Admin Guide

Synapse-HybridAnalysis Admin Guide

Configuration

Synapse-HybridAnalysis requires a Hybrid Analysis API key. For information on how to signup, please visit the Hybrid Analysis API documentation.

Setting API key for global use

To set-up a global API key:

> hybridanalysis.config.add default myapikey
Synapse-HybridAnalysis config "default" added

Creating a configuration for role-based use

Add an unscoped configuration:

> hybridanalysis.config.add myunscoped myapikey --scope unscoped
Synapse-HybridAnalysis config "myunscoped" added

Grant another user admin permissions to the new configuration:

> hybridanalysis.config.update myunscoped --perm user visi admin
Updated Synapse-HybridAnalysis config "myunscoped"

Grant a role read permissions to the new configuration:

> hybridanalysis.config.update myunscoped --perm role ninjas read
Updated Synapse-HybridAnalysis config "myunscoped"

Users may select a configuration other than their default by passing --config <name> to the Synapse-HybridAnalysis commands.

Setting the tag prefix

The tag prefix used when recording data from Hybrid Analysis defaults to rep.hybridanalysis. It may be set per configuration using the --tag-prefix option to hybridanalysis.config.add or hybridanalysis.config.update, or for all configurations using hybridanalysis.config.migrate:

> hybridanalysis.config.migrate --tag-prefix my.prefix
Updated Synapse-HybridAnalysis config "synapse-hybridanalysis:myunscoped"

Overriding the proxy configuration

In order to override the default proxy configuration in the Cortex the user must have the power-ups.hybridanalysis.admin or storm.lib.inet.http.proxy permission.

When the proxy configuration is set to (false) or a URL the permission will be checked when a configuration is created/updated, and when it is used to make an HTTP request.

Permissions

Package (synapse-hybridanalysis) defines the following permissions:
power-ups.hybridanalysis.user    : Allows a user to issue queries to the Hybrid Analysis API. ( default: false )
power-ups.hybridanalysis.admin   : Controls access to Synapse-HybridAnalysis admin options. ( default: false )

You may add rules to users/roles directly from storm:

> auth.user.addrule visi power-ups.hybridanalysis.user
Added rule power-ups.hybridanalysis.user to user visi.

or:

> auth.role.addrule ninjas power-ups.hybridanalysis.user
Added rule power-ups.hybridanalysis.user to role ninjas.

Exported APIs

Synapse-HybridAnalysis does not currently export any APIs.

Workflows

Synapse-HybridAnalysis provides the following workflows in Optic:

Title: Configuration

The Configuration workflow may be used to manage Synapse-HybridAnalysis configurations from Optic.

Node Actions

Synapse-HybridAnalysis provides the following node actions in Optic:

Name : overview
Desc : Query Hybrid Analysis overview API by SHA-256
Forms: file:bytes, hash:sha256

Name : download sample
Desc : Download sample file from Hybrid Analysis API by SHA-256
Forms: file:bytes, hash:sha256

Name : report summary
Desc : Query Hybrid Analysis report summaries by hash
Forms: file:bytes, hash:md5, hash:sha1, hash:sha256

On-demand Migrations

AV Hit Migration

The previously available migrateAvHit() function in the hybridanalysis module has been deprecated. It does not perform any migrations and will simply print a warning message indicating that the it:av:filehit migration is now automatic.