]
},
{
"data_path": "action_result.data.*.process.facets.path_full.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.process.facets.path_full.*.ratio",
"data_type": "string",
"example_values": [
"98.5"
]
},
{
"data_path": "action_result.data.*.process.facets.path_full.*.value",
"data_type": "numeric",
"example_values": [
9971
]
},
{
"contains": [
"md5"
],
"data_path": "action_result.data.*.process.facets.process_md5.*.name",
"data_type": "string",
"example_values": [
"4fb491ac8d46aaf22ba8bc5c73dabef7"
]
},
{
"data_path": "action_result.data.*.process.facets.process_md5.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.process.facets.process_md5.*.ratio",
"data_type": "string",
"example_values": [
"98.5"
]
},
{
"data_path": "action_result.data.*.process.facets.process_md5.*.value",
"data_type": "numeric",
"example_values": [
9971
]
},
{
"contains": [
"file name"
],
"data_path": "action_result.data.*.process.facets.process_name.*.name",
"data_type": "string",
"example_values": [
"wmiprvse.exe"
]
},
{
"data_path": "action_result.data.*.process.facets.process_name.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.process.facets.process_name.*.ratio",
"data_type": "string",
"example_values": [
"98.5"
]
},
{
"data_path": "action_result.data.*.process.facets.process_name.*.value",
"data_type": "numeric",
"example_values": [
9971
]
},
{
"data_path": "action_result.data.*.process.facets.start.*.name",
"data_type": "string",
"example_values": [
"2018-02-24T00:00:00Z"
]
},
{
"data_path": "action_result.data.*.process.facets.start.*.value",
"data_type": "numeric",
"example_values": [
324
]
},
{
"data_path": "action_result.data.*.process.facets.username_full.*.name",
"data_type": "string",
"example_values": [
"LOCAL SERVICE"
]
},
{
"data_path": "action_result.data.*.process.facets.username_full.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.process.facets.username_full.*.ratio",
"data_type": "string",
"example_values": [
"98.4"
]
},
{
"data_path": "action_result.data.*.process.facets.username_full.*.value",
"data_type": "numeric",
"example_values": [
9966
]
},
{
"data_path": "action_result.data.*.process.incomplete_results",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"contains": [
"md5"
],
"data_path": "action_result.data.*.process.results.*.alliance_data_srstrust",
"data_type": "string",
"example_values": [
"4fb491ac8d46aaf22ba8bc5c73dabef7"
]
},
{
"contains": [
"url"
],
"data_path": "action_result.data.*.process.results.*.alliance_link_srstrust",
"data_type": "string",
"example_values": [
"https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7"
]
},
{
"data_path": "action_result.data.*.process.results.*.alliance_score_srstrust",
"data_type": "numeric",
"example_values": [
-100
]
},
{
"data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust",
"data_type": "string",
"example_values": [
"2018-02-07T02:37:28Z"
]
},
{
"data_path": "action_result.data.*.process.results.*.childproc_count",
"data_type": "numeric",
"example_values": [
0
]
},
{
"contains": [
"file path"
],
"data_path": "action_result.data.*.process.results.*.cmdline",
"data_type": "string",
"example_values": [
"C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding"
]
},
{
"data_path": "action_result.data.*.process.results.*.comms_ip",
"data_type": "numeric",
"example_values": [
168886572
]
},
{
"data_path": "action_result.data.*.process.results.*.crossproc_count",
"data_type": "numeric",
"example_values": [
2
]
},
{
"data_path": "action_result.data.*.process.results.*.emet_config",
"data_type": "string",
"example_values": [
""
]
},
{
"data_path": "action_result.data.*.process.results.*.emet_count",
"data_type": "numeric",
"example_values": [
0
]
},
{
"data_path": "action_result.data.*.process.results.*.filemod_count",
"data_type": "numeric",
"example_values": [
0
]
},
{
"data_path": "action_result.data.*.process.results.*.filtering_known_dlls",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.process.results.*.group",
"data_type": "string",
"example_values": [
"default group"
]
},
{
"data_path": "action_result.data.*.process.results.*.host_type",
"data_type": "string",
"example_values": [
"workstation"
]
},
{
"contains": [
"host name"
],
"data_path": "action_result.data.*.process.results.*.hostname",
"data_type": "string",
"example_values": [
"win7-client1"
]
},
{
"contains": [
"carbon black process id"
],
"data_path": "action_result.data.*.process.results.*.id",
"data_type": "string",
"example_values": [
"0000000f-0000-0688-01d3-27738c9b4243"
]
},
{
"data_path": "action_result.data.*.process.results.*.interface_ip",
"data_type": "numeric",
"example_values": [
168886572
]
},
{
"data_path": "action_result.data.*.process.results.*.last_server_update",
"data_type": "string",
"example_values": [
"2018-03-22T09:21:32.332Z"
]
},
{
"data_path": "action_result.data.*.process.results.*.last_update",
"data_type": "string",
"example_values": [
"2017-09-07T00:52:15.82Z"
]
},
{
"data_path": "action_result.data.*.process.results.*.modload_count",
"data_type": "numeric",
"example_values": [
43
]
},
{
"data_path": "action_result.data.*.process.results.*.netconn_count",
"data_type": "numeric",
"example_values": [
0
]
},
{
"data_path": "action_result.data.*.process.results.*.os_type",
"data_type": "string",
"example_values": [
"windows"
]
},
{
"data_path": "action_result.data.*.process.results.*.parent_id",
"data_type": "string",
"example_values": [
"0000000f-0000-0258-01d1-ec51b545a19b"
]
},
{
"data_path": "action_result.data.*.process.results.*.parent_md5",
"data_type": "string",
"example_values": [
"000000000000000000000000000000"
]
},
{
"contains": [
"file name"
],
"data_path": "action_result.data.*.process.results.*.parent_name",
"data_type": "string",
"example_values": [
"svchost.exe"
]
},
{
"data_path": "action_result.data.*.process.results.*.parent_pid",
"data_type": "numeric",
"example_values": [
600
]
},
{
"data_path": "action_result.data.*.process.results.*.parent_unique_id",
"data_type": "string",
"example_values": [
"0000000f-0000-0258-01d1-ec51b545a19b-000000000001"
]
},
{
"contains": [
"file path",
"file name"
],
"data_path": "action_result.data.*.process.results.*.path",
"data_type": "string",
"example_values": [
"c:\\windows\\syswow64\\wbem\\wmiprvse.exe"
]
},
{
"contains": [
"md5"
],
"data_path": "action_result.data.*.process.results.*.process_md5",
"data_type": "string",
"example_values": [
"4fb491ac8d46aaf22ba8bc5c73dabef7"
]
},
{
"contains": [
"process name",
"file name"
],
"data_path": "action_result.data.*.process.results.*.process_name",
"data_type": "string",
"example_values": [
"wmiprvse.exe"
]
},
{
"contains": [
"pid"
],
"data_path": "action_result.data.*.process.results.*.process_pid",
"data_type": "numeric",
"example_values": [
1672
]
},
{
"data_path": "action_result.data.*.process.results.*.processblock_count",
"data_type": "numeric",
"example_values": [
0
]
},
{
"data_path": "action_result.data.*.process.results.*.regmod_count",
"data_type": "numeric",
"example_values": [
0
]
},
{
"data_path": "action_result.data.*.process.results.*.segment_id",
"data_type": "numeric",
"example_values": [
1
]
},
{
"contains": [
"carbon black sensor id"
],
"data_path": "action_result.data.*.process.results.*.sensor_id",
"data_type": "numeric",
"example_values": [
15
]
},
{
"data_path": "action_result.data.*.process.results.*.start",
"data_type": "string",
"example_values": [
"2017-09-07T00:52:15.758Z"
]
},
{
"data_path": "action_result.data.*.process.results.*.terminated",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.process.results.*.unique_id",
"data_type": "string",
"example_values": [
"0000000f-0000-0688-01d3-27738c9b4243-000000000001"
]
},
{
"contains": [
"user name"
],
"data_path": "action_result.data.*.process.results.*.username",
"data_type": "string",
"example_values": [
"SYSTEM"
]
},
{
"data_path": "action_result.data.*.process.start",
"data_type": "numeric",
"example_values": [
0
]
},
{
"data_path": "action_result.data.*.process.terms",
"data_type": "string",
"example_values": [
"md5:4fb491ac8d46aaf22ba8bc5c73dabef7"
]
},
{
"data_path": "action_result.data.*.process.total_results",
"data_type": "numeric",
"example_values": [
32404
]
},
{
"data_path": "action_result.summary.device_count",
"data_type": "numeric",
"example_values": [
32404,
1
]
},
{
"data_path": "action_result.message",
"data_type": "string",
"example_values": [
"Displaying 10 'process' results of total 32404",
"Displaying 1 'binary' results of total 1",
"Displaying 0 'binary' results of total 1"
]
},
{
"data_path": "summary.total_objects",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "summary.total_objects_successful",
"data_type": "numeric",
"example_values": [
1
]
}
],
"product_name": "Carbon Black",
"product_vendor": "Bit9",
"type": "endpoint"
}
],
"attrs": {
".action": {
"text": "hunt file 1"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".border": {
"height": 88
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"fill": "#FFFFFF",
"font-size": 12,
"font-weight": 300,
"opacity": 0,
"ref": ".background",
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "Investigate"
},
"g.approver image": {
"opacity": 1
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.icon image": {
"xlink:href": "/inc/coa/img/block_icon_investigate.svg"
},
"g.notes": {
"display": "block",
"opacity": 1
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
},
"g.timer image": {
"opacity": 1
},
"rect.warn-background": {
"fill": "#FFFFFF"
},
"text.icon": {
"fill": "#FFFFFF"
}
},
"block_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_1' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_2:condition_1:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_1' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name=\"hunt_file_1\")\n\n return",
"callback_code": "",
"callback_start": 193,
"callsback": true,
"color": "#654796",
"connected_to_start": true,
"connection_name": "file reputation",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "",
"delay": 0,
"description": "Hunt for binaries with the malicious fileHash across endpoints.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "214e20f6-a5fb-4409-b2f2-752d24605d9c",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 112,
"line_end": 193,
"line_start": 168,
"message": "Configuring now",
"name": "hunt file",
"notes": "Hunt for binaries with the malicious fileHash across endpoints.",
"number": 1,
"order": 8,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 780,
"y": 100
},
"previous_function": "",
"previous_name": "hunt_file_1",
"required_params": {
"hash": true
},
"reviewer": "",
"show_number": true,
"size": {
"height": 112,
"width": 168
},
"state": "asset",
"status": "",
"title": "Investigate",
"type": "coa.Action",
"warn": false,
"z": 2024
},
{
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#5C6773",
"transform": "rotate(45 30 70)"
},
".border": {
"transform": "rotate(45 30 70)"
},
".inPorts>.port-0>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".number": {
"text": 1
},
".outPorts>.port-0": {
"port": {
"id": "out-1",
"type": "out"
},
"ref-x": 83,
"ref-y": 40
},
".outPorts>.port-0>.port-body": {
"port": {
"id": "out-1",
"type": "out"
}
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.notes": {
"display": "block",
"opacity": 1
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_1() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n conditions=[\n [\"artifact:*.cef.fileHash\", \"!=\", \"\"],\n ],\n name=\"filter_1:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n file_reputation_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "",
"connection_type": "",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "filter 1",
"description": "Only process artifacts that have a CEF fileHash.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "cfd038f6-b7a3-49b5-9c7e-ca4f318c1899",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 37,
"line_end": 213,
"line_start": 196,
"name": "filter",
"notes": "Only process artifacts that have a CEF fileHash.",
"number": 1,
"order": 9,
"outPorts": [
"out-1"
],
"outputs": [
{
"conditions": [
{
"comparison": "!=",
"data_type": "",
"param": "artifact:*.cef.fileHash",
"value": ""
}
],
"display": "If",
"logic": "and",
"type": "if"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 20,
"y": 100
},
"previous_function": "",
"previous_name": "filter_1",
"show_number": true,
"size": {
"height": 82,
"width": 82
},
"state": "filter",
"status": "",
"type": "coa.Filter",
"warn": false,
"z": 2025
},
{
"action": "detonate file",
"action_type": "investigate",
"active": false,
"active_keys": {},
"active_values": {
"file_name": "",
"force_analysis": "",
"private": "",
"vault_id": "filtered-data:filter_11:condition_1:artifact:*.cef.vaultId",
"vm": ""
},
"angle": 0,
"app": "",
"approver": "",
"assets": [
{
"action": "",
"active": true,
"app_name": "WildFire",
"app_version": "1.0.24",
"appid": "",
"config_type": "asset",
"fields": {
"file_name": "",
"vault_id": "filtered-data:filter_4:condition_1:artifact:*.cef.vaultId"
},
"has_app": true,
"id": "-",
"loaded": false,
"missing": false,
"name": "wildfire",
"output": [
{
"data_path": "action_result.status",
"data_type": "string"
},
{
"contains": [
"file name"
],
"data_path": "action_result.parameter.file_name",
"data_type": "string"
},
{
"contains": [
"pe file",
"pdf",
"flash",
"apk",
"jar",
"doc",
"xls",
"ppt"
],
"data_path": "action_result.parameter.vault_id",
"data_type": "string"
},
{
"data_path": "action_result.data.*.file_info.filetype",
"data_type": "string"
},
{
"data_path": "action_result.data.*.file_info.malware",
"data_type": "string"
},
{
"contains": [
"md5",
"hash"
],
"data_path": "action_result.data.*.file_info.md5",
"data_type": "string"
},
{
"contains": [
"sha1",
"hash"
],
"data_path": "action_result.data.*.file_info.sha1",
"data_type": "string"
},
{
"contains": [
"sha256",
"hash"
],
"data_path": "action_result.data.*.file_info.sha256",
"data_type": "string"
},
{
"data_path": "action_result.data.*.file_info.size",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.#text",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.#text",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@behavior_id",
"data_type": "string"
},
{
"contains": [
"md5",
"hash"
],
"data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@md5",
"data_type": "string"
},
{
"contains": [
"sha1",
"hash"
],
"data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha1",
"data_type": "string"
},
{
"contains": [
"sha256",
"hash"
],
"data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha256",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@behavior_id",
"data_type": "string"
},
{
"contains": [
"md5",
"hash"
],
"data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@md5",
"data_type": "string"
},
{
"contains": [
"sha1",
"hash"
],
"data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha1",
"data_type": "string"
},
{
"contains": [
"sha256",
"hash"
],
"data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha256",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@deleted_file",
"data_type": "string"
},
{
"contains": [
"pid"
],
"data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@pid",
"data_type": "string"
},
{
"contains": [
"process name"
],
"data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@process_image",
"data_type": "string"
},
{
"contains": [
"pid"
],
"data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@pid",
"data_type": "string"
},
{
"contains": [
"process name"
],
"data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@process_image",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@written_file",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.malware",
"data_type": "string"
},
{
"contains": [
"md5",
"hash"
],
"data_path": "action_result.data.*.task_info.report.*.md5",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.network.dns.*.@query",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.network.dns.*.@response",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.network.dns.*.@type",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@country",
"data_type": "string"
},
{
"contains": [
"ip"
],
"data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@ip",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@port",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.network.udp.*.@country",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.network.udp.*.@ip",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.network.udp.*.@port",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.network.url.*.@host",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.network.url.*.@method",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.network.url.*.@uri",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.network.url.*.@user_agent",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.platform",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@command",
"data_type": "string"
},
{
"contains": [
"process name"
],
"data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@name",
"data_type": "string"
},
{
"contains": [
"pid"
],
"data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@pid",
"data_type": "string"
},
{
"contains": [
"md5",
"hash"
],
"data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@md5",
"data_type": "string"
},
{
"contains": [
"file path"
],
"data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@name",
"data_type": "string"
},
{
"contains": [
"sha1",
"hash"
],
"data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha1",
"data_type": "string"
},
{
"contains": [
"sha256",
"hash"
],
"data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha256",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@size",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@type",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.process_list.process.*.mutex.createmutex.*.@name",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@key",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@subkey",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@data",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@key",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@subkey",
"data_type": "string"
},
{
"contains": [
"process name"
],
"data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@name",
"data_type": "string"
},
{
"contains": [
"pid"
],
"data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@pid",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@text",
"data_type": "string"
},
{
"contains": [
"pid"
],
"data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@pid",
"data_type": "string"
},
{
"contains": [
"process name"
],
"data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@process_image",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@reg_key",
"data_type": "string"
},
{
"contains": [
"pid"
],
"data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@pid",
"data_type": "string"
},
{
"contains": [
"process name"
],
"data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@process_image",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@reg_key",
"data_type": "string"
},
{
"contains": [
"pid"
],
"data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@pid",
"data_type": "string"
},
{
"contains": [
"process name"
],
"data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@process_image",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@reg_key",
"data_type": "string"
},
{
"contains": [
"sha256",
"hash"
],
"data_path": "action_result.data.*.task_info.report.*.sha256",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.size",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.software",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.summary.entry.*.#text",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@details",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@id",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@score",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.task",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.#text",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.@seq",
"data_type": "string"
},
{
"data_path": "action_result.data.*.task_info.report.*.version",
"data_type": "string"
},
{
"data_path": "action_result.data.*.version",
"data_type": "string"
},
{
"data_path": "action_result.summary.malware",
"data_type": "string"
},
{
"data_path": "action_result.message",
"data_type": "string"
},
{
"data_path": "summary.total_objects",
"data_type": "numeric"
},
{
"data_path": "summary.total_objects_successful",
"data_type": "numeric"
}
],
"product_name": "WildFire",
"product_vendor": "Palo Alto Networks",
"type": "sandbox"
}
],
"attrs": {
".action": {
"text": "detonate file"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"fill": "#FFFFFF",
"font-size": 12,
"font-weight": 300,
"opacity": 0,
"ref": ".background",
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "Investigate"
},
"g.approver image": {
"opacity": 1
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.icon image": {
"xlink:href": "/inc/coa/img/block_icon_investigate.svg"
},
"g.notes": {
"display": "block",
"opacity": 1
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
},
"g.timer image": {
"opacity": 1
},
"rect.warn-background": {
"fill": "#FFFFFF"
},
"text.icon": {
"fill": "#FFFFFF"
}
},
"block_code": "def detonate_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('detonate_file_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'detonate_file_1' call\n filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_4:condition_1:artifact:*.cef.vaultId', 'filtered-data:filter_4:condition_1:artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'detonate_file_1' call\n for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n if filtered_artifacts_item_1[0]:\n parameters.append({\n 'vault_id': filtered_artifacts_item_1[0],\n 'file_name': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_artifacts_item_1[1]},\n })\n\n phantom.act(action=\"detonate file\", parameters=parameters, assets=['wildfire'], callback=filter_5, name=\"detonate_file_1\")\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": true,
"color": "#654796",
"connected_to_start": true,
"connection_name": "file reputation",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "",
"delay": 0,
"description": "Detonate the file(s) in the vault.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "12461935-1aee-4aec-878c-0e2fb1742912",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 135,
"line_end": 240,
"line_start": 216,
"message": "Configuring now",
"name": "detonate file",
"notes": "Detonate the file(s) in the vault.",
"number": 1,
"order": 10,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 780,
"y": 240
},
"previous_function": "",
"previous_name": "detonate_file_1",
"required_params": {
"vault_id": true
},
"reviewer": "",
"show_number": false,
"size": {
"height": 112,
"width": 168
},
"state": "asset",
"status": "",
"title": "Investigate",
"type": "coa.Action",
"warn": false,
"z": 2026
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "13fce689-6a47-484b-a70a-aa77e2e79cb1",
"router": {
"name": "metro"
},
"source": {
"id": "214e20f6-a5fb-4409-b2f2-752d24605d9c",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "f989d5e9-9586-408e-b424-8a3a5384936a",
"selector": ".port-body[type=\"input\"]"
},
"type": "link",
"z": 2037
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "eeca94e9-2c8b-4474-ad9f-39da792e28a3",
"router": {
"name": "metro"
},
"source": {
"id": "35f205e2-949e-463e-9057-658f597b1dc9",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "f989d5e9-9586-408e-b424-8a3a5384936a",
"selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
},
"type": "link",
"z": 2040
},
{
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#5C6773",
"transform": "rotate(45 30 70)"
},
".border": {
"transform": "rotate(45 30 70)"
},
".inPorts>.port-0>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".number": {
"text": 4
},
".outPorts>.port-0": {
"port": {
"id": "out-1",
"type": "out"
},
"ref-x": 83,
"ref-y": 40
},
".outPorts>.port-0>.port-body": {
"port": {
"id": "out-1",
"type": "out"
}
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.notes": {
"display": "block",
"opacity": 1
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('filter_4() called')\n\n # collect filtered artifact ids for 'if' condition 1\n matched_artifacts_1, matched_results_1 = phantom.condition(\n container=container,\n action_results=results,\n conditions=[\n [\"filtered-data:filter_3:condition_1:artifact:*.cef.vaultId\", \"!=\", \"\"],\n ],\n name=\"filter_4:condition_1\")\n\n # call connected blocks if filtered artifacts or results\n if matched_artifacts_1 or matched_results_1:\n detonate_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "file reputation",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "filter 4",
"description": "Detonate file requires a Vault file, so only proceed if vaultId is not null.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "bef1c9d9-aa68-4355-8ea3-66637924fc29",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 89,
"line_start": 71,
"name": "filter",
"notes": "Detonate file requires a Vault file, so only proceed if vaultId is not null.",
"number": 4,
"order": 4,
"outPorts": [
"out-1"
],
"outputs": [
{
"conditions": [
{
"comparison": "!=",
"data_type": "",
"param": "filtered-data:filter_3:condition_1:artifact:*.cef.vaultId",
"value": ""
}
],
"display": "If",
"logic": "and",
"type": "if"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 640,
"y": 240
},
"previous_function": "",
"previous_name": "filter_4",
"show_number": true,
"size": {
"height": 82,
"width": 82
},
"state": "filter",
"status": "",
"type": "coa.Filter",
"warn": false,
"z": 2059
},
{
"action": "hunt file",
"action_type": "investigate",
"active": false,
"active_keys": {},
"active_values": {
"hash": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5",
"range": "",
"type": ""
},
"angle": 0,
"app": "",
"approver": "",
"assets": [
{
"action": "",
"active": true,
"app_name": "",
"app_version": "",
"appid": "",
"config_type": "asset",
"fields": {
"hash": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5",
"range": "",
"type": ""
},
"has_app": true,
"id": "-",
"loaded": false,
"missing": false,
"name": "carbonblack",
"output": [
{
"data_path": "action_result.status",
"data_type": "string",
"example_values": [
"success"
]
},
{
"contains": [
"hash",
"md5"
],
"data_path": "action_result.parameter.hash",
"data_type": "string",
"example_values": [
"4fb491ac8d46aaf22ba8bc5c73dabef7",
"13ded573464ba7f43fe640479b309e09",
"9bf50324444c46997c2492d505b47f2d",
"5FB30FE90736C7FC77DE637021B1CE7C"
]
},
{
"data_path": "action_result.parameter.range",
"data_type": "string",
"example_values": [
"0-10",
"0-2",
"5-8"
]
},
{
"contains": [
"carbon black query type"
],
"data_path": "action_result.parameter.type",
"data_type": "string",
"example_values": [
"process",
"binary"
]
},
{
"data_path": "action_result.data.*.binary.elapsed",
"data_type": "numeric",
"example_values": [
0.1120398044586182,
0.04952096939086914,
0.1234798431396484,
0.05507302284240723,
0.05384993553161621
]
},
{
"data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name",
"data_type": "numeric",
"example_values": [
0
]
},
{
"data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value",
"data_type": "numeric",
"example_values": [
0
]
},
{
"data_path": "action_result.data.*.binary.facets.company_name_facet.*.name",
"data_type": "string",
"example_values": [
"Microsoft Corporation"
]
},
{
"data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio",
"data_type": "string",
"example_values": [
"100.0"
]
},
{
"data_path": "action_result.data.*.binary.facets.company_name_facet.*.value",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name",
"data_type": "string",
"example_values": [
"Microsoft Corporation"
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio",
"data_type": "string",
"example_values": [
"100.0"
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_result.*.name",
"data_type": "string",
"example_values": [
"Signed"
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_result.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio",
"data_type": "string",
"example_values": [
"100.0"
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_result.*.value",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name",
"data_type": "string",
"example_values": [
"2018-10-01T00:00:00Z",
"2015-01-01T00:00:00Z",
"2013-11-01T00:00:00Z"
]
},
{
"data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value",
"data_type": "numeric",
"example_values": [
1,
0
]
},
{
"data_path": "action_result.data.*.binary.facets.file_version_facet.*.name",
"data_type": "string",
"example_values": [
"16.0.10827.20181",
"4.7.0205.0",
"6.1.7600.16385 (win7_rtm.090713-1255)"
]
},
{
"data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio",
"data_type": "string",
"example_values": [
"100.0"
]
},
{
"data_path": "action_result.data.*.binary.facets.file_version_facet.*.value",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.binary.facets.group.*.name",
"data_type": "string",
"example_values": [
"default group"
]
},
{
"data_path": "action_result.data.*.binary.facets.group.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.binary.facets.group.*.ratio",
"data_type": "string",
"example_values": [
"100.0"
]
},
{
"data_path": "action_result.data.*.binary.facets.group.*.value",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.binary.facets.host_count.*.name",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.binary.facets.host_count.*.value",
"data_type": "numeric",
"example_values": [
1,
0
]
},
{
"data_path": "action_result.data.*.binary.facets.hostname.*.name",
"data_type": "string",
"example_values": [
"CB-TEST-02",
"WIN7-CLIENT1",
"ACCOUNTING-PC"
]
},
{
"data_path": "action_result.data.*.binary.facets.hostname.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.binary.facets.hostname.*.ratio",
"data_type": "string",
"example_values": [
"100.0",
"16.7"
]
},
{
"data_path": "action_result.data.*.binary.facets.hostname.*.value",
"data_type": "numeric",
"example_values": [
1
]
},
{
"contains": [
"file path",
"file name"
],
"data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name",
"data_type": "string",
"example_values": [
"c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe",
"c:\\program files\\microsoft security client\\nissrv.exe",
"C:\\Windows\\system32\\ping.exe"
]
},
{
"data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio",
"data_type": "string",
"example_values": [
"100.0",
"50.0"
]
},
{
"data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.binary.facets.product_name_facet.*.name",
"data_type": "string",
"example_values": [
"Microsoft Office",
"Microsoft Malware Protection"
]
},
{
"data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio",
"data_type": "string",
"example_values": [
"100.0"
]
},
{
"data_path": "action_result.data.*.binary.facets.product_name_facet.*.value",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name",
"data_type": "string",
"example_values": [
"2018-10-19T00:00:00Z",
"2018-09-29T00:00:00Z",
"2018-10-02T00:00:00Z"
]
},
{
"data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value",
"data_type": "numeric",
"example_values": [
1,
0
]
},
{
"contains": [
"md5"
],
"data_path": "action_result.data.*.binary.highlights.*.ids",
"data_type": "string",
"example_values": [
"13DED573464BA7F43FE640479B309E09",
"9BF50324444C46997C2492D505B47F2D",
"5FB30FE90736C7FC77DE637021B1CE7C"
]
},
{
"data_path": "action_result.data.*.binary.highlights.*.name",
"data_type": "string",
"example_values": [
"PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST",
"PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST",
"PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST"
]
},
{
"contains": [
"md5"
],
"data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust",
"data_type": "string",
"example_values": [
"5fb30fe90736c7fc77de637021b1ce7c"
]
},
{
"contains": [
"url"
],
"data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust",
"data_type": "string",
"example_values": [
"https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c"
]
},
{
"data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust",
"data_type": "numeric",
"example_values": [
-100
]
},
{
"data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust",
"data_type": "string",
"example_values": [
"2018-02-07T02:37:28Z"
]
},
{
"data_path": "action_result.data.*.binary.results.*.cb_version",
"data_type": "numeric",
"example_values": [
610,
510,
511
]
},
{
"data_path": "action_result.data.*.binary.results.*.company_name",
"data_type": "string",
"example_values": [
"Microsoft Corporation"
]
},
{
"data_path": "action_result.data.*.binary.results.*.copied_mod_len",
"data_type": "numeric",
"example_values": [
9683736,
366512,
16896
]
},
{
"data_path": "action_result.data.*.binary.results.*.digsig_issuer",
"data_type": "string",
"example_values": [
"Microsoft Code Signing PCA"
]
},
{
"data_path": "action_result.data.*.binary.results.*.digsig_prog_name",
"data_type": "string",
"example_values": [
"Microsoft Office",
"Microsoft Corp."
]
},
{
"data_path": "action_result.data.*.binary.results.*.digsig_publisher",
"data_type": "string",
"example_values": [
"Microsoft Corporation"
]
},
{
"data_path": "action_result.data.*.binary.results.*.digsig_result",
"data_type": "string",
"example_values": [
"Signed"
]
},
{
"data_path": "action_result.data.*.binary.results.*.digsig_result_code",
"data_type": "string",
"example_values": [
"0"
]
},
{
"data_path": "action_result.data.*.binary.results.*.digsig_sign_time",
"data_type": "string",
"example_values": [
"2018-10-14T20:23:00Z",
"2015-01-30T19:14:00Z",
"2009-07-14T10:17:00Z"
]
},
{
"data_path": "action_result.data.*.binary.results.*.digsig_subject",
"data_type": "string",
"example_values": [
"Microsoft Corporation"
]
},
{
"data_path": "action_result.data.*.binary.results.*.endpoint",
"data_type": "string",
"example_values": [
"CB-TEST-02|27",
"WIN7-CLIENT1|15",
"DC1|19"
]
},
{
"data_path": "action_result.data.*.binary.results.*.event_partition_id",
"data_type": "numeric",
"example_values": [
100972684312576,
100955696070656
]
},
{
"data_path": "action_result.data.*.binary.results.*.facet_id",
"data_type": "numeric",
"example_values": [
883737,
0
]
},
{
"data_path": "action_result.data.*.binary.results.*.file_desc",
"data_type": "string",
"example_values": [
"Microsoft Office Click-to-Run (SxS)",
"Microsoft Network Realtime Inspection Service",
"TCP/IP Ping Command"
]
},
{
"data_path": "action_result.data.*.binary.results.*.file_version",
"data_type": "string",
"example_values": [
"16.0.10827.20181",
"4.7.0205.0",
"6.1.7600.16385 (win7_rtm.090713-1255)"
]
},
{
"data_path": "action_result.data.*.binary.results.*.group",
"data_type": "string",
"example_values": [
"Default Group"
]
},
{
"data_path": "action_result.data.*.binary.results.*.host_count",
"data_type": "numeric",
"example_values": [
1,
6
]
},
{
"contains": [
"file name"
],
"data_path": "action_result.data.*.binary.results.*.internal_name",
"data_type": "string",
"example_values": [
"OfficeClickToRun.exe",
"NisSrv.exe",
"ping.exe"
]
},
{
"data_path": "action_result.data.*.binary.results.*.is_64bit",
"data_type": "boolean",
"example_values": [
false,
true
]
},
{
"data_path": "action_result.data.*.binary.results.*.is_executable_image",
"data_type": "boolean",
"example_values": [
false,
true
]
},
{
"data_path": "action_result.data.*.binary.results.*.last_seen",
"data_type": "string",
"example_values": [
"2018-10-28T10:06:02.456Z",
"2018-10-28T10:06:42.455Z",
"2018-10-26T00:01:41.224Z"
]
},
{
"data_path": "action_result.data.*.binary.results.*.legal_copyright",
"data_type": "string",
"example_values": [
"Microsoft Corporation. All rights reserved."
]
},
{
"contains": [
"md5"
],
"data_path": "action_result.data.*.binary.results.*.md5",
"data_type": "string",
"example_values": [
"13DED573464BA7F43FE640479B309E09",
"9BF50324444C46997C2492D505B47F2D",
"5FB30FE90736C7FC77DE637021B1CE7C"
]
},
{
"contains": [
"file path",
"file name"
],
"data_path": "action_result.data.*.binary.results.*.observed_filename",
"data_type": "string",
"example_values": [
"c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe",
"c:\\program files\\microsoft security client\\nissrv.exe",
"c:\\windows\\system32\\ping.exe"
]
},
{
"data_path": "action_result.data.*.binary.results.*.orig_mod_len",
"data_type": "numeric",
"example_values": [
9683736,
366512,
16896
]
},
{
"contains": [
"file name"
],
"data_path": "action_result.data.*.binary.results.*.original_filename",
"data_type": "string",
"example_values": [
"OfficeClickToRun.exe",
"NisSrv.exe",
"ping.exe.mui"
]
},
{
"data_path": "action_result.data.*.binary.results.*.os_type",
"data_type": "string",
"example_values": [
"Windows"
]
},
{
"data_path": "action_result.data.*.binary.results.*.product_name",
"data_type": "string",
"example_values": [
"Microsoft Office",
"Microsoft Malware Protection"
]
},
{
"data_path": "action_result.data.*.binary.results.*.product_version",
"data_type": "string",
"example_values": [
"16.0.10827.20181",
"4.7.0205.0",
"6.1.7600.16385"
]
},
{
"data_path": "action_result.data.*.binary.results.*.server_added_timestamp",
"data_type": "string",
"example_values": [
"2018-10-19T17:04:47.906Z",
"2015-07-01T02:12:21.783Z",
"2015-05-15T07:23:54.846Z"
]
},
{
"column_name": "Signed",
"column_order": 1,
"data_path": "action_result.data.*.binary.results.*.signed",
"data_type": "string",
"example_values": [
"Signed"
]
},
{
"data_path": "action_result.data.*.binary.results.*.timestamp",
"data_type": "string",
"example_values": [
"2018-10-19T17:04:47.906Z",
"2015-07-01T02:12:21.783Z",
"2015-05-15T07:23:54.846Z"
]
},
{
"data_path": "action_result.data.*.binary.results.*.watchlists.*.value",
"data_type": "string",
"example_values": [
"2015-07-01T02:20:02.062Z",
"2015-05-15T07:30:02.843Z"
]
},
{
"data_path": "action_result.data.*.binary.results.*.watchlists.*.wid",
"data_type": "string",
"example_values": [
"5"
]
},
{
"data_path": "action_result.data.*.binary.start",
"data_type": "numeric",
"example_values": [
0,
5
]
},
{
"data_path": "action_result.data.*.binary.terms",
"data_type": "string",
"example_values": [
"md5:13ded573464ba7f43fe640479b309e09",
"md5:9bf50324444c46997c2492d505b47f2d",
"md5:5FB30FE90736C7FC77DE637021B1CE7C"
]
},
{
"data_path": "action_result.data.*.binary.total_results",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "action_result.data.*.process.all_segments",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.process.comprehensive_search",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.process.elapsed",
"data_type": "numeric",
"example_values": [
0.2200779914855957
]
},
{
"data_path": "action_result.data.*.process.facets.day_of_week.*.name",
"data_type": "string",
"example_values": [
"0"
]
},
{
"data_path": "action_result.data.*.process.facets.day_of_week.*.value",
"data_type": "numeric",
"example_values": [
1566
]
},
{
"data_path": "action_result.data.*.process.facets.group.*.name",
"data_type": "string",
"example_values": [
"default group"
]
},
{
"data_path": "action_result.data.*.process.facets.group.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.process.facets.group.*.ratio",
"data_type": "string",
"example_values": [
"100.0"
]
},
{
"data_path": "action_result.data.*.process.facets.group.*.value",
"data_type": "numeric",
"example_values": [
10128
]
},
{
"data_path": "action_result.data.*.process.facets.host_type.*.name",
"data_type": "string",
"example_values": [
"domain_controller"
]
},
{
"data_path": "action_result.data.*.process.facets.host_type.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.process.facets.host_type.*.ratio",
"data_type": "string",
"example_values": [
"100.0"
]
},
{
"data_path": "action_result.data.*.process.facets.host_type.*.value",
"data_type": "numeric",
"example_values": [
10123
]
},
{
"data_path": "action_result.data.*.process.facets.hostname.*.name",
"data_type": "string",
"example_values": [
"dc2"
]
},
{
"data_path": "action_result.data.*.process.facets.hostname.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.process.facets.hostname.*.ratio",
"data_type": "string",
"example_values": [
"51.2"
]
},
{
"data_path": "action_result.data.*.process.facets.hostname.*.value",
"data_type": "numeric",
"example_values": [
5185
]
},
{
"data_path": "action_result.data.*.process.facets.hour_of_day.*.name",
"data_type": "string",
"example_values": [
"0"
]
},
{
"data_path": "action_result.data.*.process.facets.hour_of_day.*.value",
"data_type": "numeric",
"example_values": [
411
]
},
{
"contains": [
"file name"
],
"data_path": "action_result.data.*.process.facets.parent_name.*.name",
"data_type": "string",
"example_values": [
"svchost.exe"
]
},
{
"data_path": "action_result.data.*.process.facets.parent_name.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.process.facets.parent_name.*.ratio",
"data_type": "string",
"example_values": [
"98.5"
]
},
{
"data_path": "action_result.data.*.process.facets.parent_name.*.value",
"data_type": "numeric",
"example_values": [
9971
]
},
{
"contains": [
"file path",
"file name"
],
"data_path": "action_result.data.*.process.facets.path_full.*.name",
"data_type": "string",
"example_values": [
"c:\\windows\\syswow64\\wbem\\wmiprvse.exe"
]
},
{
"data_path": "action_result.data.*.process.facets.path_full.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.process.facets.path_full.*.ratio",
"data_type": "string",
"example_values": [
"98.5"
]
},
{
"data_path": "action_result.data.*.process.facets.path_full.*.value",
"data_type": "numeric",
"example_values": [
9971
]
},
{
"contains": [
"md5"
],
"data_path": "action_result.data.*.process.facets.process_md5.*.name",
"data_type": "string",
"example_values": [
"4fb491ac8d46aaf22ba8bc5c73dabef7"
]
},
{
"data_path": "action_result.data.*.process.facets.process_md5.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.process.facets.process_md5.*.ratio",
"data_type": "string",
"example_values": [
"98.5"
]
},
{
"data_path": "action_result.data.*.process.facets.process_md5.*.value",
"data_type": "numeric",
"example_values": [
9971
]
},
{
"contains": [
"file name"
],
"data_path": "action_result.data.*.process.facets.process_name.*.name",
"data_type": "string",
"example_values": [
"wmiprvse.exe"
]
},
{
"data_path": "action_result.data.*.process.facets.process_name.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.process.facets.process_name.*.ratio",
"data_type": "string",
"example_values": [
"98.5"
]
},
{
"data_path": "action_result.data.*.process.facets.process_name.*.value",
"data_type": "numeric",
"example_values": [
9971
]
},
{
"data_path": "action_result.data.*.process.facets.start.*.name",
"data_type": "string",
"example_values": [
"2018-02-24T00:00:00Z"
]
},
{
"data_path": "action_result.data.*.process.facets.start.*.value",
"data_type": "numeric",
"example_values": [
324
]
},
{
"data_path": "action_result.data.*.process.facets.username_full.*.name",
"data_type": "string",
"example_values": [
"LOCAL SERVICE"
]
},
{
"data_path": "action_result.data.*.process.facets.username_full.*.percent",
"data_type": "numeric",
"example_values": [
100
]
},
{
"data_path": "action_result.data.*.process.facets.username_full.*.ratio",
"data_type": "string",
"example_values": [
"98.4"
]
},
{
"data_path": "action_result.data.*.process.facets.username_full.*.value",
"data_type": "numeric",
"example_values": [
9966
]
},
{
"data_path": "action_result.data.*.process.incomplete_results",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"contains": [
"md5"
],
"data_path": "action_result.data.*.process.results.*.alliance_data_srstrust",
"data_type": "string",
"example_values": [
"4fb491ac8d46aaf22ba8bc5c73dabef7"
]
},
{
"contains": [
"url"
],
"data_path": "action_result.data.*.process.results.*.alliance_link_srstrust",
"data_type": "string",
"example_values": [
"https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7"
]
},
{
"data_path": "action_result.data.*.process.results.*.alliance_score_srstrust",
"data_type": "numeric",
"example_values": [
-100
]
},
{
"data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust",
"data_type": "string",
"example_values": [
"2018-02-07T02:37:28Z"
]
},
{
"data_path": "action_result.data.*.process.results.*.childproc_count",
"data_type": "numeric",
"example_values": [
0
]
},
{
"contains": [
"file path"
],
"data_path": "action_result.data.*.process.results.*.cmdline",
"data_type": "string",
"example_values": [
"C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding"
]
},
{
"data_path": "action_result.data.*.process.results.*.comms_ip",
"data_type": "numeric",
"example_values": [
168886572
]
},
{
"data_path": "action_result.data.*.process.results.*.crossproc_count",
"data_type": "numeric",
"example_values": [
2
]
},
{
"data_path": "action_result.data.*.process.results.*.emet_config",
"data_type": "string",
"example_values": [
""
]
},
{
"data_path": "action_result.data.*.process.results.*.emet_count",
"data_type": "numeric",
"example_values": [
0
]
},
{
"data_path": "action_result.data.*.process.results.*.filemod_count",
"data_type": "numeric",
"example_values": [
0
]
},
{
"data_path": "action_result.data.*.process.results.*.filtering_known_dlls",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.process.results.*.group",
"data_type": "string",
"example_values": [
"default group"
]
},
{
"data_path": "action_result.data.*.process.results.*.host_type",
"data_type": "string",
"example_values": [
"workstation"
]
},
{
"contains": [
"host name"
],
"data_path": "action_result.data.*.process.results.*.hostname",
"data_type": "string",
"example_values": [
"win7-client1"
]
},
{
"contains": [
"carbon black process id"
],
"data_path": "action_result.data.*.process.results.*.id",
"data_type": "string",
"example_values": [
"0000000f-0000-0688-01d3-27738c9b4243"
]
},
{
"data_path": "action_result.data.*.process.results.*.interface_ip",
"data_type": "numeric",
"example_values": [
168886572
]
},
{
"data_path": "action_result.data.*.process.results.*.last_server_update",
"data_type": "string",
"example_values": [
"2018-03-22T09:21:32.332Z"
]
},
{
"data_path": "action_result.data.*.process.results.*.last_update",
"data_type": "string",
"example_values": [
"2017-09-07T00:52:15.82Z"
]
},
{
"data_path": "action_result.data.*.process.results.*.modload_count",
"data_type": "numeric",
"example_values": [
43
]
},
{
"data_path": "action_result.data.*.process.results.*.netconn_count",
"data_type": "numeric",
"example_values": [
0
]
},
{
"data_path": "action_result.data.*.process.results.*.os_type",
"data_type": "string",
"example_values": [
"windows"
]
},
{
"data_path": "action_result.data.*.process.results.*.parent_id",
"data_type": "string",
"example_values": [
"0000000f-0000-0258-01d1-ec51b545a19b"
]
},
{
"data_path": "action_result.data.*.process.results.*.parent_md5",
"data_type": "string",
"example_values": [
"000000000000000000000000000000"
]
},
{
"contains": [
"file name"
],
"data_path": "action_result.data.*.process.results.*.parent_name",
"data_type": "string",
"example_values": [
"svchost.exe"
]
},
{
"data_path": "action_result.data.*.process.results.*.parent_pid",
"data_type": "numeric",
"example_values": [
600
]
},
{
"data_path": "action_result.data.*.process.results.*.parent_unique_id",
"data_type": "string",
"example_values": [
"0000000f-0000-0258-01d1-ec51b545a19b-000000000001"
]
},
{
"contains": [
"file path",
"file name"
],
"data_path": "action_result.data.*.process.results.*.path",
"data_type": "string",
"example_values": [
"c:\\windows\\syswow64\\wbem\\wmiprvse.exe"
]
},
{
"contains": [
"md5"
],
"data_path": "action_result.data.*.process.results.*.process_md5",
"data_type": "string",
"example_values": [
"4fb491ac8d46aaf22ba8bc5c73dabef7"
]
},
{
"contains": [
"process name",
"file name"
],
"data_path": "action_result.data.*.process.results.*.process_name",
"data_type": "string",
"example_values": [
"wmiprvse.exe"
]
},
{
"contains": [
"pid"
],
"data_path": "action_result.data.*.process.results.*.process_pid",
"data_type": "numeric",
"example_values": [
1672
]
},
{
"data_path": "action_result.data.*.process.results.*.processblock_count",
"data_type": "numeric",
"example_values": [
0
]
},
{
"data_path": "action_result.data.*.process.results.*.regmod_count",
"data_type": "numeric",
"example_values": [
0
]
},
{
"data_path": "action_result.data.*.process.results.*.segment_id",
"data_type": "numeric",
"example_values": [
1
]
},
{
"contains": [
"carbon black sensor id"
],
"data_path": "action_result.data.*.process.results.*.sensor_id",
"data_type": "numeric",
"example_values": [
15
]
},
{
"data_path": "action_result.data.*.process.results.*.start",
"data_type": "string",
"example_values": [
"2017-09-07T00:52:15.758Z"
]
},
{
"data_path": "action_result.data.*.process.results.*.terminated",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.data.*.process.results.*.unique_id",
"data_type": "string",
"example_values": [
"0000000f-0000-0688-01d3-27738c9b4243-000000000001"
]
},
{
"contains": [
"user name"
],
"data_path": "action_result.data.*.process.results.*.username",
"data_type": "string",
"example_values": [
"SYSTEM"
]
},
{
"data_path": "action_result.data.*.process.start",
"data_type": "numeric",
"example_values": [
0
]
},
{
"data_path": "action_result.data.*.process.terms",
"data_type": "string",
"example_values": [
"md5:4fb491ac8d46aaf22ba8bc5c73dabef7"
]
},
{
"data_path": "action_result.data.*.process.total_results",
"data_type": "numeric",
"example_values": [
32404
]
},
{
"data_path": "action_result.summary.device_count",
"data_type": "numeric",
"example_values": [
32404,
1
]
},
{
"data_path": "action_result.message",
"data_type": "string",
"example_values": [
"Displaying 10 'process' results of total 32404",
"Displaying 1 'binary' results of total 1",
"Displaying 0 'binary' results of total 1"
]
},
{
"data_path": "summary.total_objects",
"data_type": "numeric",
"example_values": [
1
]
},
{
"data_path": "summary.total_objects_successful",
"data_type": "numeric",
"example_values": [
1
]
}
],
"product_name": "",
"product_vendor": "",
"type": "endpoint"
}
],
"attrs": {
".action": {
"text": "hunt file 2"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".border": {
"height": 88
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"fill": "#FFFFFF",
"font-size": 12,
"font-weight": 300,
"opacity": 0,
"ref": ".background",
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "Investigate"
},
"g.approver image": {
"opacity": 1
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.icon image": {
"xlink:href": "/inc/coa/img/block_icon_investigate.svg"
},
"g.notes": {
"display": "block",
"opacity": 1
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
},
"g.timer image": {
"opacity": 1
},
"rect.warn-background": {
"fill": "#FFFFFF"
},
"text.icon": {
"fill": "#FFFFFF"
}
},
"block_code": "def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('hunt_file_2() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'hunt_file_2' call\n filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5\", \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.context.artifact_id\"])\n\n parameters = []\n \n # build parameters list for 'hunt_file_2' call\n for filtered_results_item_1 in filtered_results_data_1:\n if filtered_results_item_1[0]:\n parameters.append({\n 'hash': filtered_results_item_1[0],\n 'type': \"\",\n 'range': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': filtered_results_item_1[1]},\n })\n\n phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=join_format_for_emailer, name=\"hunt_file_2\")\n\n return",
"callback_code": "",
"callback_start": 68,
"callsback": true,
"color": "#654796",
"connected_to_start": true,
"connection_name": "detonate file",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "",
"delay": 0,
"description": "Hunt for binaries with the malicious fileHash across endpoints.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "35f205e2-949e-463e-9057-658f597b1dc9",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 215,
"line_end": 68,
"line_start": 43,
"message": "Configuring now",
"name": "hunt file",
"notes": "Hunt for binaries with the malicious fileHash across endpoints.",
"number": 2,
"order": 3,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 1160,
"y": 240
},
"previous_function": "",
"previous_name": "hunt_file_2",
"required_params": {
"hash": true
},
"reviewer": "",
"show_number": true,
"size": {
"height": 112,
"width": 168
},
"state": "asset",
"status": "",
"title": "Investigate",
"type": "coa.Action",
"warn": false,
"z": 2065
},
{
"active": false,
"angle": 0,
"attrs": {
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".format": {
"text": "format_for_emailer"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"opacity": 0,
"text": "Configuring now"
},
".outPorts>.port-out-1": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out-1>.port-body": {
"port": {
"id": "out-1",
"type": "out"
}
},
".title": {
"text": "format"
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.notes": {
"display": "block"
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
}
},
"block_code": "def format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('format_for_emailer() called')\n \n template = \"\"\"Malware in a security event has been confirmed using file reputation and/or file detonation services.\n\nReputation Results:\nUsing file reputation services, the following file hashes have been identified as malware:\n{0}\n\nEDR tool detects that the above file hashes are present on the following endpoints: \n{1}\n\nDetonation Results:\nUsing sandboxing services, the following file hashes have been identified as malware:\n{2}\n\nThe Phantom Vault ID for the malicious files, as determined by the sandbox service, are as follows:\n{3}\n\nEDR tool detects that the file hashes indicated as positives per the sandbox service are present on the following endpoints: \n{4}\n\nContainer id: {5}\n\n[EOM]\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"hunt_file_1:action_result.parameter.hash\",\n \"hunt_file_1:action_result.data.*.process.results.*.hostname\",\n \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5\",\n \"filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.vault_id\",\n \"hunt_file_2:action_result.data.*.process.results.*.hostname\",\n \"container:id\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"format_for_emailer\")\n\n send_email_1(container=container)\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": false,
"connected_to_start": true,
"connection_name": "hunt file 1, hunt file 2",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "format_for_emailer",
"description": "Format all results for an email.",
"format": "format",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "f989d5e9-9586-408e-b424-8a3a5384936a",
"inPorts": [
"in"
],
"join_code": "def join_format_for_emailer(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('join_format_for_emailer() called')\n\n # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n if phantom.completed(action_names=['hunt_file_1', 'hunt_file_2']):\n \n # call connected block \"format_for_emailer\"\n format_for_emailer(container=container, handle=handle)\n \n return",
"join_optional": [],
"join_start": 314,
"line_end": 325,
"line_start": 272,
"message": "Configuring now",
"name": "format",
"notes": "Format all results for an email.",
"number": 2,
"order": 12,
"outPorts": [
"out-1"
],
"parameters": [
{
"position": 0,
"type": "",
"value": "hunt_file_1:action_result.parameter.hash"
},
{
"position": 1,
"type": "",
"value": "hunt_file_1:action_result.data.*.process.results.*.hostname"
},
{
"position": 2,
"type": "",
"value": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.data.*.file_info.md5"
},
{
"position": 3,
"type": "",
"value": "filtered-data:filter_5:condition_1:detonate_file_1:action_result.parameter.vault_id"
},
{
"position": 4,
"type": "",
"value": "hunt_file_2:action_result.data.*.process.results.*.hostname"
},
{
"position": 5,
"type": "",
"value": "container:id"
}
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 1400,
"y": 100
},
"previous_function": "",
"previous_name": "format_for_emailer",
"show_number": true,
"size": {
"height": 100,
"width": 180
},
"state": "format",
"status": "",
"template": "Malware in a security event has been confirmed using file reputation and/or file detonation services.\n\nReputation Results:\nUsing file reputation services, the following file hashes have been identified as malware:\n{0}\n\nEDR tool detects that the above file hashes are present on the following endpoints: \n{1}\n\nDetonation Results:\nUsing sandboxing services, the following file hashes have been identified as malware:\n{2}\n\nThe Phantom Vault ID for the malicious files, as determined by the sandbox service, are as follows:\n{3}\n\nEDR tool detects that the file hashes indicated as positives per the sandbox service are present on the following endpoints: \n{4}\n\n\nContainer id: {5}\n\n[EOM]",
"title": "format",
"type": "coa.Format",
"warn": false,
"z": 2067
},
{
"attrs": {
".connection": {
"stroke": "#818D99",
"stroke-width": 2
},
".marker-target": {
"d": "M 10 0 L 0 5 L 10 10 z",
"fill": "#818D99",
"stroke": "#818D99"
}
},
"connector": {
"args": {
"radius": 5
},
"name": "rounded"
},
"endDirections": [
"left"
],
"id": "24b9331c-ecbd-454d-bdbd-926babd67934",
"router": {
"name": "metro"
},
"source": {
"id": "f989d5e9-9586-408e-b424-8a3a5384936a",
"selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
},
"startDirections": [
"right"
],
"target": {
"id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb",
"selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
},
"type": "link",
"z": 2068
},
{
"action": "send email",
"action_type": "generic",
"active": false,
"active_keys": {},
"active_values": {
"attachments": "",
"bcc": "",
"body": "format_for_emailer:formatted_data",
"cc": "",
"from": "automation@phantom.localhost",
"headers": "",
"subject": "Malware event confirmed",
"to": "recipient@phantom.localhost"
},
"angle": 0,
"app": "",
"approver": "",
"assets": [
{
"action": "",
"active": true,
"app_name": "SMTP",
"app_version": "1.2.29",
"appid": "",
"config_type": "asset",
"fields": {
"attachments": "",
"bcc": "",
"body": "format_for_emailer:formatted_data",
"cc": "",
"from": "automation@phantom.localhost",
"headers": "",
"subject": "Malware event confirmed",
"to": "recipient@phantom.localhost"
},
"has_app": true,
"id": "-",
"loaded": false,
"missing": false,
"name": "smtp",
"output": [
{
"column_name": "Status",
"column_order": 0,
"data_path": "action_result.status",
"data_type": "string",
"example_values": [
"success",
"failed"
]
},
{
"contains": [
"vault id"
],
"data_path": "action_result.parameter.attachments",
"data_type": "string",
"example_values": [
"ab2b2ccfba08ea538ef22f521caa01c3c2b17ccf"
]
},
{
"contains": [
"email"
],
"data_path": "action_result.parameter.bcc",
"data_type": "string",
"example_values": [
"test1@testdomain.com"
]
},
{
"data_path": "action_result.parameter.body",
"data_type": "string",
"example_values": [
"Test body"
]
},
{
"contains": [
"email"
],
"data_path": "action_result.parameter.cc",
"data_type": "string",
"example_values": [
"test2@testdomain.com"
]
},
{
"contains": [
"email"
],
"data_path": "action_result.parameter.from",
"data_type": "string",
"example_values": [
"sender@testdomain.com"
]
},
{
"data_path": "action_result.parameter.headers",
"data_type": "string",
"example_values": [
"{\"Subject\": \"Test1\", \"To\": \"test3@testdomain.com\"}"
]
},
{
"data_path": "action_result.parameter.subject",
"data_type": "string",
"example_values": [
"Test"
]
},
{
"contains": [
"email"
],
"data_path": "action_result.parameter.to",
"data_type": "string",
"example_values": [
"receiver@testdomain.com"
]
},
{
"data_path": "action_result.data",
"data_type": "string"
},
{
"data_path": "action_result.summary",
"data_type": "string"
},
{
"column_name": "Message",
"column_order": 1,
"data_path": "action_result.message",
"data_type": "string",
"example_values": [
"Email sent"
]
},
{
"data_path": "summary.total_objects",
"data_type": "numeric"
},
{
"data_path": "summary.total_objects_successful",
"data_type": "numeric"
}
],
"product_name": "SMTP",
"product_vendor": "Generic",
"type": "email"
}
],
"attrs": {
".action": {
"text": "send email"
},
".background": {
"fill": "#000000",
"stroke": "#5C6773"
},
".color-band": {
"fill": "#3C444D"
},
".inPorts>.port-in": {
"ref": ".background",
"ref-x": 0.5
},
".inPorts>.port-in>.port-body": {
"port": {
"id": "in",
"type": "in"
}
},
".message": {
"fill": "#FFFFFF",
"font-size": 12,
"font-weight": 300,
"opacity": 0,
"ref": ".background",
"ref-x": 5,
"ref-y": 105,
"text": "Configuring now"
},
".outPorts>.port-out": {
"ref": ".background",
"ref-x": 0.5
},
".outPorts>.port-out>.port-body": {
"port": {
"id": "out",
"type": "out"
}
},
".title": {
"text": "Generic"
},
"g.approver image": {
"opacity": 1
},
"g.code image": {
"opacity": 1
},
"g.delete": {
"display": "none"
},
"g.error": {
"opacity": 0
},
"g.error image": {
"xlink:href": "/inc/coa/img/block_icon_warn.svg"
},
"g.icon image": {
"xlink:href": "/inc/coa/img/block_icon_generic.svg"
},
"g.notes": {
"display": "block",
"opacity": 1
},
"g.notes image": {
"opacity": 1,
"xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
},
"g.timer image": {
"opacity": 1
},
"rect.warn-background": {
"fill": "#FFFFFF"
},
"text.icon": {
"fill": "#FFFFFF"
}
},
"block_code": "def send_email_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('send_email_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'send_email_1' call\n formatted_data_1 = phantom.get_format_data(name='format_for_emailer')\n\n parameters = []\n \n # build parameters list for 'send_email_1' call\n parameters.append({\n 'cc': \"\",\n 'to': \"recipient@phantom.localhost\",\n 'bcc': \"\",\n 'body': formatted_data_1,\n 'from': \"automation@phantom.localhost\",\n 'headers': \"\",\n 'subject': \"Malware event confirmed\",\n 'attachments': \"\",\n })\n\n phantom.act(action=\"send email\", parameters=parameters, assets=['smtp'], name=\"send_email_1\")\n\n return",
"callback_code": "",
"callback_start": 1,
"callsback": true,
"color": "#5094D4",
"connected_to_start": true,
"connection_name": "hunt file 1, hunt file 2",
"connection_type": "action",
"custom_callback": "",
"custom_code": "",
"custom_join": "",
"custom_name": "",
"delay": 0,
"description": "Send the formatted string as an email.",
"has_custom": false,
"has_custom_block": false,
"has_custom_callback": false,
"has_custom_join": false,
"id": "f7b3a5ea-71f6-449d-a67a-506c8d506ceb",
"inPorts": [
"in"
],
"join_code": "",
"join_optional": [],
"join_start": 1,
"line_end": 269,
"line_start": 243,
"message": "Configuring now",
"name": "send email",
"notes": "Send the formatted string as an email.",
"number": 1,
"order": 11,
"outPorts": [
"out"
],
"ports": {
"groups": {
"in": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "left"
}
},
"position": {
"name": "left"
}
},
"out": {
"attrs": {
".port-body": {
"fill": "#fff",
"magnet": true,
"r": 10,
"stroke": "#000"
},
".port-label": {
"fill": "#000"
}
},
"label": {
"position": {
"args": {
"y": 10
},
"name": "right"
}
},
"position": {
"name": "right"
}
}
}
},
"position": {
"x": 1640,
"y": 100
},
"previous_function": "",
"previous_name": "send_email_1",
"required_params": {
"body": true,
"to": true
},
"reviewer": "",
"show_number": false,
"size": {
"height": 112,
"width": 168
},
"state": "action_assets",
"status": "",
"title": "Generic",
"type": "coa.Action",
"warn": "",
"z": 2069
}
]
},
"notes": "The playbook uses the following Apps: \n - Virus Total (file reputation) [asset name = virustotal]\n - Palo Alto Networks Wildfire (detonate file) [asset name = wildfire]\n - Carbon Black (hunt file) [asset name = carbonblack]\n - SMTP (send email) [asset name = smtp]\n\nBe sure to update asset naming to reflect the asset names configured in your environment."
},
"python_version": "3",
"schema": 4,
"version": "4.10.0.40961"
},
"create_time": "2021-01-19T21:50:52.204902+00:00",
"draft_mode": false,
"labels": [
"*"
],
"tags": []
}
Reference in New Issue View Git Blame Copy Permalink