Cyware Orchestrate

Hybrid Analysis is a cloud-based sandboxing solution. In Orchestrate, Hybrid Analysis allows the users to analyze the files and identify the malicious nature of the file that is uploaded to the service in a virtual sandbox environment. Users can also lookup file hash to get details about the API key or malware samples.

The Hybrid Analysis app is configured with the Orchestrate application to perform the following actions:

The following configuration parameters are required for the Hybrid Analysis app to communicate with the Hybrid Analysis enterprise application. The parameters can be configured by creating instances in the app.

This URL must be whitelisted to use Hybrid Analysis from a proxied environment. https://www.hybrid-analysis.com/api/v2.

This action performs a quick file scan using URL and additional fields from the hybrid analysis sandbox application.

Action Input Parameters

Example Request

{     
   "file_path": "/home/anna/statusReport",      
   "scan_type": "all",      
   "additional_fields": {}   
}

This action performs a quick URL scan using URL and additional fields from the hybrid analysis sandbox application.

Action Input Parameters

Example Request

{      
   "url": "trenz.pl.com",      
   "scan_type": "all",      
   "extra_params": {}   
}

This action obtains the report status of a sandbox submission.

Action Input Parameters

Example Request

{
   "job_id": "5e9dbc86193b8430af5fbb1b"
}

This action obtains a report summary of the sandbox submission.

Action Input Parameters

Example Request

{
   "job_id": "5f48d6650286fb07773753d2"
}

This action submits a file for sandbox analysis.

Action Input Parameters

Example Request

{      
   "file_path": "/tmp/0ce98d6d-be4c-47dd-a3e0-8cd41d992e61/Kaspersky_Endpoint_Security_for_Enterprise.pdf",      
   "extra_params":       
  {           
     “no_share_third_party”: false,           
     “no_hash_lookup”: false,           
     “tor_enabled_analysis“: false,           
     “no_hash_lookup“: false       
  } 
}

This action determines a SHA256 that an online file or URL submission will have when being processed by the system.

Note: This action is useful when the user looks up URL analysis.

Action Input Parameters

Example Request

{      
   "url": "http://jusdermas.com/Jessie L Campbell/amazon/"   
}

This action submits a URL for scanning in sandbox analysis.

Action Input Parameters

Example Request

{      
   "url": "trenz.pl.com",      
   "extra_params": {},      
   "environment_id": 110   
}

This action searches for hash details and the summary of the file hash.

Action Input Parameters

Example Request

{      
   "file_hash": "83d965138a2fc05f5a403d43c9425afc1360eb793b3d94c64037f0f848467e22"   
}

This action obtains an overview of the SHA256 hash.

Action Input Parameters

Example Request

[   
   {      
     "SHA256": "83d965138a2fc05f5a403d43c9425afc1360eb793b3d94c64037f0f848467e22"   
   }
]

This action obtains the summary of SHA256 hash.

Action Input Parameters

Example Request

[   
   {      
     "SHA256": "83d965138a2fc05f5a403d43c9425afc1360eb793b3d94c64037f0f848467e22"   
   }
]

This action obtains the result of a quick scan using scan ID.

Action Input Parameters

Example Request

{      
   "scan_id": "5f4bdb83b23d773af8721296"   
}

This action retrieves a list of feeds. Retrieves the recent 250 reports logged in the last 24 hours.

Action Input Parameters

This action does not require any input parameter.

This action submits a file content for Sandbox analysis.

Action Input Parameters

Example Request

[
   {
        "file_content": "123.33.33.33\\n22.22.22.22\\n",
        "environment_id": 120
    }
]