admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
sysmon_fix
splunk-security_content/playbooks/Splunk_Attack_Analyzer_Dynamic_Analysis.json
T
tccontre bcb28ec561 Splunk_Attack_Analyzer_Dynamic_Analysis_Fix_Bug
2023-08-16 17:30:08 +02:00

815 lines
44 KiB
JSON
Raw Permalink Blame History

{
"blockly": false,
"blockly_xml": "<xml></xml>",
"category": "Dynamic Analysis",
"coa": {
"data": {
"description": "Accepts a URL or vault_id and does detonation analysis on the objects. Generates a global report and a per observable sub-report and normalized score. The score can be customized based on a variety of factors.\n\n",
"edges": [
{
"id": "port_0_to_port_2",
"sourceNode": "0",
"sourcePort": "0_out",
"targetNode": "2",
"targetPort": "2_in"
},
{
"conditions": [
{
"index": 0
}
],
"id": "port_2_to_port_3",
"sourceNode": "2",
"sourcePort": "2_out",
"targetNode": "3",
"targetPort": "3_in"
},
{
"id": "port_8_to_port_10",
"sourceNode": "8",
"sourcePort": "8_out",
"targetNode": "10",
"targetPort": "10_in"
},
{
"id": "port_10_to_port_11",
"sourceNode": "10",
"sourcePort": "10_out",
"targetNode": "11",
"targetPort": "11_in"
},
{
"id": "port_11_to_port_1",
"sourceNode": "11",
"sourcePort": "11_out",
"targetNode": "1",
"targetPort": "1_in"
},
{
"conditions": [
{
"index": 1
}
],
"id": "port_2_to_port_12",
"sourceNode": "2",
"sourcePort": "2_out",
"targetNode": "12",
"targetPort": "12_in"
},
{
"id": "port_17_to_port_18",
"sourceNode": "17",
"sourcePort": "17_out",
"targetNode": "18",
"targetPort": "18_in"
},
{
"id": "port_18_to_port_19",
"sourceNode": "18",
"sourcePort": "18_out",
"targetNode": "19",
"targetPort": "19_in"
},
{
"id": "port_19_to_port_1",
"sourceNode": "19",
"sourcePort": "19_out",
"targetNode": "1",
"targetPort": "1_in"
},
{
"id": "port_12_to_port_4",
"sourceNode": "12",
"sourcePort": "12_out",
"targetNode": "4",
"targetPort": "4_in"
},
{
"id": "port_6_to_port_7",
"sourceNode": "6",
"sourcePort": "6_out",
"targetNode": "7",
"targetPort": "7_in"
},
{
"conditions": [
{
"index": 0
}
],
"id": "port_7_to_port_8",
"sourceNode": "7",
"sourcePort": "7_out",
"targetNode": "8",
"targetPort": "8_in"
},
{
"id": "port_3_to_port_22",
"sourceNode": "3",
"sourcePort": "3_out",
"targetNode": "22",
"targetPort": "22_in"
},
{
"id": "port_15_to_port_23",
"sourceNode": "15",
"sourcePort": "15_out",
"targetNode": "23",
"targetPort": "23_in"
},
{
"conditions": [
{
"index": 0
}
],
"id": "port_23_to_port_17",
"sourceNode": "23",
"sourcePort": "23_out",
"targetNode": "17",
"targetPort": "17_in"
},
{
"conditions": [
{
"index": 0
}
],
"id": "port_22_to_port_6",
"sourceNode": "22",
"sourcePort": "22_out",
"targetNode": "6",
"targetPort": "6_in"
},
{
"conditions": [
{
"index": 0
}
],
"id": "port_4_to_port_15",
"sourceNode": "4",
"sourcePort": "4_out",
"targetNode": "15",
"targetPort": "15_in"
}
],
"hash": "cb5ebab4cfc30aa2e25d82bca5228e99b9153608",
"nodes": {
"0": {
"data": {
"advanced": {
"join": []
},
"functionName": "on_start",
"id": "0",
"type": "start"
},
"errors": {},
"id": "0",
"type": "start",
"warnings": {},
"x": 200,
"y": -1.2789769243681803e-13
},
"1": {
"data": {
"advanced": {
"join": []
},
"functionName": "on_finish",
"id": "1",
"type": "end"
},
"errors": {},
"id": "1",
"type": "end",
"userCode": "\n # Write your custom code here...\n #phantom.debug(output)\n",
"warnings": {},
"x": 200,
"y": 1800
},
"10": {
"data": {
"advanced": {
"customName": "format url report ",
"customNameId": 0,
"description": "Format a summary table with the information gathered from the playbook.",
"join": [],
"note": "Format a summary table with the information gathered from the playbook."
},
"functionId": 1,
"functionName": "format_url_report",
"id": "10",
"parameters": [
"normalized_url_forensic_output:custom_function:url",
"normalized_url_forensic_output:custom_function:scores",
"normalized_url_forensic_output:custom_function:score_id",
"normalized_url_forensic_output:custom_function:categories",
"normalized_url_forensic_output:custom_function:job_id"
],
"template": "SOAR analyzed URL(s) using Splunk Attack Analyzer. The table below shows a summary of the information gathered.\n\n| URL | Normalized Score | Score Id | Categories | Report Link | Source |\n| --- | --- | --- | --- | --- | --- |\n%%\n| `{0}` | {1} | {2} | {3} | https://app.twinwave.io/job/{4} | Splunk Attack Analyzer (SAA) |\n%%\n\n\n",
"type": "format"
},
"errors": {},
"id": "10",
"type": "format",
"userCode": "\n # Write your custom code here...\n #phantom.debug(phantom.format(container=container, template=template, parameters=parameters, name=\"format_report_url\"))\n",
"warnings": {},
"x": 0,
"y": 1440
},
"11": {
"data": {
"advanced": {
"customName": "build url output",
"customNameId": 0,
"description": "This block uses custom code to generate an observable dictionary to output into the observables data path.",
"join": [],
"note": "This block uses custom code to generate an observable dictionary to output into the observables data path."
},
"functionId": 3,
"functionName": "build_url_output",
"id": "11",
"inputParameters": [
"normalized_url_forensic_output:custom_function:url",
"normalized_url_forensic_output:custom_function:job_id",
"normalized_url_forensic_output:custom_function:url_score_object"
],
"outputVariables": [
"observable_array"
],
"type": "code"
},
"errors": {},
"id": "11",
"type": "code",
"userCode": "\n # Write your custom code here...\n from urllib.parse import urlparse\n build_url_output__observable_array = []\n #phantom.debug(playbook_input_url_values)\n # Build URL\n\n \n for url, external_id, url_object in zip(normalized_url_forensic_output__url, normalized_url_forensic_output__job_id, normalized_url_forensic_output__url_score_object):\n parsed_url = urlparse(url)\n #phantom.debug(\"url: {} jobs_id:{}\".format(url, external_id))\n #phantom.debug(\"parsed_url: {}, url_object: {}\".format(parsed_url, url_object))\n observable_object = {\n \"value\": url,\n \"type\": \"url\",\n \"reputation\": {\n \"base_score\": url_object['base_score'],\n \"score\": url_object['score'],\n \"score_id\": url_object['score_id'],\n \"confidence\": url_object['base_score'] #Attack Analyzer's score has confidence baked in.\n },\n \"attributes\": {\n \"hostname\": parsed_url.hostname,\n \"scheme\": parsed_url.scheme\n },\n \"classifications\": url_object['categories'],\n \"source\": \"Splunk Attack Analyzer\",\n \"source_link\": f\"https://app.twinwave.io/job/{external_id}\"\n }\n\n if parsed_url.path:\n observable_object['attributes']['path'] = parsed_url.path\n if parsed_url.query:\n observable_object['attributes']['query'] = parsed_url.query\n if parsed_url.port:\n observable_object['attributes']['port'] = parsed_url.port\n\n build_url_output__observable_array.append(observable_object)\n #phantom.debug(\"build_url_output__observable_array: {}\".format(build_url_output__observable_array))\n",
"warnings": {},
"x": 0,
"y": 1620
},
"12": {
"data": {
"action": "detonate file",
"actionType": "generic",
"advanced": {
"customName": "file detonation",
"customNameId": 0,
"delayTime": 0,
"description": "Queries SAA for information about the provided vault_id(s)",
"join": [],
"note": "Queries SAA for information about the provided vault_id(s)"
},
"connector": "Splunk Attack Analyzer Connector for Splunk SOAR",
"connectorConfigs": [
"splunk attack analyzer app"
],
"connectorId": "de681fee-c552-45bf-9212-827b1c7529f8",
"connectorVersion": "v1",
"functionId": 1,
"functionName": "file_detonation",
"id": "12",
"parameters": {
"file": "filtered-data:saa_input_filter:condition_2:playbook_input:vault_id"
},
"requiredParameters": [
{
"data_type": "string",
"field": "file"
}
],
"type": "action"
},
"errors": {},
"id": "12",
"type": "action",
"warnings": {},
"x": 340,
"y": 320
},
"15": {
"data": {
"action": "get job forensics",
"actionType": "investigate",
"advanced": {
"customName": "get file forensics output",
"customNameId": 0,
"delayTime": 0,
"description": "Queries SAA Forensics data relative to the JobID of URL(s) or File(s) needs to be detonated.",
"join": [],
"note": "Queries SAA Forensics data relative to the JobID of URL(s) or File(s) needs to be detonated."
},
"connector": "Splunk Attack Analyzer Connector for Splunk SOAR",
"connectorConfigs": [
"splunk attack analyzer app"
],
"connectorId": "de681fee-c552-45bf-9212-827b1c7529f8",
"connectorVersion": "v1",
"functionId": 2,
"functionName": "get_file_forensics_output",
"id": "15",
"parameters": {
"job_id": "filtered-data:detonation_status_filter:condition_1:file_detonation:action_result.data.*.JobID",
"timeout": "2"
},
"requiredParameters": [
{
"data_type": "string",
"field": "job_id"
}
],
"type": "action"
},
"errors": {},
"id": "15",
"type": "action",
"userCode": "\n # Write your custom code here...\n #parameters = []\n #for job_ids in file_jobid_detonation_output__jobid:\n # for job in job_ids:\n # if job is not None:\n # parameters.append({\n # \"job_id\": job,\n # \"timeout\": 5,\n # })\n #phantom.debug(parameters)\n",
"warnings": {},
"x": 340,
"y": 880
},
"17": {
"data": {
"advanced": {
"customName": "normalized file forensic output",
"customNameId": 0,
"description": "This block uses custom code for normalizing score. Adjust the logic as desired in the documented sections.",
"join": [],
"note": "This block uses custom code for normalizing score. Adjust the logic as desired in the documented sections."
},
"functionId": 5,
"functionName": "normalized_file_forensic_output",
"id": "17",
"inputParameters": [
"filtered-data:detonation_status_filter:condition_1:file_detonation:action_result.parameter.file",
"filtered-data:detonation_status_filter:condition_1:file_detonation:action_result.data.*.JobID",
"filtered-data:file_forensics_filter:condition_1:get_file_forensics_output:action_result.parameter.job_id",
"filtered-data:file_forensics_filter:condition_1:get_file_forensics_output:action_result.data.*.DisplayScore",
"filtered-data:file_forensics_filter:condition_1:get_file_forensics_output:action_result.data.*.Detections"
],
"outputVariables": [
"file_score_object",
"scores",
"categories",
"score_id",
"file",
"job_id"
],
"type": "code"
},
"errors": {},
"id": "17",
"type": "code",
"userCode": "\n # Write your custom code here...\n score_id =0\n score_table = {\n \"0\":\"Unknown\",\n \"1\":\"Very_Safe\",\n \"2\":\"Safe\",\n \"3\":\"Probably_Safe\",\n \"4\":\"Leans_Safe\",\n \"5\":\"May_not_be_Safe\",\n \"6\":\"Exercise_Caution\",\n \"7\":\"Suspicious_or_Risky\",\n \"8\":\"Possibly_Malicious\",\n \"9\":\"Probably_Malicious\",\n \"10\":\"Malicious\"\n }\n \n normalized_file_forensic_output__file_score_object = []\n normalized_file_forensic_output__scores = []\n normalized_file_forensic_output__categories = []\n normalized_file_forensic_output__score_id = []\n normalized_file_forensic_output__file = []\n normalized_file_forensic_output__job_id = []\n \n ## pair forensic job results with url detonated\n job_file_dict = {}\n\n for orig_file, orig_job in zip(filtered_result_0_parameter_file, filtered_result_0_data___jobid):\n for filtered_job in filtered_result_0_data___jobid:\n if orig_job == filtered_job:\n job_file_dict[filtered_job] = orig_file\n \n for job, score_num, detections in zip(filtered_result_1_parameter_job_id, filtered_result_1_data___displayscore, filtered_result_1_data___detections):\n \n ## translate scores\n score_id = int(score_num/10) if score_num > 0 else 0\n score = score_table[str(score_id)]\n file = job_file_dict[job]\n categories = [item.get('Description') for item in detections]\n \n normalized_file_forensic_output__file_score_object.append({'value': file, 'base_score': score_num, 'score': score, 'score_id': score_id, 'categories': categories})\n normalized_file_forensic_output__scores.append(score)\n normalized_file_forensic_output__categories.append(\", \".join(categories))\n normalized_file_forensic_output__score_id.append(score_id)\n normalized_file_forensic_output__file.append(file)\n normalized_file_forensic_output__job_id.append(job)\n \n",
"warnings": {},
"x": 340,
"y": 1260
},
"18": {
"data": {
"advanced": {
"customName": "format file report ",
"customNameId": 0,
"description": "Format a summary table with the information gathered from the playbook.",
"join": [],
"note": "Format a summary table with the information gathered from the playbook."
},
"functionId": 2,
"functionName": "format_file_report",
"id": "18",
"parameters": [
"normalized_file_forensic_output:custom_function:file",
"normalized_file_forensic_output:custom_function:score",
"normalized_file_forensic_output:custom_function:score_id",
"normalized_file_forensic_output:custom_function:categories",
"normalized_file_forensic_output:custom_function:job_id"
],
"template": "SOAR analyzed File(s) using Splunk Attack Analyzer. The table below shows a summary of the information gathered.\n\n| Vauld Id | Normalized Score | Score Id | Categories | Report Link | Source |\n| --- | --- | --- | --- | --- | --- |\n%%\n| `{0}` | {1} | {2} | {3} | https://app.twinwave.io/job/{4} | Splunk Attack Analyzer (SAA) |\n%%\n\n\n",
"type": "format"
},
"errors": {},
"id": "18",
"type": "format",
"userCode": "\n # Write your custom code here...\n #phantom.debug(phantom.format(container=container, template=template, parameters=parameters, name=\"format_report_file\"))\n",
"warnings": {},
"x": 340,
"y": 1440
},
"19": {
"data": {
"advanced": {
"customName": "build file output",
"customNameId": 0,
"description": "This block uses custom code to generate an observable dictionary to output into the observables data path.",
"join": [],
"note": "This block uses custom code to generate an observable dictionary to output into the observables data path."
},
"functionId": 6,
"functionName": "build_file_output",
"id": "19",
"inputParameters": [
"normalized_file_forensic_output:custom_function:file",
"normalized_file_forensic_output:custom_function:job_id",
"normalized_file_forensic_output:custom_function:file_score_object"
],
"outputVariables": [
"observable_array"
],
"type": "code"
},
"errors": {},
"id": "19",
"type": "code",
"userCode": "\n # Write your custom code here...\n build_file_output__observable_array = []\n\n for _vault_id, external_id, file_object in zip(normalized_file_forensic_output__file, normalized_file_forensic_output__job_id, normalized_file_forensic_output__file_score_object):\n #phantom.debug(\"vault: {} id: {}\".format(_vault_id, external_id))\n observable_object = {\n\n \"value\": _vault_id,\n \"type\": \"hash\",\n \"reputation\": {\n \"base_score\": file_object['base_score'],\n \"score\": file_object['score'],\n \"score_id\": file_object['score_id'],\n \"confidence\": file_object['base_score'] #Attack Analyzer's score has confidence baked in.\n },\n \"classifications\": file_object['categories'],\n \"source\": \"Splunk Attack Analyzer\",\n \"source_link\":f\"https://app.twinwave.io/job/{external_id}\"\n }\n build_file_output__observable_array.append(observable_object)\n #phantom.debug(\"build_file_output__observable_array: {}\".format(build_file_output__observable_array))\n",
"warnings": {},
"x": 340,
"y": 1620
},
"2": {
"data": {
"advanced": {
"customName": "saa input filter",
"customNameId": 0,
"delimiter": ",",
"delimiter_enabled": true,
"description": "Determine branches based on provided inputs.",
"join": [],
"note": "Determine branches based on provided inputs."
},
"conditions": [
{
"comparisons": [
{
"conditionIndex": 0,
"op": "!=",
"param": "playbook_input:url",
"value": ""
}
],
"conditionIndex": 0,
"customName": "saa_url_input",
"logic": "and"
},
{
"comparisons": [
{
"conditionIndex": 1,
"op": "!=",
"param": "playbook_input:vault_id",
"value": ""
}
],
"conditionIndex": 1,
"customName": "saa_vault_id_input",
"logic": "and"
}
],
"functionId": 1,
"functionName": "saa_input_filter",
"id": "2",
"type": "filter"
},
"errors": {},
"id": "2",
"type": "filter",
"warnings": {},
"x": 230,
"y": 148
},
"22": {
"data": {
"advanced": {
"customName": "url status filter",
"customNameId": 0,
"delimiter": ",",
"delimiter_enabled": true,
"description": "Filters url detonation results.",
"join": [],
"note": "Filters url detonation results."
},
"conditions": [
{
"comparisons": [
{
"conditionIndex": 0,
"op": "==",
"param": "url_detonation:action_result.status",
"value": "success"
}
],
"conditionIndex": 0,
"customName": "saa_url_success_status",
"logic": "and"
}
],
"functionId": 5,
"functionName": "url_status_filter",
"id": "22",
"type": "filter"
},
"errors": {},
"id": "22",
"type": "filter",
"warnings": {},
"x": 60,
"y": 500
},
"23": {
"data": {
"advanced": {
"customName": "file forensics filter",
"customNameId": 0,
"delimiter": ",",
"delimiter_enabled": true,
"description": "Filters successful file detonation job forensic results.",
"join": [],
"note": "Filters successful file detonation job forensic results."
},
"conditions": [
{
"comparisons": [
{
"conditionIndex": 0,
"op": "==",
"param": "get_file_forensics_output:action_result.status",
"value": "success"
}
],
"conditionIndex": 0,
"customName": "get_job_file_forensic_sucess",
"logic": "and"
}
],
"functionId": 6,
"functionName": "file_forensics_filter",
"id": "23",
"type": "filter"
},
"errors": {},
"id": "23",
"type": "filter",
"warnings": {},
"x": 400,
"y": 1074
},
"3": {
"data": {
"action": "detonate url",
"actionType": "generic",
"advanced": {
"customName": "url detonation",
"customNameId": 0,
"delayTime": 0,
"description": "Queries SAA for information about the provided URL(s)",
"join": [],
"note": "Queries SAA for information about the provided URL(s)"
},
"connector": "Splunk Attack Analyzer Connector for Splunk SOAR",
"connectorConfigs": [
"splunk attack analyzer app"
],
"connectorId": "de681fee-c552-45bf-9212-827b1c7529f8",
"connectorVersion": "v1",
"functionId": 1,
"functionName": "url_detonation",
"id": "3",
"parameters": {
"url": "filtered-data:saa_input_filter:condition_1:playbook_input:url"
},
"requiredParameters": [
{
"data_type": "string",
"field": "url"
}
],
"type": "action"
},
"errors": {},
"id": "3",
"type": "action",
"userCode": "\n # Write your custom code here...\n\n",
"warnings": {},
"x": 0,
"y": 320
},
"4": {
"data": {
"advanced": {
"customName": "detonation status filter",
"customNameId": 0,
"delimiter": ",",
"delimiter_enabled": true,
"description": "Filters successful file detonation results.",
"join": [],
"note": "Filters successful file detonation results."
},
"conditions": [
{
"comparisons": [
{
"conditionIndex": 0,
"op": "==",
"param": "file_detonation:action_result.status",
"value": "success"
}
],
"conditionIndex": 0,
"customName": "saa_file_success_status",
"logic": "and"
}
],
"functionId": 2,
"functionName": "detonation_status_filter",
"id": "4",
"type": "filter"
},
"errors": {},
"id": "4",
"type": "filter",
"warnings": {},
"x": 400,
"y": 500
},
"6": {
"data": {
"action": "get job forensics",
"actionType": "investigate",
"advanced": {
"customName": "get url forensics output",
"customNameId": 0,
"delayTime": 0,
"description": "Queries SAA Forensics data relative to the JobID of URL(s) or File(s) needs to be detonated.",
"join": [],
"note": "Queries SAA Forensics data relative to the JobID of URL(s) or File(s) needs to be detonated.",
"reviewer": ""
},
"connector": "Splunk Attack Analyzer Connector for Splunk SOAR",
"connectorConfigs": [
"splunk attack analyzer app"
],
"connectorId": "de681fee-c552-45bf-9212-827b1c7529f8",
"connectorVersion": "v1",
"functionId": 1,
"functionName": "get_url_forensics_output",
"id": "6",
"parameters": {
"job_id": "filtered-data:url_status_filter:condition_1:url_detonation:action_result.data.*.JobID",
"timeout": "2"
},
"requiredParameters": [
{
"data_type": "string",
"field": "job_id"
}
],
"type": "action"
},
"errors": {},
"id": "6",
"type": "action",
"userCode": "\n # Write your custom code here...\n #parameters = []\n #for job_ids in url_jobid_detonation_output__jobid:\n # for job in job_ids:\n # if job is not None:\n # parameters.append({\n # \"job_id\": job,\n # \"timeout\": 5,\n # })\n #phantom.debug(parameters)\n",
"warnings": {},
"x": 0,
"y": 880
},
"7": {
"data": {
"advanced": {
"customName": "get jobid forensic filter",
"customNameId": 0,
"delimiter": ",",
"delimiter_enabled": true,
"description": "Filters successful url detonation job forensic results.",
"join": [],
"note": "Filters successful url detonation job forensic results."
},
"conditions": [
{
"comparisons": [
{
"conditionIndex": 0,
"op": "==",
"param": "get_url_forensics_output:action_result.status",
"value": "success"
}
],
"conditionIndex": 0,
"customName": "get_job_forensic_success",
"logic": "and"
}
],
"functionId": 3,
"functionName": "get_jobid_forensic_filter",
"id": "7",
"type": "filter"
},
"errors": {},
"id": "7",
"type": "filter",
"warnings": {},
"x": 60,
"y": 1074
},
"8": {
"data": {
"advanced": {
"customName": "normalized url forensic output",
"customNameId": 0,
"description": "This block uses custom code for normalizing score. Adjust the logic as desired in the documented sections.",
"join": [],
"note": "This block uses custom code for normalizing score. Adjust the logic as desired in the documented sections."
},
"functionId": 2,
"functionName": "normalized_url_forensic_output",
"id": "8",
"inputParameters": [
"filtered-data:url_status_filter:condition_1:url_detonation:action_result.parameter.url",
"filtered-data:url_status_filter:condition_1:url_detonation:action_result.data.*.JobID",
"filtered-data:get_jobid_forensic_filter:condition_1:get_url_forensics_output:action_result.parameter.job_id",
"filtered-data:get_jobid_forensic_filter:condition_1:get_url_forensics_output:action_result.data.*.DisplayScore",
"filtered-data:get_jobid_forensic_filter:condition_1:get_url_forensics_output:action_result.data.*.Detections"
],
"outputVariables": [
"url_score_object",
"scores",
"categories",
"score_id",
"url",
"job_id"
],
"type": "code"
},
"errors": {},
"id": "8",
"type": "code",
"userCode": "\n # Write your custom code here...\n score_id =0\n score_table = {\n \"0\":\"Unknown\",\n \"1\":\"Very_Safe\",\n \"2\":\"Safe\",\n \"3\":\"Probably_Safe\",\n \"4\":\"Leans_Safe\",\n \"5\":\"May_not_be_Safe\",\n \"6\":\"Exercise_Caution\",\n \"7\":\"Suspicious_or_Risky\",\n \"8\":\"Possibly_Malicious\",\n \"9\":\"Probably_Malicious\",\n \"10\":\"Malicious\"\n }\n \n normalized_url_forensic_output__url_score_object = []\n normalized_url_forensic_output__scores = []\n normalized_url_forensic_output__categories = []\n normalized_url_forensic_output__score_id = []\n normalized_url_forensic_output__url = []\n normalized_url_forensic_output__job_id = []\n\n ## pair forensic job results with url detonated\n job_url_dict = {}\n\n for orig_url, orig_job in zip(filtered_result_0_parameter_url, filtered_result_0_data___jobid):\n for filtered_job in filtered_result_0_data___jobid:\n if orig_job == filtered_job:\n job_url_dict[filtered_job] = orig_url\n \n for job, score_num, detections in zip(filtered_result_1_parameter_job_id, filtered_result_1_data___displayscore, filtered_result_1_data___detections):\n \n ## translate scores\n score_id = int(score_num/10) if score_num > 0 else 0\n score = score_table[str(score_id)]\n url = job_url_dict[job]\n categories = [item.get('Description') for item in detections]\n \n # Attach final object\n normalized_url_forensic_output__url_score_object.append({'value': url, 'base_score': score_num, 'score': score, 'score_id': score_id, 'categories': categories})\n normalized_url_forensic_output__scores.append(score)\n normalized_url_forensic_output__categories.append(\", \".join(categories))\n normalized_url_forensic_output__score_id.append(score_id)\n normalized_url_forensic_output__url.append(url)\n normalized_url_forensic_output__job_id.append(job)\n\n",
"warnings": {},
"x": 0,
"y": 1260
}
},
"notes": "Inputs: url, vault_id\nInteractions: Splunk Attack Analyzer\nActions: url detonation, , file detonation\nOutputs: report, observables"
},
"input_spec": [
{
"contains": [
"url"
],
"description": "A URL provided for reputation analysis - Splunk Attack Analyzer",
"name": "url"
},
{
"contains": [
"vault id"
],
"description": "A vault_id provided for reputation analysis - Splunk Attack Analyzer",
"name": "vault_id"
}
],
"output_spec": [
{
"contains": [],
"datapaths": [
"build_url_output:custom_function:observable_array",
"build_file_output:custom_function:observable_array"
],
"deduplicate": false,
"description": "An array of observable dictionaries with value, type, score, score_id, and categories.",
"metadata": {},
"name": "observable"
},
{
"contains": [],
"datapaths": [
"format_url_report:formatted_data",
"format_file_report:formatted_data"
],
"deduplicate": false,
"description": "a report contains value, score, confidence and categories",
"metadata": {},
"name": "report"
}
],
"playbook_type": "data",
"python_version": "3",
"schema": "5.0.10",
"version": "6.1.0.131"
},
"create_time": "2023-08-16T15:27:27.772206+00:00",
"draft_mode": false,
"labels": [
"*"
],
"tags": [
"url",
"ip",
"domain",
"sandbox",
"D3-DA",
"vault_id",
"splunk_attack_analyzer"
]
}
Reference in New Issue View Git Blame Copy Permalink