Skip to content

Commit 04520c4

Browse files
content-botFelix Seelebachen
authored
Added File Enrichment - VMRay playbook (demisto#14890)
* Added File Enrichment - VMRay playbook (demisto#14436) * Added File Enrichment - VMRay playbook * added image link * fixed readme * fixed validation issues and updated release notes * added ELSE path for condition * added integrationReliability parameter * updated docker image * added descriptions * added Reliability output * updated version to 1.1.2 * added continueonerror property in File Enrichment playbook * removed DeleteContext task from Test Playbook * update conf.json Co-authored-by: Felix Seele <[email protected]> Co-authored-by: bachen <[email protected]>
1 parent da9d6a7 commit 04520c4

11 files changed

Lines changed: 1132 additions & 1 deletion

File tree

‎Packs/VMRay/Integrations/VMRay/README.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -570,6 +570,16 @@ Retrieves sample information by hash.
570570

571571
| **Path** | **Type** | **Description** |
572572
| --- | --- | --- |
573+
| File.Name | String | The full file name \(including file extension\). |
574+
| File.MD5 | String | The MD5 hash of the file. |
575+
| File.SHA1 | String | The SHA1 hash of the file. |
576+
| File.SHA256 | String | The SHA256 hash of the file. |
577+
| File.SSDeep | String | The SSDeep hash of the file. |
578+
| DBotScore.Indicator | String | The indicator that was tested. |
579+
| DBotScore.Type | String | The indicator type. |
580+
| DBotScore.Vendor | String | The vendor used to calculate the score. |
581+
| DBotScore.Score | Number | The actual score. |
582+
| DBotScore.Reliability | String | Reliability of the source providing the intelligence data. |
573583
| VMRay.Sample.SampleID | Number | ID of the sample. |
574584
| VMRay.Sample.SampleURL | String | URL to sample page. |
575585
| VMRay.Sample.FileName | String | File name of the sample. |
@@ -781,6 +791,7 @@ Retrieves Indicators of Compromise for a specified sample.
781791
| DBotScore.Type | String | The indicator type. |
782792
| DBotScore.Vendor | String | The vendor used to calculate the score. |
783793
| DBotScore.Score | Number | The actual score. |
794+
| DBotScore.Reliability | String | Reliability of the source providing the intelligence data. |
784795
| Domain.Name | String | The domain name |
785796
| IP.Address | String | IP address |
786797
| URL.Data | String | The URL |

‎Packs/VMRay/Integrations/VMRay/VMRay.py‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
USE_SSL = not demisto.params().get('insecure', False)
1515
HEADERS = {'Authorization': 'api_key ' + API_KEY}
1616
ERROR_FORMAT = 'Error in API call to VMRay [{}] - {}'
17+
RELIABILITY = demisto.params().get('integrationReliability', DBotScoreReliability.C) or DBotScoreReliability.C
1718

1819
# disable insecure warnings
1920
requests.packages.urllib3.disable_warnings()
@@ -198,6 +199,7 @@ def dbot_score_by_hash(data):
198199
'Type': 'hash',
199200
'Vendor': 'VMRay',
200201
'Score': DBOTSCORE.get(data.get('Verdict', 0)),
202+
'Reliability': RELIABILITY
201203
}
202204
)
203205
return scores
@@ -671,18 +673,33 @@ def get_sample_by_hash_command():
671673
samples = raw_response.get('data')
672674

673675
if samples:
676+
# VMRay outputs
674677
entry_context = dict()
675678
context_key = 'VMRay.Sample(val.{} === obj.{})'.format(hash.upper(), hash.upper())
676679
entry_context[context_key] = [
677680
create_sample_entry(sample)
678681
for sample in samples
679682
]
680683

684+
# DBotScore output
681685
scores = list() # type: list
682686
for sample in entry_context[context_key]:
683687
scores += dbot_score_by_hash(sample)
684688
entry_context[outputPaths['dbotscore']] = scores
685689

690+
# Indicator output
691+
# just use the first sample that is returned by the API for now
692+
entry = entry_context[context_key][0]
693+
file = Common.File(
694+
None,
695+
md5=entry['MD5'],
696+
sha1=entry['SHA1'],
697+
sha256=entry['SHA256'],
698+
ssdeep=entry['SSDeep'],
699+
name=entry['FileName']
700+
)
701+
entry_context.update(file.to_context())
702+
686703
human_readable = tableToMarkdown(
687704
'Results for {} hash {}:'.format(hash_type, hash),
688705
entry_context[context_key],

‎Packs/VMRay/Integrations/VMRay/VMRay.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,20 @@ commonfields:
33
id: vmray
44
version: -1
55
configuration:
6+
- additionalinfo: Reliability of the source providing the intelligence data.
7+
defaultvalue: C - Fairly reliable
8+
display: Source Reliability
9+
name: integrationReliability
10+
options:
11+
- A+ - 3rd party enrichment
12+
- A - Completely reliable
13+
- B - Usually reliable
14+
- C - Fairly reliable
15+
- D - Not usually reliable
16+
- E - Unreliable
17+
- F - Reliability cannot be judged
18+
required: true
19+
type: 15
620
- defaultvalue: https://cloud.vmray.com
721
display: Server URL (e.g., https://cloud.vmray.com)
822
name: server
@@ -399,6 +413,36 @@ script:
399413
execution: false
400414
name: vmray-get-sample-by-hash
401415
outputs:
416+
- contextPath: File.Name
417+
description: The full file name (including file extension).
418+
type: String
419+
- contextPath: File.MD5
420+
description: The MD5 hash of the file.
421+
type: String
422+
- contextPath: File.SHA1
423+
description: The SHA1 hash of the file.
424+
type: String
425+
- contextPath: File.SHA256
426+
description: The SHA256 hash of the file.
427+
type: String
428+
- contextPath: File.SSDeep
429+
description: The SSDeep hash of the file.
430+
type: String
431+
- contextPath: DBotScore.Indicator
432+
description: The indicator that was tested.
433+
type: String
434+
- contextPath: DBotScore.Type
435+
description: The indicator type.
436+
type: String
437+
- contextPath: DBotScore.Vendor
438+
description: The vendor used to calculate the score.
439+
type: String
440+
- contextPath: DBotScore.Score
441+
description: The actual score.
442+
type: Number
443+
- contextPath: DBotScore.Reliability
444+
description: Reliability of the source providing the intelligence data.
445+
type: String
402446
- contextPath: VMRay.Sample.SampleID
403447
description: ID of the sample.
404448
type: Number
@@ -554,6 +598,9 @@ script:
554598
- contextPath: DBotScore.Score
555599
description: The actual score.
556600
type: Number
601+
- contextPath: DBotScore.Reliability
602+
description: Reliability of the source providing the intelligence data.
603+
type: String
557604
- contextPath: Domain.Name
558605
description: The domain name
559606
type: String

0 commit comments

Comments
 (0)