Splunk SOAR Playbook Virustotal output IP Reputation

zksvc — Thu, 22 May 2025 08:54:26 GMT

I've obtained this information from VirusTotal, and I want to create a playbook to check IP reputation and retrieve the results. I want to make a decision where if the result is greater than 0, it will write a note stating 'It's malicious from VirusTotal.' You can see this example: Community Score or information like '4/94 security vendors flagged.' I want to compare it according to VirusTotal from the playbook. However, when I run it, it only shows 'detected urls: 2.' Can someone explain this?

Re: Splunk SOAR Playbook Virustotal output IP Reputation

livehybrid — Thu, 22 May 2025 09:31:46 GMT

Hi @zksvc

Please could you share your code for doing this check? I suspect that you are counting the number of categories returned rather than the counts in each category - e.g. in that specific example you have "malicious" and "malware".

Check that what you're counting isnt an array of objects and/or share you config/code and I'd be happy to look into it further.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Splunk SOAR Playbook Virustotal output IP Reputation

zksvc — Thu, 22 May 2025 09:53:06 GMT

What i want is from ES if it send to SOAR it will detect src IP then get information from VIrustotal, if it malicious it will write a note "Malicious from VirusTotal" and change the status to "Pending" to make sure monitoring team will double check it. i share screenshot for playbook

Also here the code

""" """ import phantom.rules as phantom import json from datetime import datetime, timedelta @phantom.playbook_block() def on_start(container): phantom.debug('on_start() called') # call 'update_event_1' block update_event_1(container=container) return @phantom.playbook_block() def update_event_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): phantom.debug("update_event_1() called") # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) container_artifact_data = phantom.collect2(container=container, datapath=["artifact:*.cef.event_id","artifact:*.id"]) parameters = [] # build parameters list for 'update_event_1' call for container_artifact_item in container_artifact_data: if container_artifact_item[0] is not None: parameters.append({ "status": "in progress", "comment": "tahap analisa via SOAR", "event_ids": container_artifact_item[0], "context": {'artifact_id': container_artifact_item[1]}, }) ################################################################################ ## Custom Code Start ################################################################################ # Write your custom code here... ################################################################################ ## Custom Code End ################################################################################ phantom.act("update event", parameters=parameters, name="update_event_1", assets=["soar_es"], callback=ip_reputation_1) return @phantom.playbook_block() def ip_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): phantom.debug("ip_reputation_1() called") # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) container_artifact_data = phantom.collect2(container=container, datapath=["artifact:*.cef.src","artifact:*.id"]) parameters = [] # build parameters list for 'ip_reputation_1' call for container_artifact_item in container_artifact_data: if container_artifact_item[0] is not None: parameters.append({ "ip": container_artifact_item[0], "context": {'artifact_id': container_artifact_item[1]}, }) ################################################################################ ## Custom Code Start ################################################################################ # Write your custom code here... ################################################################################ ## Custom Code End ################################################################################ phantom.act("ip reputation", parameters=parameters, name="ip_reputation_1", assets=["virustotalv3"], callback=decision_1) return @phantom.playbook_block() def decision_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): phantom.debug("decision_1() called") # check for 'if' condition 1 found_match_1 = phantom.decision( container=container, conditions=[ ["ip_reputation_1:action_result.data.*.detected_communicating_samples.*.positives", ">", 0] ], delimiter=None) # call connected blocks if condition 1 matched if found_match_1: update_event_2(action=action, success=success, container=container, results=results, handle=handle) return return @phantom.playbook_block() def update_event_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): phantom.debug("update_event_2() called") # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) update_event_1_result_data = phantom.collect2(container=container, datapath=["update_event_1:action_result.parameter.event_ids","update_event_1:action_result.parameter.context.artifact_id"], action_results=results) parameters = [] # build parameters list for 'update_event_2' call for update_event_1_result_item in update_event_1_result_data: if update_event_1_result_item[0] is not None: parameters.append({ "status": "Pending", "comment": "Source IP is Malicious from VirusTotal", "event_ids": update_event_1_result_item[0], "context": {'artifact_id': update_event_1_result_item[1]}, }) ################################################################################ ## Custom Code Start ################################################################################ # Write your custom code here... ################################################################################ ## Custom Code End ################################################################################ phantom.act("update event", parameters=parameters, name="update_event_2", assets=["soar_es"]) return @phantom.playbook_block() def on_finish(container, summary): phantom.debug("on_finish() called") ################################################################################ ## Custom Code Start ################################################################################ # Write your custom code here... ################################################################################ ## Custom Code End ################################################################################ return

Re: Splunk SOAR Playbook Virustotal output IP Reputation

zksvc — Fri, 23 May 2025 07:39:00 GMT

It's because VirusTotal version, all is good after i change to VirusTotalV3

topic Re: Splunk SOAR Playbook Virustotal output IP Reputation in Deployment Architecture

Splunk SOAR Playbook Virustotal output IP Reputation

Re: Splunk SOAR Playbook Virustotal output IP Reputation

Re: Splunk SOAR Playbook Virustotal output IP Reputation

Re: Splunk SOAR Playbook Virustotal output IP Reputation