Package Documentation
Storm Package: synapse-reversinglabs
The following Commands are available from this package. This documentation is generated for version 2.0.0 of the package.
Storm Commands
This package implements the following Storm Commands.
reversinglabs.a1000.download
Download the bytes for a sample in the configured Axon
Examples:
// Download all files tagged with "my.files" to the configured Axon, yielding the created file:bytes nodes
file:bytes#my.files | reversinglabs.a1000.download --yield
// Download the bytes for the file c1d31b2af2f8ce75364b3952f0b0aa0b, and the bytes for any extracted file
// automatically making file:subfile relationships
hash:md5=c1d31b2af2f8ce75364b3952f0b0aa0b | reversinglabs.a1000.download --all
Usage: reversinglabs.a1000.download [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--yield : Yield the newly created nodes.
--size <size> : Limit the number of results ingested to the given size (per-node).
--config <config> : Override the default config with the provided name.
--all : Download the bytes for any extracted files to the configured Axon and create
file:subfile relations.
--fetch : Pull the bytes for the file from TICloud into the configred Axon and Reversing Labs
Appliance.
The command is accessible to users with one or more of the following permissions:
power-ups.reversinglabs.adminpower-ups.reversinglabs.user
reversinglabs.a1000.enrich
Retrieve the static analysis report for a given hash, optionally downloading the bytes for the file
and any extracted files into the configured Axon as well.
Examples:
// Enrich a set of 10 file:bytes nodes.
file:bytes | reversinglabs.a1000.enrich --size 10
// Enrich a hash:sha512 node and download the bytes for the file and any extracted files
// into the configured Axon.
hash:sha512#re.analysis.todo | reversinglabs.a1000.enrich --download
Usage: reversinglabs.a1000.enrich [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
--asof <asof> : Specify the maximum age for a cached result. To disable caching, use --asof now.
(default: -30days)
--download : Download the corresponding bytes for the input nodes, and any extracted files, to the
configured Axon.
Inputs:
file:bytes : file:bytes nodes
hash:md5 : hash:md5 nodes
hash:sha1 : hash:sha1 nodes
hash:sha256 : hash:sha256 nodes
hash:sha512 : hash:sha512 nodes
The command is accessible to users with one or more of the following permissions:
power-ups.reversinglabs.adminpower-ups.reversinglabs.user
reversinglabs.a1000.submit
Submit a file from the configured Axon for analysis for ReversingLabs.
More detailed description talking about what kind of input the command takes
and what it does with it.
Examples:
// Submit all the files tagged with "my.files" to ReversingLabs' static analysis engine and pend on results
file:bytes#my.files | reversinglabs.a1000.submit
// Pend on results for submitting a single file to ReversingLabs,
// but only run the rl_cloud_sandbox environment
file:bytes=000032e7dc30e978e162553189d863915936d7c8e94788ac753e2785164b5f77 | reversinglabs.a1000.submit --sandboxes rl_cloud_sandbox
// Submit all the files tagged with "to.do" and do not pend on retrieving results
file:bytes#to.do | reversinglabs.a1000.submit --background --yield
// Submit a set of files and run them through the third party AV scanners ReversingLabs has
file:bytes#to.do | reversinglabs.a1000.submit --scanners --background
// Submit a set of files to both cloud processing and the third party AV scanners
file:bytes#my.files | reversinglabs.a1000.submit --scanners --sandboxes rl_cloud_sandbox --background
Usage: reversinglabs.a1000.submit [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size (per-node).
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
--download : Also download the bytes for all the extracted files to the configured Axon.
--background : Block on waiting for analysis to finish.
--sandboxes [<sandboxes> ...]: Additionally submit the sample to the cloud sandboxes for analysis. Currently supported
values are "cloud" and "rl_cloud_sandbox"
--scanners : Additionally submit the sample to the multiple AV scanners ReversingLabs has.
Inputs:
file:bytes : file:bytes nodes
hash:sha256 : hash:sha256 nodes
The command is accessible to users with one or more of the following permissions:
power-ups.reversinglabs.adminpower-ups.reversinglabs.user
reversinglabs.config.add
Add a Synapse-ReversingLabs configuration.
The baseurl argument is the URL of the ReversingLabs A1000 appliance to forward
API requests to.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Add a global configuration
reversinglabs.config.add default myapikey1234 https://a1000-example.reversinglabs.com
// Add a configuration for the current user
reversinglabs.config.add --scope self myconfig myapikey5678 https://a1000-example.my-private-cloud.com
Usage: reversinglabs.config.add [options] <name> <apikey> <baseurl>
Options:
--help : Display the command usage.
--ssl-noverify : Do not perform SSL/TLS verification.
--proxy <proxy> : Configure the proxy usage. (default: True)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from ReversingLabs. (default: rep.revlabs)
--scope <scope> : Set the scope on the configuration. (default: global, choices: global, self, unscoped)
Arguments:
<name> : A unique name for the configuration.
<apikey> : The ReversingLabs API key string.
<baseurl> : The ReversingLabs API base URL.
The command is accessible to users with one or more of the following permissions:
power-ups.reversinglabs.adminpower-ups.reversinglabs.user
reversinglabs.config.del
Delete a Synapse-ReversingLabs configuration.
Examples:
// Delete the "myconfig" configuration
reversinglabs.config.del myconfig
Usage: reversinglabs.config.del [options] <name>
Options:
--help : Display the command usage.
Arguments:
<name> : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.reversinglabs.adminpower-ups.reversinglabs.user
reversinglabs.config.list
Display the list of Synapse-ReversingLabs configurations you have access to.
Usage: reversinglabs.config.list [options]
Options:
--help : Display the command usage.
The command is accessible to users with one or more of the following permissions:
power-ups.reversinglabs.adminpower-ups.reversinglabs.user
reversinglabs.config.migrate
Migrate options for all Synapse-ReversingLabs configurations.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Disable SSL verification for all configurations
reversinglabs.config.migrate --ssl-verify (false)
// Migrate the base URL for all configurations
reversinglabs.config.migrate --baseurl https://a1000-example.reversinglabs.com
// Migrate the tag prefix for all configurations
reversinglabs.config.migrate --tag-prefix rep.rl
Usage: reversinglabs.config.migrate [options]
Options:
--help : Display the command usage.
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--baseurl <baseurl> : The ReversingLabs API base URL. (default: None)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from ReversingLabs. (default: None)
The command is accessible to users with one or more of the following permissions:
power-ups.reversinglabs.admin
reversinglabs.config.show
Show the details of a configuration.
Examples:
// Show the in-use configuration for the current user
reversinglabs.config.show
// Show a configuration by name
reversinglabs.config.show myconfig
Usage: reversinglabs.config.show [options] <name>
Options:
--help : Display the command usage.
Arguments:
[name] : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.reversinglabs.adminpower-ups.reversinglabs.user
reversinglabs.config.update
Update the configuration of a defined Synapse-ReversingLabs configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Set the permission level for user "myuser" to "admin" on the "myconfig"
// configuration
reversinglabs.config.update myconfig --perm user myuser admin
// Set the permission level for the "all" role to "deny" on the
// "myconfig" configuration
reversinglabs.config.update myconfig --perm role all deny
// Do not verify the SSL certificate when connecting to "myconfig"
reversinglabs.config.update myconfig --ssl-verify (false)
// Change the base URL of the "myconfig" configuration
reversinglabs.config.update myconfig --baseurl https://a1000-example.reversinglabs.com
// Change the tag prefix of the "myconfig" configuration
reversinglabs.config.update myconfig --tag-prefix rep.rl
// Change the name of the "myconfig" configuration to "otherconfig"
reversinglabs.config.update myconfig --name otherconfig
Usage: reversinglabs.config.update [options] <config>
Options:
--help : Display the command usage.
--apikey <apikey> : The ReversingLabs API key string. (default: None)
--baseurl <baseurl> : The ReversingLabs API base URL. (default: None)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from ReversingLabs. (default: None)
--perm <perm> : Set the permission level for a user or role on this configuration.
Arguments to this option are ``scope``, ``name``, ``level``:
<scope>: The scope for the permission, either "user" or "role".
<name>: The user/role name depending on scope.
<level>: The $lib.auth.easyperm.level name, or (null) to remove the
permission, which falls back to the config default.
(default: None)
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--name <name> : Rename the configuration. (default: None)
Arguments:
<config> : The name of the configuration to modify.
The command is accessible to users with one or more of the following permissions:
power-ups.reversinglabs.adminpower-ups.reversinglabs.user
Storm Modules
This package does not export any Storm APIs.