Detonate and Analyze File - Generic
This Playbook is part of the Common Playbooks Pack.#
Supported versions
Supported Cortex XSOAR versions: 6.5.0 and later.
This playbook uploads, detonates, and analyzes files for supported sandboxes. Currently supported sandboxes are Falcon Intelligence Sandbox, JoeSecurity, and Wildfire.
Dependencies#
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks#
- CrowdStrike Falcon Intelligence Sandbox Detonate and Analyze File
- Wildfire Detonate and Analyze File
- Mitre Attack - Extract Technique Information From ID
- Detonate File - JoeSecurity V2
Integrations#
This playbook does not use any integrations.
Scripts#
- IsIntegrationAvailable
Commands#
- rasterize-pdf
- joe-download-report
- attack-pattern
- extractIndicators
Playbook Inputs#
| Name | Description | Default Value | Required |
|---|---|---|---|
| File | The details of the file to search for. | File | Optional |
Playbook Outputs#
| Path | Description | Type |
|---|---|---|
| csfalconx.resource.tags | The analysis tags. | string |
| csfalconx.resource.sha256 | The SHA256 hash of the scanned file. | string |
| csfalconx.resource.file_name | The name of the uploaded file. | string |
| csfalconx.resource.sandbox | The Falcon Intelligence Sandbox findings. | string |
| csfalconx.resource.intel | The Falcon Intelligence Sandbox intelligence results. | string |
| WildFire.Report | The Wildfire findings. | string |
| AttackPattern | The MITRE Attack pattern information. | string |
| MITREATTACK | Full MITRE data for the attack pattern. | string |
| DBotScore | DBotScore object. | string |
| Joe.Analysis | Joe Analysis object. | string |
| DBotScore.Vendor | The vendor used to calculate the score. | string |
| DBotScore.Indicator | The indicator that was tested. | string |
| DBotScore.Type | The indicator type. | string |
| DBotScore.Score | The actual score. | string |
| DBotScore.Malicious | DBotScore Malicious object | string |
| DBotScore.Malicious.Vendor | The vendor used to calculate the score. | string |
| DBotScore.Malicious.Detections | The sub analysis detection statuses | string |
| DBotScore.Malicious.SHA1 | The SHA1 of the file | string |
| Joe.Analysis.ID | Web ID | string |
| Joe.Analysis.Status | Analysis Status | string |
| Joe.Analysis.Comments | Analysis Comments | string |
| Joe.Analysis.Time | Submitted Time | date |
| Joe.Analysis.Runs | Sub-Analysis Information | string |
| Joe.Analysis.Result | Analysis Results | string |
| Joe.Analysis.Errors | Raised errors during sampling | string |
| Joe.Analysis.Systems | Analysis OS | string |
| Joe.Analysis.MD5 | MD5 of analysis sample | string |
| Joe.Analysis.SHA1 | SHA1 of analysis sample | string |
| Joe.Analysis.SHA256 | SHA256 of analysis sample | string |
| Joe.Analysis.SampleName | Sample Data, could be a file name or URL | string |
| InfoFile | Report file object | string |
| InfoFile.Name | The filename. | string |
| InfoFile.EntryID | The entry ID of the report. | string |
| InfoFile.Size | File size. | number |
| InfoFile.Type | File type, e.g., "PE". | string |
| InfoFile.Info | Basic information of the file. | string |
| InfoFile.Extension | The extension of the image file. | string |
| File | File object | string |
| File.Extension | File extension. | string |
| File.MD5 | The MD5 hash of the file. | string |
| File.Name | The full file name. | string |
| File.SHA1 | The SHA1 hash of the file. | string |
| File.SHA256 | The SHA256 hash of the file. | string |
| ExtractedIndicators | outputs.extractindicators | string |
| AttackPattern.STIXID | The STIX ID of the Attack Pattern. | string |
| AttackPattern.KillChainPhases | The kill chain phases of the Attack Pattern. | string |
| AttackPattern.FirstSeenBySource | The first seen by source of the Attack Pattern. | string |
| AttackPattern.Description | The description of the Attack Pattern. | string |
| AttackPattern.OperatingSystemRefs | The operating system references of the Attack Pattern. | string |
| AttackPattern.Publications | The publications of the Attack Pattern. | string |
| AttackPattern.MITREID | The MITRE ID of the Attack Pattern. | string |
| AttackPattern.Tags | The tags of the Attack Pattern. | string |
Playbook Image#
