Package Documentation
Storm Package: synapse-vxintel
The following Commands are available from this package. This documentation is generated for version 4.0.0 of the package.
Storm Commands
This package implements the following Storm Commands.
vxintel.avreport
Ingest the AV reports for a particular file/hash from the VXIntel API.
Examples:
// Enrich a file and ingest the various AV reports for a set of files
file:bytes#my.cool.tag | vxintel.avreport --yield
// Download the AV report for an specifc hash, but still return the input node
hash:sha1=b71215c99256a683a589620d98cdebb14b1d1ab0 | vxintel.avreport
Usage: vxintel.avreport [options]
Options:
--help : Display the command usage.
--yield : Yield the newly created it:av:scan:result nodes.
--debug : Print debugging messages.
--config <config> : Override the default config with the provided name.
Inputs:
file:bytes : file:bytes nodes
hash:md5 : hash:md5 nodes
hash:sha1 : hash:sha1 nodes
hash:sha256 : hash:sha256 nodes
The command is accessible to users with one or more of the following permissions:
power-ups.vxintel.adminpower-ups.vxintel.user
vxintel.config.add
Add a Synapse-VXIntel configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Add a global configuration
vxintel.config.add default myapikey1234
// Add a configuration for the current user
vxintel.config.add --scope self myconfig myapikey5678
Usage: vxintel.config.add [options] <name> <apikey>
Options:
--help : Display the command usage.
--ssl-noverify : Do not perform SSL/TLS verification.
--proxy <proxy> : Configure the proxy usage. (default: True)
--scope <scope> : Set the scope on the configuration. (default: global, choices: global, self, unscoped)
Arguments:
<name> : A unique name for the configuration.
<apikey> : The VXIntel API key string.
The command is accessible to users with one or more of the following permissions:
power-ups.vxintel.adminpower-ups.vxintel.user
vxintel.config.del
Delete a Synapse-VXIntel configuration.
Examples:
// Delete the "myconfig" configuration
vxintel.config.del myconfig
Usage: vxintel.config.del [options] <name>
Options:
--help : Display the command usage.
Arguments:
<name> : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.vxintel.adminpower-ups.vxintel.user
vxintel.config.list
Display the list of Synapse-VXIntel configurations you have access to.
Usage: vxintel.config.list [options]
Options:
--help : Display the command usage.
The command is accessible to users with one or more of the following permissions:
power-ups.vxintel.adminpower-ups.vxintel.user
vxintel.config.migrate
Migrate options for all Synapse-VXIntel configurations.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Disable SSL verification for all configurations
vxintel.config.migrate --ssl-verify (false)
Usage: vxintel.config.migrate [options]
Options:
--help : Display the command usage.
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
The command is accessible to users with one or more of the following permissions:
power-ups.vxintel.admin
vxintel.config.show
Show the details of a configuration.
Examples:
// Show the in-use configuration for the current user
vxintel.config.show
// Show a configuration by name
vxintel.config.show myconfig
Usage: vxintel.config.show [options] <name>
Options:
--help : Display the command usage.
Arguments:
[name] : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.vxintel.adminpower-ups.vxintel.user
vxintel.config.update
Update the configuration of a defined Synapse-VXIntel configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Set the permission level for user "myuser" to "admin" on the "myconfig"
// configuration
vxintel.config.update myconfig --perm user myuser admin
// Set the permission level for the "all" role to "deny" on the
// "myconfig" configuration
vxintel.config.update myconfig --perm role all deny
// Do not verify the SSL certificate when connecting to "myconfig"
vxintel.config.update myconfig --ssl-verify (false)
// Change the name of the "myconfig" configuration to "otherconfig"
vxintel.config.update myconfig --name otherconfig
Usage: vxintel.config.update [options] <config>
Options:
--help : Display the command usage.
--apikey <apikey> : The VXIntel API key string. (default: None)
--perm <perm> : Set the permission level for a user or role on this configuration.
Arguments to this option are ``scope``, ``name``, ``level``:
<scope>: The scope for the permission, either "user" or "role".
<name>: The user/role name depending on scope.
<level>: The $lib.auth.easyperm.level name, or (null) to remove the
permission, which falls back to the config default.
(default: None)
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--name <name> : Rename the configuration. (default: None)
Arguments:
<config> : The name of the configuration to modify.
The command is accessible to users with one or more of the following permissions:
power-ups.vxintel.adminpower-ups.vxintel.user
vxintel.details
Enrich inbound file or hash nodes.
Examples:
// Download the details report for a set of files
file:bytes#my.cool.tag | vxintel.details
// Download the details report for an specifc hash
hash:sha1=b71215c99256a683a589620d98cdebb14b1d1ab0 | vxintel.details
Usage: vxintel.details [options]
Options:
--help : Display the command usage.
--yield : Yield the newly created nodes.
--debug : Print debugging messages.
--config <config> : Override the default config with the provided name.
Inputs:
file:bytes : file:bytes nodes
hash:md5 : hash:md5 nodes
hash:sha1 : hash:sha1 nodes
hash:sha256 : hash:sha256 nodes
The command is accessible to users with one or more of the following permissions:
power-ups.vxintel.adminpower-ups.vxintel.user
vxintel.download
Download the bytes for the inbound file or hash nodes.
Examples:
// Download the bytes for a file specified by a hash:md5 node
hash:md5#myhash | vxintel.download
// Download bytes, bypassing cache and yielding the produced file:bytes node
hash:md5#myhash | vxintel.download --yield --asof now
Usage: vxintel.download [options]
Options:
--help : Display the command usage.
--yield : Yield the newly created nodes.
--asof <asof> : Specify the maximum age for a cached result. To disable caching, use --asof now.
(default: -30days)
--debug : Print debugging messages.
--config <config> : Override the default config with the provided name.
Inputs:
file:bytes : file:bytes nodes
hash:md5 : hash:md5 nodes
hash:sha1 : hash:sha1 nodes
hash:sha256 : hash:sha256 nodes
The command is accessible to users with one or more of the following permissions:
power-ups.vxintel.adminpower-ups.vxintel.user
vxintel.files.daily
Run a progress tracked ingest of the last 7 days of file details.
This command will immediately create the file:bytes nodes from the details
returned by the VXIntel API and queue the files for downloading in the
background.
Examples:
// Ingest the last 7 days of file details
vxintel.files.daily
Usage: vxintel.files.daily [options]
Options:
--help : Display the command usage.
--yield : Yield the newly created nodes.
--debug : Print debugging messages.
--config <config> : Override the default config with the provided name.
The command is accessible to users with one or more of the following permissions:
power-ups.vxintel.adminpower-ups.vxintel.user
Storm Modules
This package does not export any Storm APIs.