At this moment, in the current the note written does not mention the artifact you ask :
Orchestration Engine
added a note to the Incident 06/11/2019 17:12
attachment: results detected_urls positives: False
And the current description information is deleting previous value of artifact description
Description
detected_referrer_samples positives: False
detected_urls positives: True
I have changed the post_process_scripting of both workflows to add artifact source comments to the note and append the comment to the artifact description.
New
Example: VirusTotal Scan post_process_script:
if results.scan.get('positives') is not None:
msg = "positives: {} out of {} {}".format(results.scan.get('positives'), results.scan.get('total'), results.scan.get('permalink'))
elif results.scan.get('detected_urls') is not None:
analysis = []
for section in ['detected_referrer_samples', 'detected_communicating_samples', 'detected_urls']:
test_for_positive = results.scan.get(section)
if test_for_positive is not None:
is_positive = False
for sample in test_for_positive:
if sample.get('positives', -1) > 0:
is_positive = True
analysis.append('{} positives: {}'.format(section, str(is_positive)))
msg = '\n'.join(analysis)
else:
msg = "{}. {}".format(results.scan['verbose_msg'], results.scan.get('permalink', ''))
if artifact.description == None:
lib = ""
else:
item = artifact.description
lib = item["content"]
artifact.description = str(lib) + "\r\n" + str(msg)
incident.addNote(helper.createRichText("VirusTotal Request on {}<div>attachment: {} {}</div>".format(artifact.value,"results", msg)))
if results.scan.get('md5') is not None:
incident.addArtifact('Malware MD5 Hash', results.scan.get('md5'), None)
if results.scan.get('sha1') is not None:
incident.addArtifact('Malware SHA-1 Hash', results.scan.get('sha1'), None)
if results.scan.get('sha256') is not None:
incident.addArtifact('Malware SHA-256 Hash', results.scan.get('sha256'), None)
New
Example: VirusTotal Scan (Attachment) post_process_script:
if results.scan.get('positives') is not None:
msg = "<p>positives: {} out of {}</p> <a target='blank' href='{}'>VirusTotal Link</a>".format(results.scan.get('positives'), results.scan.get('total'), results.scan.get('permalink'))
elif results.scan.get('detected_urls') is not None:
analysis = []
for section in ['detected_referrer_samples', 'detected_communicating_samples', 'detected_urls']:
test_for_positive = results.scan.get(section)
if test_for_positive is not None:
is_positive = False
for sample in test_for_positive:
if sample.get('positives', -1) > 0:
is_positive = True
analysis.append('{} positives: {}'.format(section, str(is_positive)))
msg = '\n'.join(analysis)
else:
msg = "<p>{}.</p> <a target='blank' href='{}'>VirusTotal Link</a>".format(results.scan['verbose_msg'], results.scan.get('permalink', ''))
# add to the note the source of the note
# incident.addNote(helper.createRichText("<div>attachment: {} {}</div>".format("results", msg)))
incident.addNote(helper.createRichText("VirusTotal Request on {}<div>attachment: {} {}</div>".format(str(attachment.name),"results", msg)))
if results.scan.get('md5') is not None:
incident.addArtifact('Malware MD5 Hash', results.scan.get('md5'), None)
if results.scan.get('sha1') is not None:
incident.addArtifact('Malware SHA-1 Hash', results.scan.get('sha1'), None)
if results.scan.get('sha256') is not None:
incident.addArtifact('Malware SHA-256 Hash', results.scan.get('sha256'), None)
# domain results
# file scan
# {'scan': {u'permalink': u'https://www.virustotal.com/file/97be2d515e01ba66091148456b392f7539b43ab1ba412c493107e93aeda1536a/analysis/1533171813/', u'sha1': u'9a419d1a7d4a515d03db7f08fdd27e11ae896b11', u'resource': u'97be2d515e01ba66091148456b392f7539b43ab1ba412c493107e93aeda1536a', u'response_code': 1, u'scan_id': u'97be2d515e01ba66091148456b392f7539b43ab1ba412c493107e93aeda1536a-1533171813', u'verbose_msg': u'Scan request successfully queued, come back later for the report', u'sha256': u'97be2d515e01ba66091148456b392f7539b43ab1ba412c493107e93aeda1536a', u'md5': u'd6e447ddcc6f74cac89322ff25e7835e'}}
# {'scan': {u'scan_id': u'97be2d515e01ba66091148456b392f7539b43ab1ba412c493107e93aeda1536a-1533171813', u'sha1': u'9a419d1a7d4a515d03db7f08fdd27e11ae896b11', u'resource': u'97be2d515e01ba66091148456b392f7539b43ab1ba412c493107e93aeda1536a', u'response_code': 1, u'scan_date': u'2018-08-02 01:03:33', u'permalink': u'https://www.virustotal.com/file/97be2d515e01ba66091148456b392f7539b43ab1ba412c493107e93aeda1536a/analysis/1533171813/', u'verbose_msg': u'Scan finished, information embedded', u'sha256': u'97be2d515e01ba66091148456b392f7539b43ab1ba412c493107e93aeda1536a', u'positives': 48, u'total': 68, u'md5': u'd6e447ddcc6f74cac89322ff25e7835e', u'scans': {u'Bkav': {u'detected': True, u'version': u'1.3.0.9466', u'result': u'HW32.Packed.C390', u'update': u'20180801'}, u'MicroWorld-eScan': {u'detected': True, u'version': u'14.0.297.0', u'result': u'Adware.GenericKD.30431884', u'update': u'20180802'}, u'CMC': {u'detected': False, u'version': u'1.1.0.977', u'result': None, u'update': u'20180801'}, u'CAT-QuickHeal': {u'detected': False, u'version': u'14.00', u'result': None, u'update': u'20180801'}, u'McAfee': {u'detected': True, u'version': u'6.0.6.653', u'result': u'RDN/Generic PUP.x', u'update': u'20180802'}, u'Cylance': {u'detected': True, u'version': u'2.3.1.101', u'result': u'Unsafe', u'update': u'20180802'}, u'Zillya': {u'detected': False, u'version': u'2.0.0.3607', u'result': None, u'update': u'20180801'}, u'TheHacker': {u'detected': False, u'version': u'6.8.0.5.3467', u'result': None, u'update': u'20180730'}, u'K7GW': {u'detected': True, u'version': u'10.56.27942', u'result': u'Trojan ( 0051506d1 )', u'update': u'20180802'}, u'K7AntiVirus': {u'detected': True, u'version': u'10.56.27942', u'result': u'Trojan ( 0051506d1 )', u'update': u'20180801'}, u'TrendMicro': {u'detected': True, u'version': u'10.0.0.1040', u'result': u'TROJ_GEN.R002C0OCL18', u'update': u'20180802'}, u'Baidu': {u'detected': False, u'version': u'1.0.0.2', u'result': None, u'update': u'20180801'}, u'Babable': {u'detected': False, u'version': u'9107201', u'result': None, u'update': u'20180725'}, u'F-Prot': {u'detected': False, u'version': u'4.7.1.166', u'result': None, u'update': u'20180802'}, u'Symantec': {u'detected': True, u'version': u'1.6.0.0', u'result': u'PUA.Gen.2', u'update': u'20180801'}, u'TotalDefense': {u'detected': False, u'version': u'37.1.62.1', u'result': None, u'update': u'20180801'}, u'TrendMicro-HouseCall': {u'detected': True, u'version': u'9.950.0.1006', u'result': u'TROJ_GEN.R002C0OCL18', u'update': u'20180801'}, u'Avast': {u'detected': True, u'version': u'18.4.3895.0', u'result': u'Win32:Malware-gen', u'update': u'20180801'}, u'ClamAV': {u'detected': False, u'version': u'0.100.1.0', u'result': None, u'update': u'20180801'}, u'GData': {u'detected': True, u'version': u'A:25.17963B:25.12867', u'result': u'Adware.GenericKD.30431884', u'update': u'20180802'}, u'Kaspersky': {u'detected': True, u'version': u'15.0.1.13', u'result': u'not-a-virus:HEUR:RiskTool.Win32.Generic', u'update': u'20180802'}, u'BitDefender': {u'detected': True, u'version': u'7.2', u'result': u'Adware.GenericKD.30431884', u'update': u'20180802'}, u'NANO-Antivirus': {u'detected': True, u'version': u'1.0.116.23366', u'result': u'Riskware.Win32.Mlw.eyrsjw', u'update': u'20180802'}, u'ViRobot': {u'detected': True, u'version': u'2014.3.20.0', u'result': u'Trojan.Win32.S.Agent.710144.I', u'update': u'20180801'}, u'AegisLab': {u'detected': False, u'version': u'4.2', u'result': None, u'update': u'20180801'}, u'Rising': {u'detected': True, u'version': u'25.0.0.24', u'result': u'Trojan.Azden!8.F0E3 (CLOUD)', u'update': u'20180802'}, u'Ad-Aware': {u'detected': True, u'version': u'3.0.5.370', u'result': u'Adware.GenericKD.30431884', u'update': u'20180802'}, u'Sophos': {u'detected': True, u'version': u'4.98.0', u'result': u'Generic PUA JK (PUA)', u'update': u'20180802'}, u'Comodo': {u'detected': True, u'version': u'29451', u'result': u'ApplicUnwnt', u'update': u'20180801'}, u'F-Secure': {u'detected': True, u'version': u'11.0.19100.45', u'result': u'Adware.GenericKD.30431884', u'update': u'20180801'}, u'DrWeb': {u'detected': True, u'version': u'7.0.33.6080', u'result': u'Trojan.KeyLogger.40115', u'update': u'20180802'}, u'VIPRE': {u'detected': True, u'version': u'68554', u'result': u'Trojan.Win32.Generic!BT', u'update': u'20180802'}, u'Invincea': {u'detected': True, u'version': u'6.3.5.26121', u'result': u'heuristic', u'update': u'20180717'}, u'McAfee-GW-Edition': {u'detected': True, u'version': u'v2017.3010', u'result': u'BehavesLike.Win32.Ramnit.jc', u'update': u'20180802'}, u'Emsisoft': {u'detected': True, u'version': u'2018.4.0.1029', u'result': u'Adware.GenericKD.30431884 (B)', u'update': u'20180802'}, u'Ikarus': {u'detected': False, u'version': u'0.1.5.2', u'result': None, u'update': u'20180801'}, u'Cyren': {u'detected': True, u'version': u'6.0.0.4', u'result': u'W32/Trojan.FSWK-1704', u'update': u'20180801'}, u'Jiangmin': {u'detected': True, u'version': u'16.0.100', u'result': u'RiskTool.Agent.wc', u'update': u'20180801'}, u'Webroot': {u'detected': True, u'version': u'1.0.0.403', u'result': u'W32.Malware.Gen', u'update': u'20180802'}, u'Avira': {u'detected': True, u'version': u'8.3.3.6', u'result': u'HEUR/AGEN.1000279', u'update': u'20180801'}, u'MAX': {u'detected': False, u'version': u'2017.11.15.1', u'result': None, u'update': u'20180802'}, u'Antiy-AVL': {u'detected': True, u'version': u'3.0.0.1', u'result': u'RiskWare[RiskTool]/Win32.Agent', u'update': u'20180802'}, u'Kingsoft': {u'detected': False, u'version': u'2013.8.14.323', u'result': None, u'update': u'20180802'}, u'Endgame': {u'detected': True, u'version': u'3.0.1', u'result': u'malicious (high confidence)', u'update': u'20180730'}, u'Arcabit': {u'detected': False, u'version': u'1.0.0.831', u'result': None, u'update': u'20180801'}, u'SUPERAntiSpyware': {u'detected': False, u'version': u'5.6.0.1032', u'result': None, u'update': u'20180801'}, u'ZoneAlarm': {u'detected': True, u'version': u'1.0', u'result': u'not-a-virus:HEUR:RiskTool.Win32.Generic', u'update': u'20180802'}, u'Avast-Mobile': {u'detected': False, u'version': u'180801-02', u'result': None, u'update': u'20180801'}, u'Microsoft': {u'detected': True, u'version': u'1.1.15100.1', u'result': u'PUA:Win32/Presenoker', u'update': u'20180801'}, u'AhnLab-V3': {u'detected': True, u'version': u'3.13.1.21616', u'result': u'Malware/Gen.Generic.C2426212', u'update': u'20180801'}, u'ALYac': {u'detected': True, u'version': u'1.1.1.5', u'result': u'Adware.GenericKD.30431884', u'update': u'20180801'}, u'AVware': {u'detected': True, u'version': u'1.6.0.52', u'result': u'Trojan.Win32.Generic!BT', u'update': u'20180727'}, u'TACHYON': {u'detected': True, u'version': u'2018-08-01.02', u'result': u'Trojan/W32.CoinMiner.710144', u'update': u'20180801'}, u'VBA32': {u'detected': True, u'version': u'3.12.32.0', u'result': u'Trojan.Keyloggerger', u'update': u'20180801'}, u'Malwarebytes': {u'detected': True, u'version': u'2.1.1.1115', u'result': u'Trojan.MalPack', u'update': u'20180801'}, u'Panda': {u'detected': True, u'version': u'4.6.4.2', u'result': u'Trj/GdSda.A', u'update': u'20180801'}, u'Zoner': {u'detected': False, u'version': u'1.0', u'result': None, u'update': u'20180801'}, u'ESET-NOD32': {u'detected': True, u'version': u'17814', u'result': u'a variant of Win32/Packed.Autoit.X suspicious', u'update': u'20180802'}, u'Tencent': {u'detected': False, u'version': u'1.0.0.1', u'result': None, u'update': u'20180802'}, u'Yandex': {u'detected': True, u'version': u'5.5.1.3', u'result': u'Riskware.Agent!', u'update': u'20180731'}, u'SentinelOne': {u'detected': True, u'version': u'1.0.17.227', u'result': u'static engine - malicious', u'update': u'20180701'}, u'eGambit': {u'detected': False, u'version': None, u'result': None, u'update': u'20180802'}, u'Fortinet': {u'detected': False, u'version': u'5.4.247.0', u'result': None, u'update': u'20180801'}, u'AVG': {u'detected': True, u'version': u'18.4.3895.0', u'result': u'Win32:Malware-gen', u'update': u'20180801'}, u'Cybereason': {u'detected': True, u'version': u'1.2.27', u'result': u'malicious.a7d4a5', u'update': u'20180225'}, u'Paloalto': {u'detected': True, u'version': u'1.0', u'result': u'generic.ml', u'update': u'20180802'}, u'CrowdStrike': {u'detected': True, u'version': u'1.0', u'result': u'malicious_confidence_100% (D)', u'update': u'20180723'}, u'Qihoo-360': {u'detected': True, u'version': u'1.0.0.1120', u'result': u'Win32/Virus.RiskTool.734', u'update': u'20180802'}}}}Quick res file to update examples:
Download additional .res file to importIt should be added by default in a new version of the functions? no ?
------------------------------
BENOIT ROSTAGNI
------------------------------