Admin Guide

Synapse-VMRay Admin Guide

Configuration

Synapse-VMRay requires a VMRay API key. For information on how to sign up, please visit the VMRay API documentation.

Each configuration requires the VMRay API base URL. If you’re Europe based, use https://eu.cloud.vmray.com. If you’re US based, use https://us.cloud.vmray.com. If you use the On Premises version of VMRay, consult your Administrator for the URL.

Setting API key for global use

To set-up a global API key:

> vmray.config.add default myapikey "https://eu.cloud.vmray.com"
Synapse-VMRay config "default" added

Creating a configuration for role-based use

Add an unscoped configuration:

> vmray.config.add myunscoped myapikey "https://us.cloud.vmray.com" --scope unscoped
Synapse-VMRay config "myunscoped" added

Grant another user admin permissions to the new configuration:

> vmray.config.update myunscoped --perm user visi admin
Updated Synapse-VMRay config "myunscoped"

Grant a role read permissions to the new configuration:

> vmray.config.update myunscoped --perm role ninjas read
Updated Synapse-VMRay config "myunscoped"

Users may select a configuration other than their default by passing --config <name> to the Synapse-VMRay commands.

Setting the API base URL

The base URL may be changed per configuration using the --baseurl option to vmray.config.update, or for all configurations using vmray.config.migrate:

> vmray.config.migrate --baseurl "https://us.cloud.vmray.com"
Updated Synapse-VMRay config "synapse-vmray:myunscoped"

Overriding the proxy configuration

In order to override the default proxy configuration in the Cortex the user must have the power-ups.vmray.admin or storm.lib.inet.http.proxy permission.

When the proxy configuration is set to (false) or a URL the permission will be checked when a configuration is created/updated, and when it is used to make an HTTP request.

Permissions

Package (synapse-vmray) defines the following permissions:
power-ups.vmray.user             : Controls user access to Synapse-VMRay. ( default: false )
power-ups.vmray.submitter        : Controls user access to submitting files to VMRay from Synapse-VMRay. Requires power-ups.vmray.user. ( default: false )
power-ups.vmray.admin            : Controls access to Synapse-VMRay admin options. ( default: false )

You may add rules to users/roles directly from storm:

> auth.user.addrule visi power-ups.vmray.user
Added rule power-ups.vmray.user to user visi.

or:

> auth.role.addrule ninjas power-ups.vmray.user
Added rule power-ups.vmray.user to role ninjas.

Exported APIs

Synapse-VMRay does not currently export any APIs.

Workflows

Synapse-VMRay provides the following workflows in Optic:

Title: Configuration

The Configuration workflow may be used to manage Synapse-VMRay configurations from Optic.

Node Actions

Synapse-VMRay provides the following node actions in Optic:

Name : vmray.sample.iocs
Desc : Fetch IOCs for a file/hash/url/fqdn
Forms: file:bytes, hash:sha256, hash:sha1, hash:md5, inet:url, inet:fqdn

Name : vmray.sample.mitre
Desc : Populate MITRE ATT&CK Techniques for a file/hash
Forms: file:bytes, hash:sha256, hash:sha1, hash:md5

Name : vmray.sample.vtis
Desc : Download the VMRay Threat Identifiers for a file/hash/url/fqdn
Forms: file:bytes, hash:sha256, hash:sha1, hash:md5, inet:url, inet:fqdn

Name : vmray.sample.submit
Desc : Submit a file:bytes to VMRay for analysis.
Forms: file:bytes, hash:sha256

On-demand Migrations

AV Hit Migration

The previously available migrateAvHit() function in the vmray module has been deprecated. It does not perform any migrations and will simply print a warning message indicating that the it:av:filehit migration is now automatic.