Package Documentation
Storm Package: synapse-hyas
The following Commands are available from this package. This documentation is generated for version 1.1.0 of the package.
Storm Commands
This package implements the following Storm Commands.
hyas.c2.attribution
Ingest C2 attribution data from HYAS.
This command will query the HYAS API using the FQDN, IPv4, SHA-256, or email from the inbound node.
If a file:bytes node is provided the :sha256 property will be used.
The command will yield inet:http:request and/or inet:email:message nodes depending on
whether an HTTP beacon or email beacon is present in the record.
An it:sec:c2:config node will also be created using the C2 URL. The cookies will be added to the
headers property using "id" as a placeholder for the name.
Examples:
// Query using an IPv4 and pivot to the inet:http:request
inet:ipv4#my.ip | hyas.c2.attribution --yield
// Filter results using a date interval
inet:ipv4#my.ip | hyas.c2.attribution --date (2023-03, 2023-04)
Usage: hyas.c2.attribution [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size (per-node).
--yield : Yield the newly created nodes.
--date <date> : Filter results by datetime.
--config <config> : Override the default config with the provided name.
Inputs:
file:bytes : file:bytes nodes
hash:sha256 : hash:sha256 nodes
inet:email : inet:email nodes
inet:fqdn : inet:fqdn nodes
inet:ipv4 : inet:ipv4 nodes
The command is accessible to users with one or more of the following permissions:
power-ups.hyas.adminpower-ups.hyas.user
hyas.config.add
Add a Synapse-HYAS configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Add a global configuration
hyas.config.add default myapikey1234
// Add a configuration for the current user
hyas.config.add --scope self myconfig myapikey5678
Usage: hyas.config.add [options] <name> <apikey>
Options:
--help : Display the command usage.
--ssl-noverify : Do not perform SSL/TLS verification.
--proxy <proxy> : Configure the proxy usage. (default: True)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from HYAS. (default: rep.hyas)
--scope <scope> : Set the scope on the configuration. (default: global, choices: global, self, unscoped)
Arguments:
<name> : A unique name for the configuration.
<apikey> : The HYAS API key string.
The command is accessible to users with one or more of the following permissions:
power-ups.hyas.adminpower-ups.hyas.user
hyas.config.del
Delete a Synapse-HYAS configuration.
Examples:
// Delete the "myconfig" configuration
hyas.config.del myconfig
Usage: hyas.config.del [options] <name>
Options:
--help : Display the command usage.
Arguments:
<name> : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.hyas.adminpower-ups.hyas.user
hyas.config.list
Display the list of Synapse-HYAS configurations you have access to.
Usage: hyas.config.list [options]
Options:
--help : Display the command usage.
The command is accessible to users with one or more of the following permissions:
power-ups.hyas.adminpower-ups.hyas.user
hyas.config.migrate
Migrate options for all Synapse-HYAS configurations.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Migrate the tag prefix for all configurations
hyas.config.migrate --tag-prefix my.tagpref
Usage: hyas.config.migrate [options]
Options:
--help : Display the command usage.
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from HYAS. (default: None)
The command is accessible to users with one or more of the following permissions:
power-ups.hyas.admin
hyas.config.show
Show the details of a configuration.
Examples:
// Show the in-use configuration for the current user
hyas.config.show
// Show a configuration by name
hyas.config.show myconfig
Usage: hyas.config.show [options] <name>
Options:
--help : Display the command usage.
Arguments:
[name] : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.hyas.adminpower-ups.hyas.user
hyas.config.update
Update the configuration of a defined Synapse-HYAS configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Set the permission level for user "myuser" to "admin" on the "myconfig"
// configuration
hyas.config.update myconfig --perm user myuser admin
// Set the permission level for the "all" role to "deny" on the
// "myconfig" configuration
hyas.config.update myconfig --perm role all deny
// Do not verify the SSL certificate when connecting to "myconfig"
hyas.config.update myconfig --ssl-verify (false)
// Change the tag prefix used by the "myconfig" configuration
hyas.config.update myconfig --tag-prefix my.prefix
// Change the name of the "myconfig" configuration to "otherconfig"
hyas.config.update myconfig --name otherconfig
Usage: hyas.config.update [options] <config>
Options:
--help : Display the command usage.
--apikey <apikey> : The HYAS API key string. (default: None)
--perm <perm> : Set the permission level for a user or role on this configuration.
Arguments to this option are ``scope``, ``name``, ``level``:
<scope>: The scope for the permission, either "user" or "role".
<name>: The user/role name depending on scope.
<level>: The $lib.auth.easyperm.level name, or (null) to remove the
permission, which falls back to the config default.
(default: None)
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from HYAS. (default: None)
--name <name> : Rename the configuration. (default: None)
Arguments:
<config> : The name of the configuration to modify.
The command is accessible to users with one or more of the following permissions:
power-ups.hyas.adminpower-ups.hyas.user
hyas.dns.dynamic
Ingest dynamic DNS information from HYAS.
This command takes inet:fqdn, inet:ipv4, or inet:email nodes as input
and queries the HYAS API to retrieve A records and domain creator data.
inet:dns:a nodes are tagged with rep.hyas.dynamic_dns and inet:dns:dynreg nodes
are created to record the domain creator information.
Examples:
// Get dynamic DNS data about an FQDN and yield inet:dns:dynreg nodes
inet:fqdn#test | hyas.dns.dynamic --yield
// Pivot from inet:dns:dynreg to the inet:dns:a nodes
inet:email#test | hyad.dns.dynamic --yield | :fqdn -> inet:dns:a:fqdn
Usage: hyas.dns.dynamic [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size (per-node).
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
Inputs:
inet:email : inet:email nodes
inet:fqdn : inet:fqdn nodes
inet:ipv4 : inet:ipv4 nodes
The command is accessible to users with one or more of the following permissions:
power-ups.hyas.adminpower-ups.hyas.user
hyas.dns.passive
Ingest passive DNS information from HYAS.
This command takes inet:fqdn or inet:ipv4 nodes as input and queries
the HYAS API to retrieve A and AAAA records.
If available in the response, the inet:ipv4/inet:ipv6 nodes will also
have their :asn and :latlong props set.
Examples:
// Get pDNS information about an IP and yield the created inet:dns:a nodes
inet:ipv4=89.117.139.137 | hyas.dns.passive --yield
// Get pDNS information about an FQDN and yield the created inet:dns:a nodes
inet:fqdn=vertex.link | hyas.dns.passive --yield
Usage: hyas.dns.passive [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size (per-node).
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
Inputs:
inet:fqdn : inet:fqdn nodes
inet:ipv4 : inet:ipv4 nodes
inet:ipv6 : inet:ipv6 nodes
The command is accessible to users with one or more of the following permissions:
power-ups.hyas.adminpower-ups.hyas.user
hyas.ssl.certs
Ingest SSL certificates from HYAS.
This command will query the HYAS API using the FQDN, IPv4, or SHA-1 from the inbound node.
If a file:bytes or crypto:x509:cert node is provided the :sha1 property will be used.
The command will yield an inet:tls:servercert node for each result record.
The associated crypto:x509:cert node will be created using Synapse-FileParser and the raw PEM
certificate, however if the service is not available the raw fields in the JSON response will be used.
Examples:
// Enrich an inet:ipv4 node and yield the inet:tls:servercert node
inet:ipv4#myip | hyas.ssl.certs --yield
// Enrich an inet:fqdn node and filter by issued date
inet:fqdn=vertex.link | hyas.ssl.certs --issued (2020, 2022)
Usage: hyas.ssl.certs [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size (per-node).
--yield : Yield the newly created nodes.
--expires <expires> : Filter results by expiration date.
--issued <issued> : Filter results by issue date.
--issuer <issuer> : Filter results by issuer common name.
--subject <subject> : Filter results by subject organization.
--config <config> : Override the default config with the provided name.
Inputs:
crypto:x509:cert : crypto:x509:cert nodes
file:bytes : file:bytes nodes
hash:sha1 : hash:sha1 nodes
inet:fqdn : inet:fqdn nodes
inet:ipv4 : inet:ipv4 nodes
The command is accessible to users with one or more of the following permissions:
power-ups.hyas.adminpower-ups.hyas.user
hyas.whois
Query WHOIS information by domain from HYAS.
This command takes inet:fqdn nodes as input and queries the HYAS API
to create inet:whois:rec and inet:whois:contact nodes. The inet:whois:rec
nodes are linked to inet:email nodes with refs edges. Abuse emails are
recorded as inet:whois:contact nodes with an abuse type (abuse, abuse:1,
...).
Examples:
// Get WHOIS information about a domain and yield the created inet:whois:rec nodes
inet:fqdn=vertex.link | hyas.whois --yield
Usage: hyas.whois [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size (per-node).
--yield : Yield the newly created nodes.
--city <city> : The city of the registrant.
--country <country> : The country of the registrant.
--name <name> : The contact name (registrant, admin, technical, or abuse contact).
--email <email> : The email of the registrant.
--phone <phone> : The phone number of the registrant in e164 format.
--nameserver <nameserver> : The nameserver domain.
--config <config> : Override the default config with the provided name.
Inputs:
inet:fqdn : inet:fqdn nodes
The command is accessible to users with one or more of the following permissions:
power-ups.hyas.adminpower-ups.hyas.user
Storm Modules
This package does not export any Storm APIs.