Package Documentation
Storm Package: synapse-hybridanalysis
The following Commands are available from this package. This documentation is generated for version 4.0.0 of the package.
Storm Commands
This package implements the following Storm Commands.
hybridanalysis.config.add
Add a Synapse-HybridAnalysis configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Add a global configuration
hybridanalysis.config.add default myapikey1234
// Add a configuration for the current user
hybridanalysis.config.add --scope self myconfig myapikey5678
Usage: hybridanalysis.config.add [options] <name> <apikey>
Options:
--help : Display the command usage.
--ssl-noverify : Do not perform SSL/TLS verification.
--proxy <proxy> : Configure the proxy usage. (default: True)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from Hybrid Analysis. (default:
rep.hybridanalysis)
--scope <scope> : Set the scope on the configuration. (default: global, choices: global, self, unscoped)
Arguments:
<name> : A unique name for the configuration.
<apikey> : The Hybrid Analysis API key string.
The command is accessible to users with one or more of the following permissions:
power-ups.hybridanalysis.adminpower-ups.hybridanalysis.user
hybridanalysis.config.del
Delete a Synapse-HybridAnalysis configuration.
Examples:
// Delete the "myconfig" configuration
hybridanalysis.config.del myconfig
Usage: hybridanalysis.config.del [options] <name>
Options:
--help : Display the command usage.
Arguments:
<name> : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.hybridanalysis.adminpower-ups.hybridanalysis.user
hybridanalysis.config.list
Display the list of Synapse-HybridAnalysis configurations you have access to.
Usage: hybridanalysis.config.list [options]
Options:
--help : Display the command usage.
The command is accessible to users with one or more of the following permissions:
power-ups.hybridanalysis.adminpower-ups.hybridanalysis.user
hybridanalysis.config.migrate
Migrate options for all Synapse-HybridAnalysis configurations.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Migrate the tag prefix for all configurations
hybridanalysis.config.migrate --tag-prefix my.tagpref
Usage: hybridanalysis.config.migrate [options]
Options:
--help : Display the command usage.
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from Hybrid Analysis. (default: None)
The command is accessible to users with one or more of the following permissions:
power-ups.hybridanalysis.admin
hybridanalysis.config.show
Show the details of a configuration.
Examples:
// Show the in-use configuration for the current user
hybridanalysis.config.show
// Show a configuration by name
hybridanalysis.config.show myconfig
Usage: hybridanalysis.config.show [options] <name>
Options:
--help : Display the command usage.
Arguments:
[name] : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.hybridanalysis.adminpower-ups.hybridanalysis.user
hybridanalysis.config.update
Update the configuration of a defined Synapse-HybridAnalysis configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Set the permission level for user "myuser" to "admin" on the "myconfig"
// configuration
hybridanalysis.config.update myconfig --perm user myuser admin
// Set the permission level for the "all" role to "deny" on the
// "myconfig" configuration
hybridanalysis.config.update myconfig --perm role all deny
// Do not verify the SSL certificate when connecting to "myconfig"
hybridanalysis.config.update myconfig --ssl-verify (false)
// Change the tag prefix used by the "myconfig" configuration
hybridanalysis.config.update myconfig --tag-prefix my.prefix
// Change the name of the "myconfig" configuration to "otherconfig"
hybridanalysis.config.update myconfig --name otherconfig
Usage: hybridanalysis.config.update [options] <config>
Options:
--help : Display the command usage.
--apikey <apikey> : The Hybrid Analysis API key string. (default: None)
--perm <perm> : Set the permission level for a user or role on this configuration.
Arguments to this option are ``scope``, ``name``, ``level``:
<scope>: The scope for the permission, either "user" or "role".
<name>: The user/role name depending on scope.
<level>: The $lib.auth.easyperm.level name, or (null) to remove the
permission, which falls back to the config default.
(default: None)
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from Hybrid Analysis. (default: None)
--name <name> : Rename the configuration. (default: None)
Arguments:
<config> : The name of the configuration to modify.
The command is accessible to users with one or more of the following permissions:
power-ups.hybridanalysis.adminpower-ups.hybridanalysis.user
hybridanalysis.overview
Query the Hybrid Analysis API overview endpoint by SHA-256.
Examples:
// Query by hash and yield file:bytes node
hash:sha256#foo | hybridanalysis.overview --yield
// Query by file:bytes SHA-256
file:bytes#foo | hybridanalysis.overview
// Query by file:bytes and pivot to it:av:scan:result
file:bytes#foo | hybridanalysis.overview | -> it:av:scan:result
// Do not add Hybrid Analysis tags to file:bytes node
file:bytes#foo | hybridanalysis.overview --no-tags
Usage: hybridanalysis.overview [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--yield : Yield the newly created nodes.
--no-tags : Construct nodes but do not record tags returned by the Hybrid Analysis API.
--config <config> : Override the default config with the provided name.
Inputs:
file:bytes : Query overview API by SHA-256
hash:sha256 : Query overview API by SHA-256
The command is accessible to users with one or more of the following permissions:
power-ups.hybridanalysis.adminpower-ups.hybridanalysis.user
hybridanalysis.reportsummary
Query the Hybrid Analysis API for report summaries by a file:bytes or hash form.
Note: it:mitre:attack:technique nodes for the techniques used by a file will
be linked with -(uses)> edges from the file:bytes node.
Examples:
// Query by hash and yield it:exec:proc nodes
hash:md5#foo | hybridanalysis.reportsummary --yield
// Query by SHA-256, MD5, or SHA-1 from a file:bytes node
file:bytes#foo | hybridanalysis.reportsummary --yield
Usage: hybridanalysis.reportsummary [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size (per-node).
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
Inputs:
file:bytes : Query report summaries by SHA-256, MD5, or SHA-1
hash:md5 : Query report summaries by MD5
hash:sha1 : Query report summaries by SHA-1
hash:sha256 : Query report summaries by SHA-256
The command is accessible to users with one or more of the following permissions:
power-ups.hybridanalysis.adminpower-ups.hybridanalysis.user
hybridanalysis.samples
Download sample files from the Hybrid Analysis API overview endpoint by SHA-256.
The response is saved directly to the Axon, and is typically a gzip of the actual file
represented by the input SHA-256.
Examples:
// Query by hash and yield file:bytes node
hash:sha256#foo | hybridanalysis.samples --yield
// Query by file:bytes SHA-256
file:bytes#foo | hybridanalysis.samples
// Extract gzip sample using Synapse-FileParser and pivot
hash:sha256#foo | hybridanalysis.samples --yield | fileparser.parse
| -> file:subfile :child -> file:bytes
Usage: hybridanalysis.samples [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
Inputs:
file:bytes : Download sample file by SHA-256
hash:sha256 : Download sample file by SHA-256
The command is accessible to users with one or more of the following permissions:
power-ups.hybridanalysis.adminpower-ups.hybridanalysis.user
Storm Modules
This package does not export any Storm APIs.