Package Documentation
Storm Package: synapse-vmray
The following Commands are available from this package. This documentation is generated for version 2.2.1 of the package.
Storm Commands
This package implements the following Storm Commands.
vmray.config.add
Add a Synapse-VMRay configuration.
The baseurl argument is the VMRay Cloud/On Premises URL to forward REST requests to.
Per their documentation, if you're Europe based, use "https://eu.cloud.vmray.com".
If you're US based, use "https://us.cloud.vmray.com". If you use the On Premises
version of VMRay, consult your Administrator for the URL.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Add a global configuration
vmray.config.add default myapikey1234 https://us.cloud.vmray.com
// Add a configuration for the current user
vmray.config.add --scope self myconfig myapikey5678 https://eu.cloud.vmray.com
Usage: vmray.config.add [options] <name> <apikey> <baseurl>
Options:
--help : Display the command usage.
--ssl-noverify : Do not perform SSL/TLS verification.
--proxy <proxy> : Configure the proxy usage. (default: True)
--scope <scope> : Set the scope on the configuration. (default: global, choices: global, self, unscoped)
Arguments:
<name> : A unique name for the configuration.
<apikey> : The VMRay API key string.
<baseurl> : The VMRay API base URL.
The command is accessible to users with one or more of the following permissions:
power-ups.vmray.adminpower-ups.vmray.user
vmray.config.del
Delete a Synapse-VMRay configuration.
Examples:
// Delete the "myconfig" configuration
vmray.config.del myconfig
Usage: vmray.config.del [options] <name>
Options:
--help : Display the command usage.
Arguments:
<name> : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.vmray.adminpower-ups.vmray.user
vmray.config.list
Display the list of Synapse-VMRay configurations you have access to.
Usage: vmray.config.list [options]
Options:
--help : Display the command usage.
The command is accessible to users with one or more of the following permissions:
power-ups.vmray.adminpower-ups.vmray.user
vmray.config.migrate
Migrate options for all Synapse-VMRay configurations.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Disable SSL verification for all configurations
vmray.config.migrate --ssl-verify (false)
// Migrate the base URL for all configurations
vmray.config.migrate --baseurl https://eu.cloud.vmray.com
Usage: vmray.config.migrate [options]
Options:
--help : Display the command usage.
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--baseurl <baseurl> : The VMRay API base URL. (default: None)
The command is accessible to users with one or more of the following permissions:
power-ups.vmray.admin
vmray.config.show
Show the details of a configuration.
Examples:
// Show the in-use configuration for the current user
vmray.config.show
// Show a configuration by name
vmray.config.show myconfig
Usage: vmray.config.show [options] <name>
Options:
--help : Display the command usage.
Arguments:
[name] : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.vmray.adminpower-ups.vmray.user
vmray.config.update
Update the configuration of a defined Synapse-VMRay configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Set the permission level for user "myuser" to "admin" on the "myconfig"
// configuration
vmray.config.update myconfig --perm user myuser admin
// Set the permission level for the "all" role to "deny" on the
// "myconfig" configuration
vmray.config.update myconfig --perm role all deny
// Do not verify the SSL certificate when connecting to "myconfig"
vmray.config.update myconfig --ssl-verify (false)
// Change the base URL of the "myconfig" configuration
vmray.config.update myconfig --baseurl https://eu.cloud.vmray.com
// Change the name of the "myconfig" configuration to "otherconfig"
vmray.config.update myconfig --name otherconfig
Usage: vmray.config.update [options] <config>
Options:
--help : Display the command usage.
--apikey <apikey> : The VMRay API key string. (default: None)
--baseurl <baseurl> : The VMRay API base URL. (default: None)
--perm <perm> : Set the permission level for a user or role on this configuration.
Arguments to this option are ``scope``, ``name``, ``level``:
<scope>: The scope for the permission, either "user" or "role".
<name>: The user/role name depending on scope.
<level>: The $lib.auth.easyperm.level name, or (null) to remove the
permission, which falls back to the config default.
(default: None)
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--name <name> : Rename the configuration. (default: None)
Arguments:
<config> : The name of the configuration to modify.
The command is accessible to users with one or more of the following permissions:
power-ups.vmray.adminpower-ups.vmray.user
vmray.sample.iocs
Retrieve the IOCs from the VMRay IOC samples endpoint.
The IOCs that can be pulled back are files, filenames, mutexes, registry data, urls,
domains, IP addresses, emails, email addresses, and processes.
Can take as input a file:bytes/hash* node, or retrieve a sample directly by id using
the --id parameter
Examples:
// Retrieve all the IOCs associated with all the files tagged with cno.tag
file:bytes#cno.tag | vmray.sample.iocs --yield
// Retrieve an IOC report for a specific VMRay sample ID, bypassing caching
vmray.sample.iocs --id 95248 --yield --asof now | limit 10
Usage: vmray.sample.iocs [options]
Options:
--help : Display the command usage.
--id <id> : A VMRay sample ID to query for
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size (per-node).
--yield : Yield the newly created nodes.
--asof <asof> : Specify the maximum age for a cached result. To disable caching, use --asof now.
(default: -30days)
--config <config> : Override the default config with the provided name.
--severity <severity> : Filter IOC results to one of VMRay's verdicts (malicious, suspicious, clean, or null)
--type <type> : Filter results by IOC type (files/mutexes/emails/etc), or return everything if not
specified.
Inputs:
file:bytes : Retrieve VMRay IOCs for a file:bytes node
hash:md5 : Retrieve VMRay IOCs for a hash:md5 node
hash:sha1 : Retrieve VMRay IOCs for a hash:sha1 node
hash:sha256 : Retrieve VMRay IOCs for a hash:sha256 node
hash:sha512 : Retrieve VMRay IOCs for a hash:sha512 node
inet:fqdn : Retrieve VMRay IOCs for an inet:fqdn node
inet:url : Retrieve VMRay IOCs for an inet:url node
The command is accessible to users with one or more of the following permissions:
power-ups.vmray.adminpower-ups.vmray.user
vmray.sample.mitre
Retrieve the Mitre ATT&CK techniques for a given sample.
Can take as input a file:bytes/hash* node, or retrieve a sample directly by id using
the --id parameter
Examples:
// Retrieve all the MITRE ATT&CK techniques associated with a set of binaries
file:bytes#interesting.files | vmray.sample.mitre --yield
// Retrieve all the MITRE ATT&CK techniques for a specific VMRay sample ID
vmray.sample.mitre --id 280013
Usage: vmray.sample.mitre [options]
Options:
--help : Display the command usage.
--id <id> : A VMRay sample ID to query for
--debug : Show verbose debug output.
--yield : Yield the newly created nodes.
--size <size> : Limit the number of results ingested to the given size (per-node).
--asof <asof> : Specify the maximum age for a cached result. To disable caching, use --asof now.
(default: -30days)
--config <config> : Override the default config with the provided name.
Inputs:
file:bytes : Retrieve the Mitre ATT&CK indicators about a file:bytes node
The command is accessible to users with one or more of the following permissions:
power-ups.vmray.adminpower-ups.vmray.user
vmray.sample.submit
Submit the full bytes for a file to VMRay for analysis. The file must live in the configured Axon.
Examples:
// Submit a single file to VMRay for analysis.
file:bytes | vmray.sample.submit --size 1
Usage: vmray.sample.submit [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--passwd <passwd> : A password to hand to VMRay for extracting an already encrypted or password-protected
archive or document.
--archive-action <archive_action>: Tell VMRay how to deal with archive files. "sample" for treating as singular sample,
"compound_sample" to run multiple files as one sample, and "separate_samples" to treat
every file in an archive as a separate sample.
--static-only : Only run static analysis on the sample, not static and dynamic.
--config <config> : Override the default config with the provided name.
Inputs:
file:bytes : Submit a file:bytes that has bytes in the configured Axon to VMRay for analysis.
hash:sha256 : Submit a hash:sha256 that has bytes in the configured Axon to VMRay for analysis.
The command is accessible to users with one or more of the following permissions:
power-ups.vmray.adminpower-ups.vmray.submitter
vmray.sample.vtis
Retrieve the VMRay Threat Identifiers for a given sample.
Can take as input a file:bytes/hash* node, or retrieve a sample directly by id using
the --id parameter
Examples:
// Retrieve all the VMRay Threat Identifiers for a set of hashes
hash:sha1#my.cool.tag | vmray.sample.vtis --yield
// Retrieve the VMRay Threat identifiers for a specific sample ID
vmray.sample.vtis --id 57293 --yield
Usage: vmray.sample.vtis [options]
Options:
--help : Display the command usage.
--id <id> : A VMRay sample ID to query for
--debug : Show verbose debug output.
--yield : Yield the newly created nodes.
--size <size> : Limit the number of results ingested to the given size (per-node).
--asof <asof> : Specify the maximum age for a cached result. To disable caching, use --asof now.
(default: -30days)
--config <config> : Override the default config with the provided name.
Inputs:
file:bytes : Retrieve VMRay Threat Identifiers about a file:bytes node
inet:fqdn : Retrieve VMRay Threat Identifiers about an inet:fqdn node
inet:url : Retrieve VMRay Threat Identifiers about an inet:url node
The command is accessible to users with one or more of the following permissions:
power-ups.vmray.adminpower-ups.vmray.user
Storm Modules
This package does not export any Storm APIs.