# Automating File Artifact Enrichment in Splunk SOAR

> Build automated file enrichment playbooks in Splunk SOAR using ReversingLabs TitaniumCloud for reputation lookups, file detonation, and dynamic analysis.

![File enrichment workflow with ReversingLabs integration for Splunk SOAR](../images/enrichment-blogpost1.png)

## Overview

File classification presents a significant challenge for security analysts
Typically, the standard data provided in a Splunk SOAR artifact - such as file
hashes or names - isn't enough to definitively identify malicious files. It's
akin to trying to judge the contents of a package by its label alone.

This is where smart automation becomes crucial. Implementing systems to
automatically enrich file artifacts isn't just a nice-to-have; it's essential
for enabling Security Operations Centers (SOCs) to quickly triage file-based
alerts and address potential malware incidents before they escalate into
full-blown ransomware attacks.

This post will cover the key components involved in file artifact enrichment and
guide you through building a basic Splunk SOAR playbook to automate that process.
By the end, you'll have a clear roadmap for enhancing your security posture
through intelligent file analysis automation.

## Enrichment - Key Components

When adding enrichment to the triage process, the typical first step is to provide
analysts with a simple classification status that says if the file is malicious or benign.
However, there is a lot more information that can be obtained that could be used
to further detect malicious activity! Here's just some of the possibilities:

- Network indicators: malware will often call out to network locations such as
  IP addresses or domain names.
- Dropped file hashes: some malware will download other modules, or the malware may be
  an archive containing additional malware files.
- Associated threats: malware can be traced back to specific threat actors or
  families.

ReversingLabs apps for Splunk SOAR make this wealth of information readily
accessible to analysts. When implemented within a well-designed playbook, these
apps deliver rapid and accurate insights, significantly enhancing the speed and
effectiveness of the triage process. This comprehensive approach allows security
teams to:

- Quickly assess the severity and scope of potential threats
- Identify relationships between seemingly disparate indicators
- Prioritize response actions based on a more complete threat picture
- Proactively hunt for related malicious activity within the environment

In the next section, we'll walk through the step-by-step process of constructing
a simple file enrichment playbook in Splunk SOAR, incorporating ReversingLabs
apps to harness the full potential of file threat intelligence.

## Automating File Enrichment with Splunk SOAR

When building playbooks in Splunk SOAR, it's always good to start with a design
methodology. Splunk has created the I2A2 acronym, which stands for **I**nputs, **I**nteractions,
**A**ctions, and **A**rtifacts.

- Inputs: the data sources that trigger and feed into the playbook.
- Interactions: third party services that the playbook interacts with.
- Actions: the specific automated tasks performed to process inputs and interact with external services.
- Artifacts: the outputs and results generated by the playbook.

For a basic file enrichment playbook, here's what an I2A2 design looks like:

  
    Inputs
    FileHash, Hostname, FileName
  
  
    Interactions
    ReversingLabs Spectra Intelligence, ReversingLabs Spectra Analyze
    
  
    Actions
    Get File Hash Reputation, Detonate File, Get File Report 
  
  
    Artifacts
    FileHash
  

### First Steps - Reputation Lookup

To get started creating a basic file artifact enrichment playbook, it's a good
idea to start by filtering for only the inputs that the playbook should work with.
This will require an understanding of how artifacts are being created in Splunk
SOAR. For example, artifacts generated for this event use the `fileHash` CEF field:

![Splunk SOAR artifact with fileHash CEF field data](../images/splunk-soar-file-enrichment-1.png)

Place a filter block and connect the Start block. For the condition parameter,
set the value to `artifact:*.cef.fileHash`, the operator to `!=`, and leave the
match value empty. This will ensure that only artifacts with the `fileHash` CEF
field continue past this point:

![Splunk SOAR playbook filter block configuration for fileHash artifacts](../images/splunk-soar-file-enrichment-2.png)

Now that the playbook will only process file hashes, it's time to start adding actions
and interactions. A common action is to get the reputation of the file hash. Using
the ReversingLabs TitaniumCloud v2 app for Splunk SOAR makes this easy.

- Add an action block and connect to the filter block.
- Select the ReversingLabs TitaniumCloud v2 app.
- Select "file reputation" from the list of actions.
- In the hash input, select the `fileHash` CEF field from the previous filter action:

![ReversingLabs TitaniumCloud file reputation action with hash input configuration](../images/splunk-soar-file-enrichment-3.png)

Congratulations! You've built your first file enrichment automation playbook.
However, what happens if the third party service hasn't seen this file before?

### Adding Functionality - File Upload and Detonation

To further extend the capabilities of this playbook, adding an action to upload
and detonate unknown files can be a game changer. For the ReversingLabs TitaniumCloud v2 app,
the process to upload and detonate a file can be summarized in the following steps:

1. Upload the file
2. Submit for static and/or dynamic analysis
3. Retrieve the analysis report

Start by adding a decision block, and connect it to the file reputation action.
The value for the parameter should be `file_reputation_1:action_result.data.*.rl.malware_presence.status`,
the operator set to `==`, and the matching value should be `UNKNOWN`:

![Splunk SOAR playbook decision block checking file reputation unknown status](../images/splunk-soar-file-enrichment-4.png)

Next, connect the decision block to a new action block. This time, select the
"upload file" action from the ReversingLabs TitaniumCloud v2 app. Set the `vault_id`
input parameter to the artifacts vaultId CEF field, or `artifact:*.cef.vaultId`:

**Info: Ensure that the file has been uploaded to the container's file vault, otherwise**
the playbook will not be able to continue!

![ReversingLabs TitaniumCloud upload file action with vaultId parameter](../images/splunk-soar-file-enrichment-5.png)

After the file has been uploaded, add another action block to submit the sample
for detonation by selecting the "submit for dynamic analysis" action. Set the sha1
input as the vaultId value:

![ReversingLabs TitaniumCloud submit for dynamic analysis action configuration](../images/splunk-soar-file-enrichment-6.png)

Finally, add another action block and select the "dynamic analysis results" action.
The sha1 input value can be set to `submit_for_dynamic_analysis_1:action_result.parameter.sha1`,
and the analysis_id value should be set to `submit_for_dynamic_analysis_1:action_result.data.*.rl.analysis_id`:

![ReversingLabs TitaniumCloud dynamic analysis results action with output fields](../images/splunk-soar-file-enrichment-7.png)

A key point to know here is that dynamic analysis can take several minutes to
complete, so it's important to configure a loop until the analysis is completed.
Configure an acceptable number of retries, and ensure the exit condition value is
set to `dynamic_analysis_results_1:action_result.status`:

![Splunk SOAR custom loop block with retry configuration for analysis polling](../images/splunk-soar-file-enrichment-8.png)

The finalized version of this playbook now looks like this:

![Complete Splunk SOAR file enrichment playbook with all configured actions](../images/splunk-soar-file-enrichment-9.png)

Once this playbook is set to run automatically, analysts will now have file
enrichment information available to them in the widget view:

![Splunk SOAR analyst view with file enrichment results in widget panel](../images/splunk-soar-file-enrichment-10.png)

## Conclusion

This blog post has outlined the process of creating a fundamental file artifact enrichment playbook in Splunk SOAR, leveraging ReversingLabs' capabilities. The key steps covered include:

- Implementing filters to identify and isolate file hash artifacts
- Executing reputation lookups to assess potential threats
- Initiating file detonation for in-depth analysis when reputation data is unavailable

By incorporating these steps into your security operations, you can significantly enhance your SOC's initial triage process, providing analysts with crucial context for more informed decision-making. This approach not only streamlines workflows but also improves overall threat detection and response times.

The integration of ReversingLabs with Splunk SOAR offers a powerful combination for strengthening your organization's security posture. To explore the full potential of this integration and learn how to implement it in your environment, be sure to visit our website to see how we integrate with Splunk and other top
security platforms.

[Learn more about ReversingLabs integrations for Splunk](https://www.reversinglabs.com/reversinglabs-integration-with-splunk)
