<commit_before>id: WildFire - Detonate file
version: -1
name: WildFire - Detonate file
description: Detonate one or more files using the Wildfire integration. This playbook
  returns relevant reports to the War Room and file reputations to the context data.
fromversion: 3.6.0
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 29dcbc1e-0bb0-45f1-82ed-eb65b6ce039d
    type: start
    task:
      id: 29dcbc1e-0bb0-45f1-82ed-eb65b6ce039d
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 50
        }
      }
  "5":
    id: "5"
    taskid: 8dec7425-dcfc-4b65-8810-02604bb775be
    type: condition
    task:
      id: 8dec7425-dcfc-4b65-8810-02604bb775be
      version: -1
      name: Is WildFire enabled?
      description: |
        Verify that there is a valid instance of Wildfire enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "13"
    reputationcalc: 0
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: string.isEqual
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: WildFire
                    ignorecase: true
                - - operator: string.isEqual
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 500,
          "y": 195
        }
      }
  "6":
    id: "6"
    taskid: e6a670a6-eff4-4b16-883b-f08e7d7e7bd3
    type: title
    task:
      id: e6a670a6-eff4-4b16-883b-f08e7d7e7bd3
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1421
        }
      }
  "8":
    id: "8"
    taskid: 014d826b-a0a1-425d-834b-c285d71ae68e
    type: regular
    task:
      id: 014d826b-a0a1-425d-834b-c285d71ae68e
      version: -1
      name: Get PDF report
      description: Download the pdf report to the War Room.
      script: WildFire|||wildfire-report
      type: regular
      iscommand: true
      brand: WildFire
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      format:
        simple: pdf
      hash: {}
      md5:
        complex:
          root: File
          accessor: MD5
      verbose: {}
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1252
        }
      }
  "9":
    id: "9"
    taskid: 190a26ed-0c09-4567-8bc2-a9bea3f53207
    type: condition
    task:
      id: 190a26ed-0c09-4567-8bc2-a9bea3f53207
      version: -1
      name: Is there an MD5 hash?
      description: Checks if there is an MD5 hash in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "8"
    reputationcalc: 0
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: File
                accessor: MD5
            iscontext: true
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1075
        }
      }
  "10":
    id: "10"
    taskid: 489aac5a-850e-4b34-86bd-1d2812088a98
    type: condition
    task:
      id: 489aac5a-850e-4b34-86bd-1d2812088a98
      version: -1
      name: Is  the file type supported?
      description: Check if file type is supported.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "12"
    reputationcalc: 0
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: File
                filters:
                - - operator: string.match
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:APK|JAR|DOC|DOCX|RTF|XLS|XLSX|PPT|PPTX|OOXML|PE32|PDF|DMG|PKG|RAR|7Z)\b
                    ignorecase: true
                  - operator: string.match
                    left:
                      value:
                        simple: File.Info
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:APK|JAR|DOC|DOCX|RTF|XLS|XLSX|PPT|PPTX|OOXML|PE32|PDF|DMG|PKG|RAR|7Z)\b
                    ignorecase: true
                accessor: EntryID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 500,
          "y": 721
        }
      }
  "11":
    id: "11"
    taskid: a707109d-e569-4fa6-853a-30cf5b5ffb50
    type: regular
    task:
      id: a707109d-e569-4fa6-853a-30cf5b5ffb50
      version: -1
      name: Set file to context
      description: Set the file object into context.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      append: {}
      key:
        simple: File
      value:
        complex:
          root: inputs.File
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 553
        }
      }
  "12":
    id: "12"
    taskid: 24e8b68e-759f-44e5-81d7-ced51d3c6618
    type: regular
    task:
      id: 24e8b68e-759f-44e5-81d7-ced51d3c6618
      version: -1
      name: DetonateFile (WildFire)
      description: Detonate the file in WildFire.
      script: WildFire|||detonate-file
      type: regular
      iscommand: true
      brand: WildFire
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      delay: {}
      entryID:
        simple: ${inputs.File(['exe', 'pe32', 'pe64', 'pdf'].filter(function(t) {return
          val.Info.toLowerCase().indexOf(t) >= 0 || val.Type.toLowerCase().indexOf(t)
          >= 0;}).length > 0).EntryID}
      format: {}
      hash: {}
      interval: {}
      md5: {}
      timeout: {}
      upload:
        complex:
          root: File
          filters:
          - - operator: string.match
              left:
                value:
                  simple: File.Type
                iscontext: true
              right:
                value:
                  simple: .*(?:APK|JAR|DOC|DOCX|RTF|XLS|XLSX|PPT|PPTX|OOXML|PE32|PDF|DMG|PKG|RAR|7Z)\b
              ignorecase: true
            - operator: string.match
              left:
                value:
                  simple: File.Info
                iscontext: true
              right:
                value:
                  simple: .*(?:APK|JAR|DOC|DOCX|RTF|XLS|XLSX|PPT|PPTX|OOXML|PE32|PDF|DMG|PKG|RAR|7Z)\b
          accessor: EntryID
      verbose: {}
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 897
        }
      }
  "13":
    id: "13"
    taskid: 1c7984d0-757a-481d-8d42-93b047c636da
    type: condition
    task:
      id: 1c7984d0-757a-481d-8d42-93b047c636da
      version: -1
      name: Is there a file to detonate?
      description: Checks that there is a file in the playbook's input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
      "yes":
      - "11"
    reputationcalc: 0
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: inputs.File
            iscontext: true
    view: |-
      {
        "position": {
          "x": 500,
          "y": 368
        }
      }
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1436,
        "width": 380,
        "x": 500,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: File object of the file to detonate.
outputs:
- contextPath: File.SHA256
  description: SHA256 hash of the file
  type: string
- contextPath: File.Malicious
  description: The File malicious description
  type: unknown
- contextPath: File.Type
  description: File type e.g. "PE"
  type: string
- contextPath: File.Size
  description: File size
  type: number
- contextPath: File.MD5
  description: MD5 hash of the file
  type: string
- contextPath: File.Name
  description: Filename
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file
  type: string
- contextPath: File
  description: The File object
  type: unknown
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision
  type: string
- contextPath: DBotScore
  description: The DBotScore object
  type: unknown
- contextPath: DBotScore.Indicator
  description: The indicator we tested
  type: string
- contextPath: DBotScore.Type
  description: The type of the indicator
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score
  type: string
- contextPath: DBotScore.Score
  description: The actual score
  type: number<commit_msg>Fix WildFire detonation playbook no file bug (#1902)<commit_after>id: WildFire - Detonate file
version: -1
name: WildFire - Detonate file
description: Detonate one or more files using the Wildfire integration. This playbook
  returns relevant reports to the War Room and file reputations to the context data.
  The detonation supports the following file types -
  APK, JAR, DOC, DOCX, RTF, XLS, XLSX, PPT, PPTX, XML, PE32, PDF, DMG, PKG, RAR, 7Z
fromversion: 3.6.0
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 29dcbc1e-0bb0-45f1-82ed-eb65b6ce039d
    type: start
    task:
      id: 29dcbc1e-0bb0-45f1-82ed-eb65b6ce039d
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 50
        }
      }
  "5":
    id: "5"
    taskid: 8dec7425-dcfc-4b65-8810-02604bb775be
    type: condition
    task:
      id: 8dec7425-dcfc-4b65-8810-02604bb775be
      version: -1
      name: Is WildFire enabled?
      description: |
        Verify that there is a valid instance of Wildfire enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "13"
    reputationcalc: 0
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: string.isEqual
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: WildFire
                    ignorecase: true
                - - operator: string.isEqual
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 500,
          "y": 195
        }
      }
  "6":
    id: "6"
    taskid: e6a670a6-eff4-4b16-883b-f08e7d7e7bd3
    type: title
    task:
      id: e6a670a6-eff4-4b16-883b-f08e7d7e7bd3
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1421
        }
      }
  "8":
    id: "8"
    taskid: 014d826b-a0a1-425d-834b-c285d71ae68e
    type: regular
    task:
      id: 014d826b-a0a1-425d-834b-c285d71ae68e
      version: -1
      name: Get PDF report
      description: Download the pdf report to the War Room.
      script: WildFire|||wildfire-report
      type: regular
      iscommand: true
      brand: WildFire
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      format:
        simple: pdf
      hash: {}
      md5:
        complex:
          root: File
          accessor: MD5
      verbose: {}
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1252
        }
      }
  "9":
    id: "9"
    taskid: 190a26ed-0c09-4567-8bc2-a9bea3f53207
    type: condition
    task:
      id: 190a26ed-0c09-4567-8bc2-a9bea3f53207
      version: -1
      name: Is there an MD5 hash?
      description: Checks if there is an MD5 hash in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "8"
    reputationcalc: 0
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: File
                accessor: MD5
            iscontext: true
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1075
        }
      }
  "10":
    id: "10"
    taskid: 489aac5a-850e-4b34-86bd-1d2812088a98
    type: condition
    task:
      id: 489aac5a-850e-4b34-86bd-1d2812088a98
      version: -1
      name: Is  the file type supported?
      description: Check if file type is supported.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "12"
    reputationcalc: 0
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: File
                filters:
                - - operator: string.match
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:APK|JAR|DOC|DOCX|RTF|XLS|XLSX|PPT|PPTX|XML|PE32|PDF|DMG|PKG|RAR|7Z)\b
                    ignorecase: true
                  - operator: string.match
                    left:
                      value:
                        simple: File.Info
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:APK|JAR|DOC|DOCX|RTF|XLS|XLSX|PPT|PPTX|XML|PE32|PDF|DMG|PKG|RAR|7Z)\b
                    ignorecase: true
                accessor: EntryID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 500,
          "y": 721
        }
      }
  "11":
    id: "11"
    taskid: a707109d-e569-4fa6-853a-30cf5b5ffb50
    type: regular
    task:
      id: a707109d-e569-4fa6-853a-30cf5b5ffb50
      version: -1
      name: Set file to context
      description: Set the file object into context.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      append: {}
      key:
        simple: File
      value:
        complex:
          root: inputs.File
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 553
        }
      }
  "12":
    id: "12"
    taskid: 24e8b68e-759f-44e5-81d7-ced51d3c6618
    type: regular
    task:
      id: 24e8b68e-759f-44e5-81d7-ced51d3c6618
      version: -1
      name: DetonateFile (WildFire)
      description: Detonate the file in WildFire.
      script: WildFire|||detonate-file
      type: regular
      iscommand: true
      brand: WildFire
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      delay: {}
      entryID:
        simple: ${inputs.File(['exe', 'pe32', 'pe64', 'pdf'].filter(function(t) {return
          val.Info.toLowerCase().indexOf(t) >= 0 || val.Type.toLowerCase().indexOf(t)
          >= 0;}).length > 0).EntryID}
      format: {}
      hash: {}
      interval: {}
      md5: {}
      timeout: {}
      upload:
        complex:
          root: File
          filters:
          - - operator: string.match
              left:
                value:
                  simple: File.Type
                iscontext: true
              right:
                value:
                  simple: .*(?:APK|JAR|DOC|DOCX|RTF|XLS|XLSX|PPT|PPTX|OOXML|PE32|PDF|DMG|PKG|RAR|7Z)\b
              ignorecase: true
            - operator: string.match
              left:
                value:
                  simple: File.Info
                iscontext: true
              right:
                value:
                  simple: .*(?:APK|JAR|DOC|DOCX|RTF|XLS|XLSX|PPT|PPTX|OOXML|PE32|PDF|DMG|PKG|RAR|7Z)\b
          accessor: EntryID
      verbose: {}
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 897
        }
      }
  "13":
    id: "13"
    taskid: 1c7984d0-757a-481d-8d42-93b047c636da
    type: condition
    task:
      id: 1c7984d0-757a-481d-8d42-93b047c636da
      version: -1
      name: Is there a file to detonate?
      description: Checks that there is a file in the playbook's input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "11"
    reputationcalc: 0
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: inputs.File
            iscontext: true
    view: |-
      {
        "position": {
          "x": 500,
          "y": 368
        }
      }
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1436,
        "width": 380,
        "x": 500,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: File object of the file to detonate.
outputs:
- contextPath: File.SHA256
  description: SHA256 hash of the file
  type: string
- contextPath: File.Malicious
  description: The File malicious description
  type: unknown
- contextPath: File.Type
  description: File type e.g. "PE"
  type: string
- contextPath: File.Size
  description: File size
  type: number
- contextPath: File.MD5
  description: MD5 hash of the file
  type: string
- contextPath: File.Name
  description: Filename
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file
  type: string
- contextPath: File
  description: The File object
  type: unknown
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision
  type: string
- contextPath: DBotScore
  description: The DBotScore object
  type: unknown
- contextPath: DBotScore.Indicator
  description: The indicator we tested
  type: string
- contextPath: DBotScore.Type
  description: The type of the indicator
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score
  type: string
- contextPath: DBotScore.Score
  description: The actual score
  type: number
releaseNotes: "-"
{'fraction_non_alphanumeric': 0.09937070100980536, 'fraction_numerical': 0.05224645104639251, 'mean_word_length': 1.432945644433895, 'pattern_counts': {'":': 94, '<': 3, '<?xml version=': 0, '>': 9, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3010670', 'n_tokens_mistral': 7137, 'n_tokens_neox': 6479, 'n_words': 1574}