integration-TrendMicroDDA.yml

commonfields:
  id: Trend Micro Deep Discovery Analyzer Beta
  version: -1
name: Trend Micro Deep Discovery Analyzer Beta
display: Trend Micro Deep Discovery Analyzer (Beta)
category: Forensics & Malware Analysis
image: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAAyCAMAAACgee/qAAACplBMVEUAAAADBQUAAAACBQUAAAAAAAACBQYAAAADBQUDBQUEBQUDBQUDBAUCBQUAAAACBQYDBAUDBgYEBgYCBQUDBQUCBQUCAwMAAAAAAAACBgYBAwMAAAAAAAAAAAADBAUCBgYDBQYCBQUCBQUCBAQCAwUAAgMEBAUDBQUAAwQDBAUCBQUCBQUDBAUCAwMABAQABATcFxzYFx4AAADTOk4ASiX/X1/eHicCBAYCBQUCBQUDAwUDBQYCBAQCBAQCBAQDAwUABATaGCH52dvhHyjdGyMCBAUDBAYCBQUEBAXeHyfeHSQDBAXbGSMAAADUDx7mpqbcGyPdGyPcGyQEBAXcFR7dICYDBgYDBgYCBQXdGiIEBgbgOEDaGCIDAwbjQ0naGR8ABATaLzbfV1feICngISvfJy7eJC3dFx/hNTzcGyPhMznbGyIEBgbdGyICBATgPEPgOULbGiDdMDndSk4AAwT97+/kVFoAAADeISnaEBn////eGyTcGyL0xsn//v7fGyTkSlDfKDH////eKzPeNDvxsrXxsLL//f3aGyP64+XdJi7bGyICBAYEBgb////cHyfdOD/bMTnbMDbdGCbcQknvur7f///cHCQDBQb////aDxjcGCHkHSfbFR3gHCTdHCThHSbbExvbERrgNDvdHyjeGyPvnaDtjpL//f364eLcFh7dIyz99fXqfYDnZ23hQkngOUDjHSb+9/f97/D77O376er2y83yq67peHzlW2H++fn64+T639/1xsf0wMLys7XvoqXul5vtkpbrgYXncHTmX2XeKDDlHSbhEBn75eb30dP1yMr0vb/zuLvwpanrhYrkV13jT1biSU/iR07gPUTfLzfhFyD/3+D53N70wsT4r7Hwe4DncXbnbHHkWmDsWWDmJy/ZCxBTAkaxAAAAl3RSTlMAXwOqJgndGfbwjPz6zivgu7GKavjUTi4j2kcVDwXr17aonXxRM8KQOr9uZ2NMQD08JQwFBALp5NCmlYB/dnNXQhj+/vjo5s/LqWxcMh8NCuze0cW6srCuoJmHelpaSUU+IRf49dnOrqufmpSLgXloXk5MPDgtKQf69fTy7u3l5ODSzMK6t7eloJSGhoWEdXVyY1VKQj8QLmikJQAABh9JREFUWMPtl1VXG1EQgCchJIRAUiGQ4qWlRVukRkuBuru7u7u7u3fvJpsQEpxSoE7d3d3ln3RWswu0T4Vzeg7fA3fnLocvM3d2lkA99dQdU5ctPjxu3KKJKwdBHbJy3LZ23RiGecB0mzZj7sS6ci+bPZ1x5FE82Q6m25ZFdaGeOnd1RTalwMHMnAi1zfEZD5Ram91ltT4s3psKtcri6Q6FNcfmfll6O//WnR+zB0ItcqSbQ66lyu/m37h+4eplmqY/7KjFg146TZFv+b3Tr9y5djvlLi1C9a62UEtMaSf3lpSXo9TGpW59dwHNB6F2aDuCoWTkYqkl7OXnaHrtCuDxzlSJxABk8VeBGmBRNxdvBWEUrVJNSMFVp1Jp+BA3ggcoxUed1J+x3sSUdwrFDvEjIk0BIgmPTySr8m5PBPZj1BLXzrhmERInhIg+TQMeUmc6/iJ2fUPxxUmCONbf32wgen//XukADQmJwKsehGhDUKwlAR38kV7x+JuNUNNDB9CKkMYY+hISbuqJeyajrLOc1F+wV6L48yzgUavVGh/SABdgxX5BeKWLJSSREzdJUbOAICYd5eLMlJBWwwhp0EYS96mQJCUl1cQ5p1Gcv2YKiFhQjAsvNgLSjJDmvBidiCT2CZKJE3HR9SSGaGlUii1tc5UWvcipdsYFKL70sC+IaKqKQ1oQEs2JTdFGRKPmxHrcHgmTJXEgIKPZUGCS4M3JzS88U1ZcrdSfaPpM2fs+NYpJ79jYFthUEd6cmBhYTKGc2Cc4nBhaLVeKsThjQeAQw2nt3x9jE1mreovLTtH0BZtjaGpNYgF9IHBig54lghcH6NDSIkspXkhIIxAYw+CcyK18VkjTp97+qlpqaz5baWve4C41iQ1RYxv1JH6JwIu1Fh2LmhdbQk341PkpxC3Zh0xghNPmzu9Ks5wvKCjNVRa67CxNfyyxZXdPrvGMLVz15gviJmEggmINxBNELlb7ExIMAsOdrjuPztJI4dWiolt2pfgp7n91UdlU/xrFODkG6InewosjQCn27i0To1CNH1Ib6hFTJdRTGrlG5ebalIW+g9vXce+PYr5TfXlx+IH0TkimKIZEmTgt3XcYRhNAZFYFlVNZyCZ82lr1gCuxs869xSLIS40tAwg3MllxFkGJfGQ24A8T99SRRDEySXsVSMxjKPt1GumaW3Vavj4vfhxZc+nSvJoBR2evpgPYVDt6eeEACcOFJwM3+3ml6XAJwpA9VBV3o6NKB2GrQKAvY39zmUYKrFXyffNI2nXi4/RvCE6IMyYAS1IeDifk8mu70vsS86Vv8pvMHPhH6CbHpfNP1MAh76/RSFGJ8p+uS6dw87mN77aK8SAQ1ob/IaLGSwlvnbcnUIeFhSmcIWxDh2qMwdHCBPl5hUYeK9J9d5FG8ovRqzjiaLO/BTLMaSDiG6kGkTiTjzZeiuZHaLUdMqS7MbH68JEWkJHkPsf1lkebY7tbhDtnpFeGp9KtCekHw0hvEPEySX86k3hlepFAMRwZHh/fkMQI0YDwiH7xPcwp4KHtdm58nCpz8UW22u5xtb9yT+y27O79JXGAKSokvL1H3NTzLow1rYKUsYliOMoM0Bw/Jk8GiWbD5oqU+YH5xG1Fit2lF7jwmdtFCTC7QRL7RJlVPRv61yAOM0WCnKYB5g76cI0QRekxWQtOajl7aI5zN24X3HyC6SNFd4ulN6Sj3RSP2C+hR6/Ijh1qEKsj2MGi0UmHoPfVBsSIUUufEHyscYzJObmVVnL+9n3PQ53tGA8eMYkxk4yWSrGYlF8MJBoSZKUOJgvFKJA0a+MdZQgCBSs2yrVXC9xWm8fLLAAPk4lxNFke5XkdjPI0l6WJn9nQIlQMI7UADfyMQtQmijQxkXSowokNZ3hp4ZUbp++jVuad11b+LKpCjSrvmEAQaSVrF12cb4LkhSy8Y0kwemZWp2atoRpJm7/kX3x+69Kr+64c1Eo4HPvQW5skD3+IX0tddrTK0203Hmqb1L6bHjgoOXkVeX2SoQ7osmCIk3HmZfOt7GTW9UmCOmLgkjFD11MOpzOv+5ARfZOhLknt0n/SkmNJyQOhnnr+T34DnwO1l/mBsm0AAAAASUVORK5CYII=
description: Deep Discovery Analyzer is a turnkey appliance that uses virtual images
  of endpoint configurations to analyze and detect targeted attacks.
detaileddescription: |-
  In order to allow the integration to work, the following configurations are required:
  1) Enter the DDA server and port into the server parameter in the integration
  2) Copy the IP address value from  Administration --> System Settings --> Network
  3) Paste this value into the ip_address parameter in the integration
  4) Copy the API key to the clipboard from Help --> About
  5) Paste this value into the apiKey parameter in the integration

  Note: This is a beta Integration, which lets you implement and test pre-release software. Since the integration is beta, it might contain bugs. Updates to the integration during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the integration to help us identify issues, fix them, and continually improve.
configuration:
- display: DDA Server and Port  (e.g https://192.168.0.1:<port>)
  name: server
  defaultvalue: ""
  type: 0
  required: true
- display: Internal IP address (only needed if the server URL is external)
  name: ip_address
  defaultvalue: ""
  type: 0
  required: false
- display: API Key
  name: apiKey
  defaultvalue: ""
  type: 4
  required: true
- display: Trust any certificate (unsecure)
  name: insecure
  defaultvalue: "true"
  type: 8
  required: false
- display: Use system proxy settings
  name: Proxy
  defaultvalue: ""
  type: 8
  required: false
- display: Protocol Version
  name: protocol_version
  defaultvalue: "1.5"
  type: 0
  required: false
script:
  script: |-
    import hashlib
    from datetime import datetime, timedelta
    import uuid
    import json
    import requests
    from requests.adapters import HTTPAdapter
    from requests.packages.urllib3.util.retry import Retry
    import re
    import platform
    import os.path
    import copy
    import requests
    from collections import OrderedDict

    # disable insecure warnings
    requests.packages.urllib3.disable_warnings()

    if not demisto.params().get("proxy", True):
        del os.environ["HTTP_PROXY"]
        del os.environ["HTTPS_PROXY"]
        del os.environ["http_proxy"]
        del os.environ["https_proxy"]

    #HELPER FUNCTIONS#

    def load_host_url():
        ''' loads the host url from the configuration or strips the server url to get valid host url '''
        host = demisto.params()['ip_address']
        if host:
            #strip https://www. of the server address //disable-secrets-detection
            url = re.compile(r"https?://(www\.)?")
            host = url.sub('', demisto.params()['server']).strip().strip('/')
            #strip :{port} of the server address
            host = host.split(':')[0]
        return host


    def hash_file(filename):
        '''Calculate the SHA1 of a file'''
        h = hashlib.sha1()
        with open(filename,'rb') as f:
            chunk = 0
            while chunk != '':
                chunk = f.read(1024)
                h.update(chunk)
        return h.hexdigest()

    def hash_url(url):
        '''Calculate the SHA1 of a URL'''
        h = hashlib.sha1()
        h.update(url)
        return h.hexdigest()

    def get_epoch_time():
        '''Get the epoch time (for the X-DTAS-Time header value.'''
        epoch_time = str(int(time.time()))
        return epoch_time

    def get_epoch_from_datetime(dt):
        '''Calculate epoch time from a datetime object'''
        epoch_format = str(int(time.mktime(dt.timetuple())))
        return epoch_format

    def calculate_checksum(api_key, headers, body=''):
        ''' Generates a Checksum for the api call '''
        temp = api_key
        if 'X-DTAS-ChecksumCalculatingOrder' in headers:
            x_dtas_checksum_calculating_order_list = headers['X-DTAS-ChecksumCalculatingOrder'].split(",")
            for key in x_dtas_checksum_calculating_order_list:
                temp += headers[key]
        else:
            for key, value in headers.iteritems():
                if ('X-DTAS-' in key and 'X-DTAS-Checksum' not in key and 'X-DTAS-ChecksumCalculatingOrder' not in key):
                    temp += value

        temp += body
        return hashlib.sha1(temp)

    def http_request(uri, method, headers, body={}, params={}, files={}):
        ''' Makes an API call to the server URL with the supplied uri, method, headers, body and params '''
        url = '%s/%s' % (SERVER_URL, uri)
        if method not in ['put', 'post']:
            body=json.dumps(body)
        res = requests.request(
            method,
            url,
            headers=headers,
            data=body,
            verify=USE_SSL,
            params=params,
            files=files
        )

        if (res.status_code != 102 and (res.status_code < 200 or res.status_code >= 300)):
            raise Exception('Got status code ' + str(res.status_code) + ' with body ' + res.content + ' with headers ' + str(res.headers))
        return res

    def file_uploaded_to_incident(file, file_sha1):
        ''' Converts an uploaded file to a Demisto incident '''
        incident = {}
        incident["name"] = "Incident: %s " % (file_sha1)
        incident["occurred"] = CURRENT_TIME
        incident["rawJSON"] = "TODO"

        labels = []
        incident["labels"] = labels
        return incident

    def binary_to_booleanic_string(binary):
        if (binary == '0'):
            return 'False'
        else:
            return 'True'

    def binary_to_boolean(binary):
        if (binary == '0'):
            return False
        else:
            return True

    #GLOBAL VARIABLES#
    API_KEY = demisto.params()['apiKey']
    PROTOCOL_VERSION = demisto.params()['protocol_version']
    SERVER_URL = demisto.params()['server'][:-1] if demisto.params()['server'].endswith('/') else demisto.params()['server']
    USE_SSL = not demisto.params().get('insecure', True)
    UUID = str(uuid.uuid4())
    HOST = load_host_url()

    DEFAULT_HEADERS = {
        'Host' : HOST,
        'X-DTAS-ProtocolVersion' : PROTOCOL_VERSION,
        'X-DTAS-ClientUUID': UUID,
        'X-DTAS-Time': get_epoch_time(),
        'X-DTAS-Challenge': str(uuid.uuid4()),
        'X-DTAS-ProductName': 'TDA',
        'X-DTAS-ClientHostname': platform.node(),
        'X-DTAS-SourceID': '1',
        'X-DTAS-SourceName': 'DemistoIntegration',
    }

    #for fetch incident
    CURRENT_TIME = datetime.utcnow()

    #COMMAND FUNCTIONS#

    def register():
        headers_register = copy.deepcopy(DEFAULT_HEADERS)
        tmp_checksum = calculate_checksum(API_KEY, headers_register)
        headers_register['X-DTAS-Checksum'] = tmp_checksum.hexdigest()
        res = http_request(
            'web_service/sample_upload/register',
            'get',
            headers_register
        )

    def unregister():
        headers_unregister = copy.deepcopy(DEFAULT_HEADERS)
        tmp_checksum = calculate_checksum(API_KEY, headers_unregister)
        headers_unregister['X-DTAS-Checksum'] = tmp_checksum.hexdigest()
        res = http_request(
            'web_service/sample_upload/unregister',
            'get',
            headers_unregister
        )

    def test():
        headers_test = copy.deepcopy(DEFAULT_HEADERS)
        tmp_checksum = calculate_checksum(API_KEY, headers_test)
        headers_test['X-DTAS-Checksum'] = tmp_checksum.hexdigest()
        res = http_request(
            'web_service/sample_upload/test_connection',
            'get',
            headers_test
        )
        demisto.results('ok')

    def prettify_simple_upload_sample_file(sha1):
        pretty_sample = {
            'SHA1': sha1.upper()
        }
        return pretty_sample

    def simple_upload_sample_file(sample_file):
        '''Upload a file to Deep Discovery Analyzer for analysis'''
        with open(demisto.getFilePath(sample_file)['path'], 'rb') as f:
            headers_simple_upload_sample_file = {
                'X-DTAS-ProtocolVersion': PROTOCOL_VERSION,
                'X-DTAS-ClientUUID': UUID,
                'X-DTAS-SourceID': '1',
                'X-DTAS-SourceName': 'DemistoIntegration',
                'X-DTAS-SHA1': hash_file(demisto.getFilePath(sample_file)['path']),
                'X-DTAS-Time': get_epoch_time(),
                'X-DTAS-SampleType': '0', #0 for file, 1 for URL
                'X-DTAS-Challenge': str(uuid.uuid4()),
                'X-DTAS-ChecksumCalculatingOrder': "X-DTAS-ProtocolVersion,X-DTAS-ClientUUID,X-DTAS-SourceID,X-DTAS-SourceName,X-DTAS-SHA1,X-DTAS-Time,X-DTAS-SampleType,X-DTAS-Challenge",
            }
            tmp_checksum = calculate_checksum(API_KEY, headers_simple_upload_sample_file)
            headers_simple_upload_sample_file['X-DTAS-Checksum'] = tmp_checksum.hexdigest()
            cmd_url = 'web_service/sample_upload/simple_upload_sample'
            res = http_request(
                cmd_url,
                'post',
                headers_simple_upload_sample_file,
                files = {'uploadsample': f}
            )
        pretty_res = prettify_simple_upload_sample_file(headers_simple_upload_sample_file['X-DTAS-SHA1'])
        return res, pretty_res

    def simple_upload_sample_file_command():
        sample_file = demisto.args().get('entryID')
        res, pretty_res = simple_upload_sample_file(sample_file)

        demisto.results({
            'Type': entryTypes['note'],
            'ContentsFormat': formats['text'],
            'Contents': 'File was uploaded to Trend Micro DDA successfully',
            'EntryContext': {
                  'TrendMicroDDA.Submission(val.SHA1 && val.SHA1==obj.SHA1)': pretty_res
            }
        })


    def prettify_simple_upload_sample_url(url, sha1):
        pretty_sample = {
            'SHA1': sha1.upper(),
            'URL': url
        }
        return pretty_sample

    def simple_upload_sample_url(sample_url):
        '''Upload a URL to Analyzer for analysis'''
        headers_simple_upload_sample_url = {
            'X-DTAS-ProtocolVersion': PROTOCOL_VERSION,
            'X-DTAS-ClientUUID': UUID,
            'X-DTAS-SourceID': '1',
            'X-DTAS-SourceName': 'DemistoIntegration',
            'X-DTAS-SHA1': hash_url(sample_url),
            'X-DTAS-Time': get_epoch_time(),
            'X-DTAS-SampleType': '1', #0 for file, 1 for URL
            'X-DTAS-Challenge': str(uuid.uuid4()),
            'X-DTAS-ChecksumCalculatingOrder': "X-DTAS-ProtocolVersion,X-DTAS-ClientUUID,X-DTAS-SourceID,X-DTAS-SourceName,X-DTAS-SHA1,X-DTAS-Time,X-DTAS-SampleType,X-DTAS-Challenge",
        }
        tmp_checksum = calculate_checksum(API_KEY, headers_simple_upload_sample_url)
        headers_simple_upload_sample_url['X-DTAS-Checksum'] = tmp_checksum.hexdigest()

        cmd_url = 'web_service/sample_upload/simple_upload_sample'
        res = http_request(
            cmd_url,
            'post',
            headers_simple_upload_sample_url,
            files = {'uploadsample' : sample_url}
        )

        pretty_res = prettify_simple_upload_sample_url(sample_url, headers_simple_upload_sample_url['X-DTAS-SHA1'])
        return res, pretty_res

    def simple_upload_sample_url_command():
        sample_url = demisto.args().get('url')
        res, pretty_res = simple_upload_sample_url(sample_url)

        demisto.results({
            'Type': entryTypes['note'],
            'Contents': str(res.headers),
            'ContentsFormat': formats['text'],
            'ReadableContentsFormat': formats['markdown'],
            'HumanReadable': tableToMarkdown('URL was uploaded to Trend Micro DDA successfully', pretty_res),
            'EntryContext': {
                  'TrendMicroDDA.Submission(val.SHA1 && val.SHA1==obj.SHA1)': pretty_res
            }
        })

    def get_sample(sha1, archive_type, archive_encrypted, archive_name):
        '''Issue a request to retrieve an archive of the sample given its SHA1 hash'''
        if not (re.match(r'\b[0-9a-fA-F]{40}\b', sha1)):
            return_error('Provided SHA1: {} is unvalid.'.format(sha1))

        headers_get_sample = copy.deepcopy(DEFAULT_HEADERS)
        headers_get_sample['X-DTAS-SHA1'] = sha1 # SHA1 of the file/URL to download
        headers_get_sample['X-DTAS-ArchiveType'] = archive_type
        headers_get_sample['X-DTAS-ArchiveEncrypted'] = archive_encrypted

        tmp_checksum = calculate_checksum(API_KEY, headers_get_sample)
        headers_get_sample['X-DTAS-Checksum'] = tmp_checksum.hexdigest()

        cmd_url = 'web_service/sample_upload/get_sample'
        res = http_request(
            cmd_url,
            'get',
            headers_get_sample
        )
        file = fileResult(archive_name, res.content)

        return res, file

    def get_sample_command():
        sha1 = demisto.args()['sha1']
        archive_type = demisto.args()['type']
        archive_encrypted = demisto.args()['encrypted']
        archive_name = demisto.args()['archive_name'] if 'archive_name' in demisto.args() else sha1
        archive_name += '.{}'.format(archive_type)
        res, file = get_sample(sha1, archive_type, archive_encrypted, archive_name)

        return demisto.results(file)

    def get_sample_list(interval_start, interval_end, interval_type):

        try:
            interval_start_dt = datetime.strptime(interval_start, "%Y-%m-%d %H:%M:%S")
            interval_end_dt = datetime.strptime(interval_end, "%Y-%m-%d %H:%M:%S")
        except:
            return_error('Given interval times are not in the required format, which is: YYYY-MM-DD HH:MM:SS, e.g. 2008-11-22 19:53:42')

        headers_get_sample_list = copy.deepcopy(DEFAULT_HEADERS)
        headers_get_sample_list['X-DTAS-IntervalStartingPoint'] = get_epoch_from_datetime(interval_start_dt)
        headers_get_sample_list['X-DTAS-IntervalEndPoint'] = get_epoch_from_datetime(interval_end_dt)
        headers_get_sample_list['X-DTAS-IntervalType'] = interval_type

        tmp_checksum = calculate_checksum(API_KEY, headers_get_sample_list)
        headers_get_sample_list['X-DTAS-Checksum'] = tmp_checksum.hexdigest()

        cmd_url = 'web_service/sample_upload/get_sample_list'
        res = http_request(
            cmd_url,
            'get',
            headers_get_sample_list
        )

        return res #returns a list of SHA1 of the samples

    def get_sample_list_command():
        '''Issue a request to get a semi-colon separated values list of submissions within the given time interval'''
        interval_start = demisto.args()['interval_start']
        interval_end = demisto.args()['interval_end']
        interval_type = demisto.args()['interval_type']
        result = get_sample_list(interval_start, interval_end, interval_type)
        if result.text:
            sha1_list = result.text.split(';')
            hr = '### Trend Micro DDA submissions SHA1\n'
            for sha1 in sha1_list:
                hr += '- {}\n'.format(sha1)

            demisto.results({
                'Type': entryTypes['note'],
                'ContentsFormat': formats['text'],
                'Contents': result.text,
                'ReadableContentsFormat': formats['markdown'],
                'HumanReadable': hr
            })
        else:
            demisto.results('No results found.')

    def build_report(res, threshold, status, verbose):
        report_json = json.loads(xml2json(res.text))
        reports = report_json['REPORTS']
        #true if list, false if dict
        reports_type_is_list = isinstance(reports['FILE_ANALYZE_REPORT'], list)
        hr = {}
        hr_headers = {
            'Risk Level': reports['OVERALL_RISK_LEVEL'],
            'Image Type': reports['IMAGE_TYPE']['TYPE']['#text'],
            'Sum of Files Analyzed': (len(reports['FILE_ANALYZE_REPORT'])) if reports_type_is_list  else '1',
        }

        context = {}
        dbot_score = 0
        context['DBotScore'] = {
            'Vendor': 'Trend Micro DDA',
            'Score': dbot_score, #check that------------------ TODO --------------------
            'Type': 'hash',
            'Indicator': reports['FILE_ANALYZE_REPORT']['FileSHA1'] if not reports_type_is_list else reports['FILE_ANALYZE_REPORT'][0]['FileSHA1']
        }
        #if type is list, the submission was divided to sub-files and the first file_analyze_report is of the main submission
        #context['DBotScore.Indicator'] = reports['FILE_ANALYZE_REPORT']['FileSHA1'] if not reports_type_is_list else reports['FILE_ANALYZE_REPORT'][0]['FileSHA1']

        if not reports_type_is_list: #if the submission doesn't have sub-files
            file_analyze_report = reports['FILE_ANALYZE_REPORT']
            hr['File Name'] = file_analyze_report['OrigFileName']
            hr['Malware Source IP'] = file_analyze_report['MalwareSourceIP']
            hr['Malware Source Host'] = file_analyze_report['MalwareSourceHost']
            hr['Total Dropped Files'] = file_analyze_report['DroppedFiles']['@Total']
            hr['Deny List'] = binary_to_booleanic_string(file_analyze_report['IsDenylisted'])
            hr['White List'] = binary_to_booleanic_string(file_analyze_report['IsWhitelisted'])

            if '#text' in file_analyze_report['VirusName']: #the submission has a detection
                hr['Detection Name'] = file_analyze_report['VirusName']['#text']
            #set the filename
            filename = hr['Detection Name'] if ('Detection Name' in hr) else file_analyze_report['FileSHA1']

            #add data regarding the submission to the context
            context['TrendMicroDDA.Submission(val.SHA1 && val.SHA1==obj.SHA1)'] = {
                'Status': status,
                'RiskLevel': reports['OVERALL_RISK_LEVEL'],
                'SHA1': file_analyze_report['FileSHA1'],
                'SHA256': file_analyze_report['FileSHA256'],
                'MD5': file_analyze_report['FileMD5'],
                'VirusDetected' : binary_to_boolean(file_analyze_report['VirusDetected']),
            }

            if file_analyze_report['TrueFileType'] == 'URL':
                #add the URL address
                context[outputPaths['url']] = {
                    'Data': file_analyze_report['OrigFileName']
                }
            else:
                context[outputPaths['file']] = {
                    'MD5': file_analyze_report['FileMD5'],
                    'SHA1': file_analyze_report['FileSHA1'],
                    'SHA256': file_analyze_report['FileSHA256'],
                    'Size': file_analyze_report['FileSize'],
                    'Name': file_analyze_report['OrigFileName'],
                }

            #add data regarding the submission to the context if file is malicious
            if (reports['OVERALL_RISK_LEVEL'] >= threshold):
                dbot_score = 3
                if file_analyze_report['TrueFileType'] == 'URL':
                    context[outputPaths['url']].update({
                        'Malicious': {
                            'Vendor': 'Trend Micro DDA',
                            'Description': 'RiskLevel: ' + reports['OVERALL_RISK_LEVEL']
                        }
                    })
                else:
                    context[outputPaths['file']].update({
                        'Malicious' : {
                            'Vendor': 'Trend Micro DDA',
                            'Description': 'RiskLevel: ' + reports['OVERALL_RISK_LEVEL']
                        }
                    })

            #extracting IP and Domains from the report
            if file_analyze_report['MalwareSourceIP']:
                context['IP.Address(val.Address && val.Address == obj.Address)'] = file_analyze_report['MalwareSourceIP']
            if file_analyze_report['MalwareSourceHost']:
                context['Domain.Name(val.Name && val.Name == obj.Name)'] = file_analyze_report['MalwareSourceHost']
            if verbose == 'true':
                dropped_files = file_analyze_report['DroppedFiles']
                if 'FileItem' in dropped_files:
                    if 'DownloadURL' in dropped_files['FileItem']:
                        context['URL.Data(val.Data && val.Data == obj.Data)'] = dropped_files['FileItem']['DownloadURL']
                        hr['Download URL'] = dropped_files['FileItem']['DownloadURL']
                        context['TrendMicroDDA.Submission'].update({
                            'DownloadURL': dropped_files['FileItem']['DownloadURL']
                        })

        else: #if the submission have sub-files

            main_file_analyze_report = reports['FILE_ANALYZE_REPORT'][0]

            #add data to the war room
            hr = copy.deepcopy(reports['FILE_ANALYZE_REPORT'])
            for item in hr:
                item['File Name'] = item['OrigFileName']
                item['Detection Name'] = item['VirusName']['#text'] if '#text' in item['VirusName'] else None
                item['Malware Source IP'] = item['MalwareSourceIP']
                item['Malware Source Host'] = item['MalwareSourceHost']
                if verbose == 'true':
                    item['Download URL'] = item['DroppedFiles'].get('FileItem')
                item['Deny List'] = binary_to_booleanic_string(item['IsDenylisted']) if item['IsDenylisted'] else None
                item['White List'] = binary_to_booleanic_string(item['IsWhitelisted']) if item['IsWhitelisted'] else None

            #set the filename
            filename = main_file_analyze_report['OrigFileName']

            if verbose == 'true':
                hr['Download URL'] = download_url_list
                context['URL.Data(val.Data && val.Data == obj.Data)'] = download_url_list
                context['TrendMicroDDA.Submission'].update({
                    'DownloadURL': download_url_list
                })

            #add data regarding the submission to the context
            file_analyzed_list = []
            for file_analyzed in reports['FILE_ANALYZE_REPORT'][1:]: #iterate over all the subfiles excluding the main file
                file_analyzed_dict = {
                    'SHA1': file_analyzed['FileSHA1'],
                    'SHA256': file_analyzed['FileSHA256'],
                    'MD5': file_analyzed['FileMD5'],
                    'Name': file_analyzed['VirusName']['#text'] if '#text' in file_analyzed['VirusName'] else '',
                    'VirusDetected': binary_to_boolean(file_analyzed['VirusDetected']),
                }
                if file_analyzed['TrueFileType'] == 'URL':
                    #add the URL address
                    context[outputPaths['url']] = {
                        'Data': file_analyzed['OrigFileName']
                    }
                else:
                    context[outputPaths['file']] = {
                        'MD5': file_analyzed['FileMD5'],
                        'SHA1': file_analyzed['FileSHA1'],
                        'SHA256': file_analyzed['FileSHA256'],
                        'Size': file_analyzed['FileSize'],
                        'Name': file_analyzed['VirusName']['#text'] if '#text' in file_analyzed['VirusName'] else '',
                        ##add score of some sort from virusdetected? ask michal.------------------ TODO --------------------
                    }
                file_analyzed_list.append(file_analyzed_dict)

            context['TrendMicroDDA.Submission(val.SHA1 && val.SHA1==obj.SHA1)'] = {
                'Status': status,
                'RiskLevel': reports['OVERALL_RISK_LEVEL'],
                'SHA1': main_file_analyze_report['FileSHA1'],
                'SHA256': main_file_analyze_report['FileSHA256'],
                'MD5': main_file_analyze_report['FileMD5'],
                'VirusDetected': binary_to_boolean(main_file_analyze_report['VirusDetected']),
                'FileAnalyzed': file_analyzed_list,
            }
            if main_file_analyze_report['TrueFileType'] == 'URL':
                context['URL(val.Data && val.Data==obj.Data)'] = {
                    'Data': main_file_analyze_report['OrigFileName'],
                }
            else:
                context['File(val.SHA1 && val.SHA1==obj.SHA1)'] = {
                    'MD5': main_file_analyze_report['FileMD5'],
                    'SHA1': main_file_analyze_report['FileSHA1'],
                    'SHA256': main_file_analyze_report['FileSHA256'],
                    'Size': main_file_analyze_report['FileSize'],
                    'Name': main_file_analyze_report['VirusName']['#text'] if '#text' in file_analyzed['VirusName'] else '',
                }
            #add data regarding the submission to the context if it is malicious
            if (reports['OVERALL_RISK_LEVEL'] >= threshold):
                context['DBotScore.Score'] = 3
                if (main_file_analyze_report['TrueFileType'] == 'URL'):
                    context[outputPaths['url']] = {
                        'Malicious' : {
                            'Vendor' : 'Trend Micro DDA',
                            'Description' : 'RiskLevel: ' + reports['OVERALL_RISK_LEVEL']
                            }
                    }
                else:
                    context[outputPaths['file']] = {
                        'Malicious' : {
                            'Vendor' : 'Trend Micro DDA',
                            'Description' : 'RiskLevel: ' + reports['OVERALL_RISK_LEVEL']
                            }
                    }

            #extracting IP and Domains from the report
            if main_file_analyze_report['MalwareSourceIP']:
                context['IP.Address(val.Address && val.Address == obj.Address)'] = main_file_analyze_report['MalwareSourceIP']
            if main_file_analyze_report['MalwareSourceHost']:
                context['Domain.Name(val.Name && val.Name == obj.Name)'] = main_file_analyze_report['MalwareSourceHost']

        return context, hr, hr_headers, filename

    def get_report(sha1):
        '''Issue a request to retrieve XML report for a given SHA1'''
        if not (re.match(r'\b[0-9a-fA-F]{40}\b', sha1)):
            return_error('Provided SHA1: {} is unvalid.'.format(sha1))

        headers_get_report = copy.deepcopy(DEFAULT_HEADERS)
        headers_get_report['X-DTAS-SHA1'] = sha1 # SHA1 of the file/URL to download
        headers_get_report['X-DTAS-Time'] = get_epoch_time()

        tmp_checksum = calculate_checksum(API_KEY, headers_get_report)
        headers_get_report['X-DTAS-Checksum'] = tmp_checksum.hexdigest()

        cmd_url = 'web_service/sample_upload/get_report'
        res = http_request(
            cmd_url,
            'get',
            headers_get_report
        )

        return res

    def get_report_command():
        sha1 = demisto.args()['sha1']
        threshold = demisto.args()['threshold']
        verbose = demisto.args()['verbose']
        res = get_report(sha1)

        if res.status_code == 102:
            ec = {
                'Status': 'Analyzing',
                'SHA1': sha1
            }
            demisto.results({
                'Type': entryTypes['note'],
                'ContentsFormat': formats['text'],
                'Content': res,
                'HumanReadable': 'Submission analyzation was not finished yet.',
                'EntryContext': {
                    'TrendMicroDDA.Submission(val.SHA1 && val.SHA1==obj.SHA1)': ec
                }
            })
        else:
            status = 'Completed'

            context, hr, hr_headers, filename = build_report(res, threshold, status, verbose)
            markdown_table_headers = ['File Name', 'Detection Name', 'Malware Source IP', 'Malware Source Host']
            if verbose == 'true':
                markdown_table_headers.append('Download URL')
            markdown_table_headers.extend(('Deny List', 'White List'))

            demisto.results({ #add context and the Report File to the war room
                'Type': 9,
                'FileID': res.text,
                'Contents': '',
                'ContentsFormat': formats['text'],
                'File': filename,
                'EntryContext': context,
            })
            demisto.results({ #add table to the war room
                'Type': entryTypes['note'],
                'Contents': res.text,
                'ContentsFormat': formats['text'],
                'HumanReadableFormat': formats['markdown'],
                'HumanReadable':
                    '## Submission Report from TrendMicroDDA\n' +
                    '### Risk Level: {}, Sum of Files Analyzed: {}, Image Type: {}\n'.format(hr_headers['Risk Level'], hr_headers['Sum of Files Analyzed'],hr_headers['Image Type']) +
                    tableToMarkdown('Report Summary', hr, headers=markdown_table_headers),
            })

    def build_brief_report(res, sha1, threshold):
        report_json = json.loads(xml2json(res.text))
        brief_report_json = report_json['REPORT']['BRIEF_REPORT']
        hr = {
            'SHA1': sha1,
            'Risk Level': brief_report_json['RiskLevel'],
            'Status': brief_report_json['STATUS'],
        }
        return hr


    def get_brief_report(sha1):
        if not (re.match(r'\b[0-9a-fA-F]{40}\b', sha1)):
            return_error('Provided SHA1 is unvalid.')

        headers_get_brief_report = {
            'Content-Type': 'text/plain',
            'X-DTAS-ProtocolVersion': PROTOCOL_VERSION,
            'X-DTAS-ClientUUID': UUID,
            'X-DTAS-Time': get_epoch_time(),
            'X-DTAS-Challenge': str(uuid.uuid4()),
            'X-DTAS-ChecksumCalculatingOrder': "X-DTAS-ProtocolVersion,X-DTAS-ClientUUID,X-DTAS-Time,X-DTAS-Challenge",
        }
        sha1_list = argToList(sha1)
        data = ';'.join(sha1_list)
        tmp_checksum = calculate_checksum(API_KEY, headers_get_brief_report, data)
        headers_get_brief_report['X-DTAS-Checksum'] = tmp_checksum.hexdigest()

        cmd_url = 'web_service/sample_upload/get_brief_report'
        res = http_request(
            cmd_url,
            'put',
            headers=headers_get_brief_report,
            body=data
        )
        return res

    def get_brief_report_command():
        '''Issue a request to retrieve the brief XML report for a given SHA1'''
        sha1 = demisto.args()['sha1']
        threshold = demisto.args()['threshold']
        res = get_brief_report(sha1)

        hr = build_brief_report(res, sha1, threshold)
        demisto.results({
            'Type': entryTypes['note'],
            'ContentsFormat': formats['text'],
            'Contents': res.text,
            'HumanReadableFormat': formats['markdown'],
            'HumanReadable': tableToMarkdown('Sample Brief Report from TrendMicroDDA', hr, removeNull=True),
            #'EntryContext': {
            #    'TrendMicroDDA.Submission(val.SHA1 && val.SHA1==obj.SHA1)': context
            #}
        })

    def check_status(sha1_list):
        for sha1 in sha1_list:
            if not (re.match(r'\b[0-9a-fA-F]{40}\b', sha1)):
                return_error('Provided SHA1: {} is unvalid.'.format(sha1))
        manyRes = []
        manyEC = []

        for sha1 in sha1_list:
            res = get_report(sha1)
            manyRes.append(res.text)
            if res.status_code == 102:
                manyEC.append({
                    'Status': 'Analyzing',
                    'SHA1': sha1
                })
            else:
                manyEC.append({
                    'Status': 'Completed',
                    'SHA1': sha1
                })

        return manyRes, manyEC

    def check_status_command():
        sha1_list = argToList(demisto.args()['sha1'])
        manyRes, manyEC, = check_status(sha1_list)

        demisto.results({
            'Type': entryTypes['note'],
            'Contents': manyRes,
            'ContentsFormat': formats['json'],
            'ReadableContentsFormat': formats['markdown'],
            'HumanReadable': tableToMarkdown('Status of the submissions in TrendMicroDDA', manyEC),
            'EntryContext': {
                  'TrendMicroDDA.Submission(val.SHA1 && val.SHA1==obj.SHA1)': manyEC
            }
        })

    # EXECUTION
    LOG('command is %s' % (demisto.command(), ))

    try:
        register()
        if demisto.command() == 'test-module':
            test()

        elif demisto.command() == 'fetch-incidents':
            fetch_incidents()

        elif demisto.command() == 'trendmicro-dda-upload-file':
            simple_upload_sample_file_command()

        elif demisto.command() == 'trendmicro-dda-upload-url':
            simple_upload_sample_url_command()

        elif demisto.command() == 'trendmicro-dda-get-sample':
            get_sample_command()

        elif demisto.command() == 'trendmicro-dda-check-status':
            check_status_command()

        elif demisto.command() == 'trendmicro-dda-get-brief-report':
            get_brief_report_command()

        elif demisto.command() == 'trendmicro-dda-get-report':##add !file !url command? ask anar
            get_report_command()

        elif demisto.command() == 'trendmicro-dda-get-openioc':
            get_openioc_report_command()

        elif demisto.command() == 'trendmicro-dda-get-sample-list':
            get_sample_list_command()

    except Exception, e:
        LOG(e.message)
        LOG.print_log()
        raise

    finally:
        unregister()
  type: python
  commands:
  - name: trendmicro-dda-get-sample
    arguments:
    - name: sha1
      required: true
      description: The SHA1 of the sample to get
    - name: type
      auto: PREDEFINED
      predefined:
      - tgz
      - zip
      description: The export data type
      defaultValue: zip
    - name: encrypted
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      description: '0 (not encrypted) or 1 (Encrypted with password "virus")'
      defaultValue: "0"
    - name: archive_name
      description: A name for the retrieved archive
    outputs:
    - contextPath: File.EntryID
      description: Demisto entry ID of archive
      type: string
    - contextPath: File.Size
      description: File size
      type: number
    - contextPath: File.SHA1
      description: File SHA1
      type: string
    - contextPath: File SHA256
      description: File SHA256
      type: string
    - contextPath: File.Name
      description: File name
      type: string
    - contextPath: File.SSDeep
      description: File SSDeep
      type: string
    - contextPath: File.Info
      description: File info
      type: string
    - contextPath: File.Type
      description: File type
      type: string
    - contextPath: File.MD5
      description: File MD5
      type: string
    - contextPath: File.Extension
      description: File extension
      type: string
    description: Retrieves a sample
  - name: trendmicro-dda-get-openioc
    arguments:
    - name: sha1
      description: SHA1 of the submission
    description: Retrieves IOC for a given submission, returns an error if submission
      has no IOC
  - name: trendmicro-dda-get-report
    arguments:
    - name: sha1
      required: true
      description: The SHA1 of the submission
    - name: threshold
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      - "2"
      - "3"
      description: DDA severity score (greater or equal to) for which the submission
        will be considered malicious
      defaultValue: "1"
    - name: verbose
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Return detailed report
      defaultValue: "false"
    outputs:
    - contextPath: TrendMicroDDA.Submission.Status
      description: The status of the submission
      type: string
    - contextPath: TrendMicroDDA.Submission.SHA1
      description: SHA1 of the submission
      type: string
    - contextPath: TrendMicroDDA.Submission.RiskLevel
      description: The Risk Level of the submission
      type: number
    - contextPath: DBotScore.Score
      description: The actual score
      type: number
    - contextPath: DBotScore.Indicator
      description: The indicator we tested
      type: string
    - contextPath: DBotScore.Type
      description: The type of the indicator
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score
      type: string
    - contextPath: InfoFile.MD5
      description: MD5 hash of the report file
      type: string
    - contextPath: InfoFile.SHA1
      description: SHA1 hash of the report file
      type: string
    - contextPath: InfoFile.SHA256
      description: SHA256 hash of the report  file
      type: string
    - contextPath: InfoFile.Name
      description: Report file name
      type: string
    - contextPath: InfoFile.Type
      description: Report file type e.g. "PE"
      type: string
    - contextPath: InfoFile.Size
      description: Report file size
      type: number
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the reason for the vendor to make the decision
      type: string
    - contextPath: IP.Address
      description: IPs relevant to the submission
      type: string
    - contextPath: Domain.Name
      description: Domains relevant to the submission
      type: string
    - contextPath: URL.Data
      description: URL data
      type: string
    - contextPath: File.MD5
      description: MD5 hash of the file
      type: string
    - contextPath: File.SHA1
      description: SHA1 hash of the file
      type: string
    - contextPath: File.SHA256
      description: SHA256 hash of the file
      type: string
    - contextPath: File.Size
      description: File size
      type: number
    - contextPath: File.Name
      description: File name
      type: string
    - contextPath: TrendMicroDDA.Submission.SHA256
      description: SHA256 of the submission
      type: string
    - contextPath: TrendMicroDDA.Submission.MD5
      description: MD5 of the submission
      type: string
    - contextPath: TrendMicroDDA.Submission.VirusDetected
      description: True if virus detected, else Flase
      type: boolean
    - contextPath: TrendMicroDDA.Submission.DownloadURL
      description: Download URL address of files
      type: string
    description: Retrieves XML report of a given submission
  - name: trendmicro-dda-get-sample-list
    arguments:
    - name: interval_start
      required: true
      description: Interval start time, given in format ~~YYYY-MM-DD HH:MM:SS, e.g.
        2008-11-22 19:53:42
    - name: interval_end
      required: true
      description: Interval end time, given in format YYYY-MM-DD HH:MM:SS, e.g. 2008-11-22
        19:53:42
    - name: interval_type
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      description: '0: Submission time, 1: Completion time'
      defaultValue: "0"
    description: Retrieves a list of SHA1 of samples submitted within the given time
      interval
  - name: trendmicro-dda-check-status
    arguments:
    - name: sha1
      required: true
      description: 'The SHA1 of the submissions. Example: "2492A18532745251FBC5DAF7160DAA49B90DBBE1,  52483514F07EB14570142F6927B77DEB7B4DA99F"'
      isArray: true
    outputs:
    - contextPath: TrendMicroDDA.Submission.Status
      description: The status of the submission
      type: string
    - contextPath: TrendMicroDDA.Submission.SHA1
      description: The SHA1 of the submission
      type: string
    description: Checks the analysis status of the submissions
  - name: trendmicro-dda-upload-url
    arguments:
    - name: url
      required: true
      description: The URL to upload
      isArray: true
    outputs:
    - contextPath: TrendMicroDDA.Submission.SHA1
      description: The SHA1 of the submission
      type: string
    - contextPath: TrendMicroDDA.Submission.URL
      description: The submitted URL
      type: string
    description: 'Upload a URL to Trend Micro DDA '
  - name: trendmicro-dda-upload-file
    arguments:
    - name: entryID
      required: true
      description: EntryID of the file to upload
      isArray: true
    outputs:
    - contextPath: TrendMicroDDA.Submission.SHA1
      description: The SHA1 of the submission
      type: string
    description: 'Upload a file to Trend Micro DDA '
  - name: trendmicro-dda-get-brief-report
    arguments:
    - name: sha1
      required: true
      description: SHA1 of the submission
    - name: threshold
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      - "2"
      - "3"
      description: DDA severity score (greater or equal to) for which the submission
        will be considered malicious
      defaultValue: "1"
    description: Retrieves a brief XML report of a given submission
  runonce: false
beta: true
tests:
- No Test - run "Test Playbook TrendMicroDDA" manually