Admin Guide

Synapse-ReversingLabs Admin Guide

Configuration

Synapse-ReversingLabs requires a ReversingLabs API key. For information on how to sign up, please visit the ReversingLabs website.

Each configuration requires the base URL of your ReversingLabs A1000 appliance.

Setting API key for global use

To set-up a global API key:

> reversinglabs.config.add default myapikey "https://example.reversinglabs.com"
Synapse-ReversingLabs config "default" added

Creating a configuration for role-based use

Add an unscoped configuration:

> reversinglabs.config.add myunscoped myapikey "https://example.reversinglabs.com" --scope unscoped
Synapse-ReversingLabs config "myunscoped" added

Grant another user admin permissions to the new configuration:

> reversinglabs.config.update myunscoped --perm user visi admin
Updated Synapse-ReversingLabs config "myunscoped"

Grant a role read permissions to the new configuration:

> reversinglabs.config.update myunscoped --perm role ninjas read
Updated Synapse-ReversingLabs config "myunscoped"

Users may select a configuration other than their default by passing --config <name> to the Synapse-ReversingLabs commands.

Setting the API base URL

The base URL may be changed per configuration using the --baseurl option to reversinglabs.config.update, or for all configurations using reversinglabs.config.migrate:

> reversinglabs.config.migrate --baseurl "https://example.reversinglabs.com"
Updated Synapse-ReversingLabs config "synapse-reversinglabs:default"
Updated Synapse-ReversingLabs config "synapse-reversinglabs:myunscoped"

To disable SSL verification for a configuration:

> reversinglabs.config.update default --ssl-verify (false)
Updated Synapse-ReversingLabs config "default"

Setting the tag prefix

The tag prefix applied to nodes defaults to rep.revlabs. It may be changed per configuration using the --tag-prefix option to reversinglabs.config.update:

> reversinglabs.config.update default --tag-prefix rep.rl
Updated Synapse-ReversingLabs config "default"

Overriding the proxy configuration

In order to override the default proxy configuration in the Cortex the user must have the power-ups.reversinglabs.admin or storm.lib.inet.http.proxy permission.

When the proxy configuration is set to (false) or a URL the permission will be checked when a configuration is created/updated, and when it is used to make an HTTP request.

To configure a proxy for all configurations:

> reversinglabs.config.migrate --proxy "https://example.proxy.com"
Updated Synapse-ReversingLabs config "synapse-reversinglabs:default"
Updated Synapse-ReversingLabs config "synapse-reversinglabs:myunscoped"

To disable any proxy settings including disabling any Cortex proxy settings:

> reversinglabs.config.migrate --proxy (false)
Updated Synapse-ReversingLabs config "synapse-reversinglabs:default"
Updated Synapse-ReversingLabs config "synapse-reversinglabs:myunscoped"

To use the Cortex proxy settings:

> reversinglabs.config.migrate --proxy (true)
Updated Synapse-ReversingLabs config "synapse-reversinglabs:default"
Updated Synapse-ReversingLabs config "synapse-reversinglabs:myunscoped"

Background submissions

Files queued for background processing are fetched by a Storm Dmon using the configuration that was selected when the file was queued.

Dependencies

Synapse-ReversingLabs requires the following Power-Ups to be installed:

Name   : synapse-fileparser
Version: >=4.2.1,<5.0.0
Desc   : Synapse-FileParser is needed to download extracted files for all reversinglabs.a1000.* commands.

Permissions

Package (synapse-reversinglabs) defines the following permissions:
power-ups.reversinglabs.user     : Controls user access to Synapse-ReversingLabs. ( default: false )
power-ups.reversinglabs.admin    : Controls access to Synapse-ReversingLabs admin options. ( default: false )

You may add rules to users/roles directly from storm:

> auth.user.addrule visi power-ups.reversinglabs.user
Added rule power-ups.reversinglabs.user to user visi.

or:

> auth.role.addrule ninjas power-ups.reversinglabs.user
Added rule power-ups.reversinglabs.user to role ninjas.

Exported APIs

Synapse-ReversingLabs does not currently export any APIs.

Workflows

Synapse-ReversingLabs provides the following workflows in Optic:

Title: Configuration

The Configuration workflow may be used to manage Synapse-ReversingLabs configurations from Optic.

Node Actions

Synapse-ReversingLabs provides the following node actions in Optic:

Name : reversinglabs.a1000.enrich
Desc : Enrich nodes using Synapse-ReversingLabs
Forms: file:bytes, hash:md5, hash:sha1, hash:sha256, hash:512

Name : reversinglabs.a1000.download
Desc : Download the bytes for the file from ReversingLabs
Forms: file:bytes, hash:sha256

Name : reversinglabs.a1000.submit
Desc : Submit a file for analysis to ReversingLabs
Forms: file:bytes, hash:sha256

Onload Events

Synapse-ReversingLabs uses an onload event to create a Storm Dmon used by reversinglabs.a1000.submit for submitting files in the background.