WildFire - Detonate file
WildFire by Palo Alto Networks Pack.#
This Playbook is part of theDetonates one or more files using the Wildfire integration. This playbook returns relevant reports to the War Room and file reputations to the context data.
The detonation supports the following file types: APK, JAR, DOC, DOCX, RTF, XLS, XLSX, PPT, PPTX, OOXML, PE32, PDF, DMG, PKG, RAR, 7Z, JS, ELF, HTA, LNK, VBS, PS1, PERL, PYTHON, SHELL.
#
DependenciesThis playbook uses the following sub-playbooks, integrations, and scripts.
#
Sub-playbooks- GenericPolling
#
IntegrationsThis playbook does not use any integrations.
#
Scripts- Set
#
Commands- wildfire-upload
- wildfire-report
#
Playbook InputsName | Description | Default Value | Source | Required |
---|---|---|---|---|
File | The file object of the file to detonate. The file is taken from the context. | None | File | Optional |
Interval | The duration for executing the polling (in minutes). | 1 | - | Optional |
Timeout | The duration after which to stop polling and to resume the playbook (in minutes). | 15 | - | Optional |
ReportFileType | The resource type to download. The default is "pdf". XML is also possible. | - | - | Optional |
#
Playbook OutputsPath | Description | Type |
---|---|---|
DBotScore.Score | The actual score. | string |
DBotScore.Type | The type of the indicator. | string |
File.Type | File type. For example, "PE". | string |
File.Size | The file size. | number |
File.MD5 | The MD5 hash of the file. | string |
File.Name | The filename. | string |
File.SHA1 | The SHA1 hash of the file. | string |
File | The file object. | unknown |
File.SHA256 | The SHA256 hash of the file. | string |
File.Malicious | The malicious object. | unknown |
File.Malicious.Vendor | The vendor that made the decision that the file is malicious. | string |
DBotScore | The DBot object. | unknown |
DBotScore.Indicator | The indicator that was tested. | string |
DBotScore.Vendor | The vendor used to calculate the score. | string |
WildFire.Report | The submission object. | unknown |
WildFire.Report.Status | The status of the submission. | string |
WildFire.Report.SHA256 | The SHA256 hash of the submission. | string |
InfoFile | The report file object. | unknown |
InfoFile.EntryID | The EntryID of the report file. | string |
InfoFile.Extension | The extension of the report file. | string |
InfoFile.Name | The name of the report file. | string |
InfoFile.Info | The info of the report file. | string |
InfoFile.Size | The size of the report file. | number |
InfoFile.Type | The type of the report file. | string |
WildFire.Report.MD5 | The MD5 hash of the submission. | string |
WildFire.Report.FileType | The type of the submission. | string |
WildFire.Report.Size | The size of the submission. | number |