diff --git a/README.md b/README.md index 4056957..24c4def 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ # Reversinglabs TitaniumCloud v2 Publisher: ReversingLabs -Connector Version: 1.0.1 +Connector Version: 1.2.0 Product Vendor: Reversinglabs Product Name: TitaniumCloud Product Version Supported (regex): ".\*" @@ -22,6 +22,861 @@ App integrates with ReversingLabs TitaniumCloud APIs delivering targeted file an [comment]: # "and limitations under the License." [comment]: # "" +### Configuration Variables +The below configuration variables are required for this Connector to operate. These variables are specified when configuring a TitaniumCloud asset in SOAR. + +VARIABLE | REQUIRED | TYPE | DESCRIPTION +-------- | -------- | ---- | ----------- +**url** | required | string | TitaniumCloud URL +**username** | required | string | TitaniumCloud username +**password** | required | password | TitaniumCloud password + +### Supported Actions +[test connectivity](#action-test-connectivity) - Validate the asset configuration for connectivity using supplied configuration +[yara create ruleset](#action-yara-create-ruleset) - TCA-0303 - Create a new YARA ruleset +[yara delete ruleset](#action-yara-delete-ruleset) - TCA-0303 - Delete YARA ruleset +[yara get ruleset info](#action-yara-get-ruleset-info) - TCA-0303 - Get YARA ruleset info +[yara get ruleset text](#action-yara-get-ruleset-text) - TCA-0303 - Get YARA ruleset text +[get yara matches](#action-get-yara-matches) - TCA-0303 - Get a recordset of YARA ruleset matches in the specified time range +[yara retro enable hunt](#action-yara-retro-enable-hunt) - TCA-0319 - Enable YARA retro hunt +[yara retro start hunt](#action-yara-retro-start-hunt) - TCA-0319 - Start YARA retro hunt for the specified ruleset +[yara retro check status](#action-yara-retro-check-status) - TCA-0319 - Check the retro hunt status for the specified ruleset +[yara retro cancel hunt](#action-yara-retro-cancel-hunt) - TCA-0319 - Cancel the retro hunt for the specified ruleset +[get yara retro matches](#action-get-yara-retro-matches) - TCA-0319 - Get a recordset of YARA ruleset matches in the specified time range +[imphash similarity](#action-imphash-similarity) - TCA-0302 - Get a a list of all available SHA1 hashes for files sharing the same import hash (imphash) +[advanced search](#action-advanced-search) - TCA-0320 - Search for hashes using multi-part search criteria +[av scanners](#action-av-scanners) - TCA-0103 - Retrieve AV Scanner data from TitaniumCloud +[file reputation](#action-file-reputation) - TCA-0101 - Queries for file reputation info +[file analysis](#action-file-analysis) - TCA-0104 - Retrieve File Analysis by hash data from TitaniumCloud +[functional similarity](#action-functional-similarity) - TCA-0301 - Retrieve a list of functionally similar hashes to the provided one +[url reputation](#action-url-reputation) - TCA-0403 - Queries URL Threat Intelligence +[get downloaded files](#action-get-downloaded-files) - TCA - 0403 - Get files downloaded from url +[get latest url analysis feed](#action-get-latest-url-analysis-feed) - TCA - 0403 - Get latest url analysis feed +[get url analysis feed from date](#action-get-url-analysis-feed-from-date) - TCA - 0403 - Get url analysis feed from date +[analyze url](#action-analyze-url) - TCA-0404 - Analyze a given URL +[uri statistics](#action-uri-statistics) - TCA-0402 - Retrieve the number of MALICIOUS, SUSPICIOUS and KNOWN files associated with a specific URI +[uri index](#action-uri-index) - TCA-0401 - Retrieve a list of all available file hashes associated with a given URI +[submit for dynamic analysis](#action-submit-for-dynamic-analysis) - TCA-0207 - Submit an existing sample for dynamic analysis +[dynamic analysis results](#action-dynamic-analysis-results) - TCA-0106 - Retrieve dynamic analysis results +[reanalyze file](#action-reanalyze-file) - TCA-0205 - Reanalyze sample +[upload file](#action-upload-file) - TCA-0202 - Upload file to TitaniumCloud +[get file](#action-get-file) - TCA-0201 - Download a sample from TitaniumCloud +[get network reputation](#action-get-network-reputation) - TCA-0407 - Get reputation of a requested URL, domain or IP address +[get list user overrides](#action-get-list-user-overrides) - TCA-0408 - Get user URL classification overrides +[get list user overrides aggregated](#action-get-list-user-overrides-aggregated) - TCA-0408 - Get user URL classification overrides aggregated +[network reputation user override](#action-network-reputation-user-override) - TCA-0408 - Override user network location reputation + +## action: 'test connectivity' +Validate the asset configuration for connectivity using supplied configuration + +Type: **test** +Read only: **True** + +Validate the asset configuration for connectivity using supplied configuration. + +#### Action Parameters +No parameters are required for this action + +#### Action Output +No Output + +## action: 'yara create ruleset' +TCA-0303 - Create a new YARA ruleset + +Type: **generic** +Read only: **False** + +TCA-0303 - Create a new YARA ruleset. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**ruleset_name** | required | YARA ruleset name | string | +**ruleset_text** | required | Stringified YARA ruleset / a Unicode string | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.ruleset_name | string | | +action_result.parameter.ruleset_text | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'yara delete ruleset' +TCA-0303 - Delete YARA ruleset + +Type: **generic** +Read only: **False** + +TCA-0303 - Delete YARA ruleset. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**ruleset_name** | required | YARA ruleset name | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.ruleset_name | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'yara get ruleset info' +TCA-0303 - Get YARA ruleset info + +Type: **generic** +Read only: **False** + +TCA-0303 - Get information for a specific YARA ruleset or all YARA rulesets in the collection. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**ruleset_name** | optional | YARA ruleset name | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.ruleset_name | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'yara get ruleset text' +TCA-0303 - Get YARA ruleset text + +Type: **generic** +Read only: **False** + +TCA-0303 - Get the text of a YARA ruleset. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**ruleset_name** | required | YARA ruleset name | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.ruleset_name | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get yara matches' +TCA-0303 - Get a recordset of YARA ruleset matches in the specified time range + +Type: **generic** +Read only: **False** + +TCA-0303 - Get a recordset of YARA ruleset matches in the specified time range. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**time_format** | required | 'utc' or 'timestamp' | string | +**time_value** | required | 'YYYY-MM-DDThh:mm:ss' or Unix timestamp string | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.time_format | string | | +action_result.parameter.time_value | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'yara retro enable hunt' +TCA-0319 - Enable YARA retro hunt + +Type: **generic** +Read only: **False** + +TCA-0319 - Enable the retro hunt for the specified ruleset that has been submitted to TitaniumCloud prior to deployment of YARA retro. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**ruleset_name** | required | YARA ruleset name | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.ruleset_name | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'yara retro start hunt' +TCA-0319 - Start YARA retro hunt for the specified ruleset + +Type: **generic** +Read only: **False** + +TCA-0319 - Start YARA retro hunt for the specified ruleset. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**ruleset_name** | required | YARA ruleset name | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.ruleset_name | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'yara retro check status' +TCA-0319 - Check the retro hunt status for the specified ruleset + +Type: **generic** +Read only: **False** + +TCA-0319 - Check the retro hunt status for the specified ruleset. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**ruleset_name** | required | YARA ruleset name | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.ruleset_name | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'yara retro cancel hunt' +TCA-0319 - Cancel the retro hunt for the specified ruleset + +Type: **generic** +Read only: **False** + +TCA-0319 - Cancel the retro hunt for the specified ruleset. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**ruleset_name** | required | YARA ruleset name | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.ruleset_name | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get yara retro matches' +TCA-0319 - Get a recordset of YARA ruleset matches in the specified time range + +Type: **generic** +Read only: **False** + +TCA-0319 - Get a recordset of YARA ruleset matches in the specified time range. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**time_format** | required | 'utc' or 'timestamp' | string | +**time_value** | required | 'YYYY-MM-DDThh:mm:ss' or Unix timestamp string | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.time_format | string | | +action_result.parameter.time_value | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'imphash similarity' +TCA-0302 - Get a a list of all available SHA1 hashes for files sharing the same import hash (imphash) + +Type: **generic** +Read only: **False** + +TCA-0302 - Imphash Index provides a list of all available SHA1 hashes for files sharing the same import hash (imphash). An imphash is a hash calculated from a string which contains the libraries imported by a Windows Portable Executable (PE) file. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**imphash** | required | Imphash | string | +**limit** | optional | Maximum number of results | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.imphash | string | | +action_result.parameter.limit | numeric | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'advanced search' +TCA-0320 - Search for hashes using multi-part search criteria + +Type: **generic** +Read only: **False** + +TCA-0320 - Search for hashes using multi-part search criteria. Supported criteria include more than 60 keywords, 35 antivirus vendors, 137 sample types and subtypes, and 283 tags that enable creating 510 unique search expressions with support for Boolean operators and case-insensitive wildcard matching. A number of search keywords support relational operators '<=' and '>='. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**query** | required | Advanced Search query | string | +**limit** | optional | Maximum number of results | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.limit | numeric | | +action_result.parameter.query | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'av scanners' +TCA-0103 - Retrieve AV Scanner data from TitaniumCloud + +Type: **generic** +Read only: **False** + +TCA-0103 - Provides AV vendor cross-reference data for a desired sample from multiple AV scanners. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**hash** | required | File hash | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.hash | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'file reputation' +TCA-0101 - Queries for file reputation info + +Type: **investigate** +Read only: **True** + +TCA-0101 - Queries for file reputation info. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**hash** | required | File hash to query | string | `hash` `sha256` `sha1` `md5` + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.hash | string | `hash` `sha256` `sha1` `md5` | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'file analysis' +TCA-0104 - Retrieve File Analysis by hash data from TitaniumCloud + +Type: **generic** +Read only: **False** + +TCA-0104 - Provides file analysis data on hashes. Metadata can include relevant portions of static analysis, AV scan information, file sources and any related IP/domain information. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**hash** | required | File hash | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.hash | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'functional similarity' +TCA-0301 - Retrieve a list of functionally similar hashes to the provided one + +Type: **generic** +Read only: **False** + +TCA-0301 - Provides a list of SHA1 hashes of files that are functionally similar to the provided file (SHA1 hash) at the selected precision level. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**hash** | required | File hash | string | +**limit** | optional | Maximum number of results | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.hash | string | | +action_result.parameter.limit | numeric | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'url reputation' +TCA-0403 - Queries URL Threat Intelligence + +Type: **investigate** +Read only: **True** + +TCA-0403 - Queries URL Threat Intelligence. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**url** | required | URL to query | string | `url` + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.url | string | `url` | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get downloaded files' +TCA - 0403 - Get files downloaded from url + +Type: **generic** +Read only: **False** + +Accepts a URL string and returns a list of downloaded files aggregated through multiple pages of results. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**url** | required | URL string | string | +**extended** | optional | Return extended report | boolean | +**classification** | optional | Return only files of this classification | string | +**last_analysis** | optional | Return only files from the last analysis | boolean | +**analysis_id** | optional | Return only files from this analysis | string | +**results_per_page** | optional | Number of results to be returned in one page, maximum value is 1000 | numeric | +**max_results** | optional | Maximum results to be returned in the list | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.parameter.url | string | | +action_result.parameter.extended | boolean | | +action_result.parameter.classification | string | | +action_result.parameter.last_analysis | boolean | | +action_result.parameter.analysis_id | string | | +action_result.parameter.results_per_page | numeric | | +action_result.parameter.max_results | numeric | | +action_result.status | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get latest url analysis feed' +TCA - 0403 - Get latest url analysis feed + +Type: **generic** +Read only: **False** + +Returns the latest URL analyses reports aggregated as list. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**results_per_page** | optional | Number of results to be returned in one page, maximum value is 1000 | numeric | +**max_results** | optional | Maximum results to be returned in the list | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.parameter.results_per_page | numeric | | +action_result.parameter.max_results | numeric | | +action_result.status | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get url analysis feed from date' +TCA - 0403 - Get url analysis feed from date + +Type: **generic** +Read only: **False** + +Accepts time format and a start time and returns URL analyses reports from that defined time onward aggregated as a list. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**time_format** | required | Possible values: 'utc' or 'timestamp' | string | +**start_time** | required | Time from which to retrieve results onwards | string | +**results_per_page** | optional | Number of results to be returned in one page, maximum value is 1000 | numeric | +**max_results** | optional | Maximum results to be returned in the list | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.parameter.time_format | string | | +action_result.parameter.start_time | string | | +action_result.parameter.results_per_page | numeric | | +action_result.parameter.max_results | numeric | | +action_result.status | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'analyze url' +TCA-0404 - Analyze a given URL + +Type: **investigate** +Read only: **False** + +TCA-0404 - This service allows users to submit a URL for analysis. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**url** | required | URL to analyze | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.url | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'uri statistics' +TCA-0402 - Retrieve the number of MALICIOUS, SUSPICIOUS and KNOWN files associated with a specific URI + +Type: **generic** +Read only: **False** + +TCA-0402 - Provides the number of MALICIOUS, SUSPICIOUS and KNOWN files associated with a specific URI (domain, IP address, email or URL). + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**uri** | required | Uri | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.uri | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'uri index' +TCA-0401 - Retrieve a list of all available file hashes associated with a given URI + +Type: **generic** +Read only: **False** + +TCA-0401 - Provides a list of all available file hashes associated with a given URI (domain, IP address, email or URL) regardless of file classification. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**uri** | required | Desired URI string | string | +**limit** | optional | Maximum number of results | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.limit | numeric | | +action_result.parameter.uri | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'submit for dynamic analysis' +TCA-0207 - Submit an existing sample for dynamic analysis + +Type: **generic** +Read only: **False** + +TCA-0207 - This service allows users to detonate a file in the ReversingLabs TitaniumCloud sandbox. To submit a file for analysis, it must exist in TitaniumCloud. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**sha1** | required | Selected sample's SHA-1 hash | string | +**platform** | required | Selected platform on which the analysis will be performed. See TCA-0207 API documentation for available options | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.platform | string | | +action_result.parameter.sha1 | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'dynamic analysis results' +TCA-0106 - Retrieve dynamic analysis results + +Type: **generic** +Read only: **False** + +TCA-0106 - This service allows users to retrieve dynamic analysis results for a file that was submitted for dynamic analysis. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**sha1** | required | Selected sample's SHA-1 hash | string | +**analysis_id** | optional | Return only the results of this analysis | string | +**latest** | optional | Return only the latest analysis results | boolean | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.analysis_id | string | | +action_result.parameter.latest | boolean | | +action_result.parameter.sha1 | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'reanalyze file' +TCA-0205 - Reanalyze sample + +Type: **generic** +Read only: **False** + +TCA-0205 - This query sends a sample with the requested hash for rescanning. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**hash** | required | File hash | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.hash | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'upload file' +TCA-0202 - Upload file to TitaniumCloud + +Type: **generic** +Read only: **False** + +TCA-0202 - Upload file to TitaniumCloud. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**vault_id** | required | Vault ID of file to upload | string | `vault id` +**file_name** | optional | Filename to use | string | `file name` + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.file_name | string | `file name` | +action_result.parameter.vault_id | string | `pe file` `pdf` `flash` `apk` `jar` `doc` `xls` `ppt` | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get file' +TCA-0201 - Download a sample from TitaniumCloud + +Type: **investigate** +Read only: **True** + +TCA-0201 - Download a sample from TitaniumCloud and add it to the vault. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**hash** | required | Hash of file/sample to download | string | `md5` `sha1` `sha256` + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.hash | string | `md5` `sha1` `sha256` | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get network reputation' +TCA-0407 - Get reputation of a requested URL, domain or IP address + +Type: **generic** +Read only: **False** + +TCA-0407 - Get reputation of a requested URL, domain or IP address + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**network_locations** | required | domain, url or ip | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.network_locations | string | | 92.123.37.9 or multiple separated by space (92.123.37.9 reversinglabs.com) +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get list user overrides' +TCA-0408 - Get user URL classification overrides + +Type: **generic** +Read only: **False** + +TCA-0408 - Get user URL classification overrides + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**next_page_sha1** | optional | Optional parameter used for pagination | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.next_page_sha1 | string | | 23e725d8923bf46bb776f15f26f410f829b75e7f +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get list user overrides aggregated' +TCA-0408 - Get user URL classification overrides aggregated + +Type: **generic** +Read only: **False** + +TCA-0408 - Get user URL classification overrides aggregated + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**max_results** | optional | | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.max_results | numeric | | 50 +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'network reputation user override' +TCA-0408 - Override user network location reputation + +Type: **generic** +Read only: **False** + +TCA-0408 - Override user network location reputation + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**override_list** | required | Network Reputation User Override | string | +**remove_overrides_list** | optional | List of network locations whose classification override needs to be removed | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.override_list | string | | { "network_location": "http://example.com", "type": "url", "classification": "malicious", "categories": ["phishing"] } +action_result.parameter.remove_overrides_list | string | | { "network_location": "http://example.com", "type": "url" } +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | ### Configuration Variables @@ -52,6 +907,9 @@ VARIABLE | REQUIRED | TYPE | DESCRIPTION [file analysis](#action-file-analysis) - TCA-0104 - Retrieve File Analysis by hash data from TitaniumCloud [functional similarity](#action-functional-similarity) - TCA-0301 - Retrieve a list of functionally similar hashes to the provided one [url reputation](#action-url-reputation) - TCA-0403 - Queries URL Threat Intelligence +[get downloaded files](#action-get-downloaded-files) - TCA - 0403 - Get files downloaded from url +[get latest url analysis feed](#action-get-latest-url-analysis-feed) - TCA - 0403 - Get latest url analysis feed +[get url analysis feed from date](#action-get-url-analysis-feed-from-date) - TCA - 0403 - Get url analysis feed from date [analyze url](#action-analyze-url) - TCA-0404 - Analyze a given URL [uri statistics](#action-uri-statistics) - TCA-0402 - Retrieve the number of MALICIOUS, SUSPICIOUS and KNOWN files associated with a specific URI [uri index](#action-uri-index) - TCA-0401 - Retrieve a list of all available file hashes associated with a given URI @@ -60,6 +918,10 @@ VARIABLE | REQUIRED | TYPE | DESCRIPTION [reanalyze file](#action-reanalyze-file) - TCA-0205 - Reanalyze sample [upload file](#action-upload-file) - TCA-0202 - Upload file to TitaniumCloud [get file](#action-get-file) - TCA-0201 - Download a sample from TitaniumCloud +[get network reputation](#action-get-network-reputation) - Network Reputation API +[get list user overrides](#action-get-list-user-overrides) - List User Overrides +[get list user overrides aggregated](#action-get-list-user-overrides-aggregated) - Returns a list of overrides that the user has made +[network reputation user override](#action-network-reputation-user-override) - Network Reputation User Override ## action: 'test connectivity' Validate the asset configuration for connectivity using supplied configuration @@ -495,6 +1357,92 @@ action_result.message | string | | summary.total_objects | numeric | | summary.total_objects_successful | numeric | | +## action: 'get downloaded files' +TCA - 0403 - Get files downloaded from url + +Type: **generic** +Read only: **False** + +Accepts a URL string and returns a list of downloaded files aggregated through multiple pages of results. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**url** | required | URL string | string | +**extended** | optional | Return extended report | boolean | +**classification** | optional | Return only files of this classification | string | +**last_analysis** | optional | Return only files from the last analysis | boolean | +**analysis_id** | optional | Return only files from this analysis | string | +**results_per_page** | optional | Number of results to be returned in one page, maximum value is 1000 | numeric | +**max_results** | optional | Maximum results to be returned in the list | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.parameter.url | string | | +action_result.parameter.extended | boolean | | +action_result.parameter.classification | string | | +action_result.parameter.last_analysis | boolean | | +action_result.parameter.analysis_id | string | | +action_result.parameter.results_per_page | numeric | | +action_result.parameter.max_results | numeric | | +action_result.status | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get latest url analysis feed' +TCA - 0403 - Get latest url analysis feed + +Type: **generic** +Read only: **False** + +Returns the latest URL analyses reports aggregated as list. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**results_per_page** | optional | Number of results to be returned in one page, maximum value is 1000 | numeric | +**max_results** | optional | Maximum results to be returned in the list | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.parameter.results_per_page | numeric | | +action_result.parameter.max_results | numeric | | +action_result.status | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get url analysis feed from date' +TCA - 0403 - Get url analysis feed from date + +Type: **generic** +Read only: **False** + +Accepts time format and a start time and returns URL analyses report from that defined time onward aggregated as a list. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**time_format** | required | Possible values: 'utc' or 'timestamp' | string | +**start_time** | required | Time from which to retrieve results onwards | string | +**results_per_page** | optional | Number of results to be returned in one page, maximum value is 1000 | numeric | +**max_results** | optional | Maximum results to be returned in the list | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.parameter.time_format | string | | +action_result.parameter.start_time | string | | +action_result.parameter.results_per_page | numeric | | +action_result.parameter.max_results | numeric | | +action_result.status | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + ## action: 'analyze url' TCA-0404 - Analyze a given URL @@ -695,4 +1643,94 @@ action_result.data | string | | action_result.summary | string | | action_result.message | string | | summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get network reputation' +Network Reputation API + +Type: **generic** +Read only: **False** + +Service provides information regarding the reputation of a requested URL, domain, or IP address. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**network_locations** | required | Network location to check (URL,DNS,IP) | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.parameter.network_locations | string | | +action_result.status | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get list user overrides' +List User Overrides + +Type: **generic** +Read only: **False** + +The Network Reputation User Override service enables URL classification overrides. Any URL can be overridden to malicious, suspicious, or known. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**next_page_sha1** | optional | Optional parameter used for pagination | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.parameter.next_page_sha1 | string | | +action_result.status | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get list user overrides aggregated' +Returns a list of overrides that the user has made + +Type: **generic** +Read only: **False** + +This API automatically handles paging and returns a list of results instead of a Response object. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**max_results** | optional | Maximum number of results to be returned in the list | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.parameter.max_results | numeric | | +action_result.status | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'network reputation user override' +Network Reputation User Override + +Type: **generic** +Read only: **False** + +The Network Reputation User Override service enables URL classification overrides. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**override_list** | required | List of network locations whose classification needs to be overriden | string | +**remove_overrides_list** | optional | List of network locations whose classification override needs to be removed | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.parameter.override_list | string | | +action_result.parameter.remove_overrides_list | string | | +action_result.status | string | | +action_result.message | string | | +summary.total_objects | numeric | | summary.total_objects_successful | numeric | | \ No newline at end of file diff --git a/manual_readme_content.md b/manual_readme_content.md new file mode 100644 index 0000000..3c8828d --- /dev/null +++ b/manual_readme_content.md @@ -0,0 +1,867 @@ +[comment]: # " File: README.md" +[comment]: # " Copyright (c) ReversingLabs, 2023" +[comment]: # "Licensed under the Apache License, Version 2.0 (the 'License');" +[comment]: # "you may not use this file except in compliance with the License." +[comment]: # "You may obtain a copy of the License at" +[comment]: # " http://www.apache.org/licenses/LICENSE-2.0" +[comment]: # "Unless required by applicable law or agreed to in writing, software distributed under" +[comment]: # "the License is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND," +[comment]: # "either express or implied. See the License for the specific language governing permissions" +[comment]: # "and limitations under the License." +[comment]: # "" + +### Configuration Variables +The below configuration variables are required for this Connector to operate. These variables are specified when configuring a TitaniumCloud asset in SOAR. + +VARIABLE | REQUIRED | TYPE | DESCRIPTION +-------- | -------- | ---- | ----------- +**url** | required | string | TitaniumCloud URL +**username** | required | string | TitaniumCloud username +**password** | required | password | TitaniumCloud password + +### Supported Actions +[test connectivity](#action-test-connectivity) - Validate the asset configuration for connectivity using supplied configuration +[yara create ruleset](#action-yara-create-ruleset) - TCA-0303 - Create a new YARA ruleset +[yara delete ruleset](#action-yara-delete-ruleset) - TCA-0303 - Delete YARA ruleset +[yara get ruleset info](#action-yara-get-ruleset-info) - TCA-0303 - Get YARA ruleset info +[yara get ruleset text](#action-yara-get-ruleset-text) - TCA-0303 - Get YARA ruleset text +[get yara matches](#action-get-yara-matches) - TCA-0303 - Get a recordset of YARA ruleset matches in the specified time range +[yara retro enable hunt](#action-yara-retro-enable-hunt) - TCA-0319 - Enable YARA retro hunt +[yara retro start hunt](#action-yara-retro-start-hunt) - TCA-0319 - Start YARA retro hunt for the specified ruleset +[yara retro check status](#action-yara-retro-check-status) - TCA-0319 - Check the retro hunt status for the specified ruleset +[yara retro cancel hunt](#action-yara-retro-cancel-hunt) - TCA-0319 - Cancel the retro hunt for the specified ruleset +[get yara retro matches](#action-get-yara-retro-matches) - TCA-0319 - Get a recordset of YARA ruleset matches in the specified time range +[imphash similarity](#action-imphash-similarity) - TCA-0302 - Get a a list of all available SHA1 hashes for files sharing the same import hash (imphash) +[advanced search](#action-advanced-search) - TCA-0320 - Search for hashes using multi-part search criteria +[av scanners](#action-av-scanners) - TCA-0103 - Retrieve AV Scanner data from TitaniumCloud +[file reputation](#action-file-reputation) - TCA-0101 - Queries for file reputation info +[file analysis](#action-file-analysis) - TCA-0104 - Retrieve File Analysis by hash data from TitaniumCloud +[functional similarity](#action-functional-similarity) - TCA-0301 - Retrieve a list of functionally similar hashes to the provided one +[url reputation](#action-url-reputation) - TCA-0403 - Queries URL Threat Intelligence +[get downloaded files](#action-get-downloaded-files) - TCA - 0403 - Get files downloaded from url +[get latest url analysis feed](#action-get-latest-url-analysis-feed) - TCA - 0403 - Get latest url analysis feed +[get url analysis feed from date](#action-get-url-analysis-feed-from-date) - TCA - 0403 - Get url analysis feed from date +[analyze url](#action-analyze-url) - TCA-0404 - Analyze a given URL +[uri statistics](#action-uri-statistics) - TCA-0402 - Retrieve the number of MALICIOUS, SUSPICIOUS and KNOWN files associated with a specific URI +[uri index](#action-uri-index) - TCA-0401 - Retrieve a list of all available file hashes associated with a given URI +[submit for dynamic analysis](#action-submit-for-dynamic-analysis) - TCA-0207 - Submit an existing sample for dynamic analysis +[dynamic analysis results](#action-dynamic-analysis-results) - TCA-0106 - Retrieve dynamic analysis results +[reanalyze file](#action-reanalyze-file) - TCA-0205 - Reanalyze sample +[upload file](#action-upload-file) - TCA-0202 - Upload file to TitaniumCloud +[get file](#action-get-file) - TCA-0201 - Download a sample from TitaniumCloud +[get network reputation](#action-get-network-reputation) - TCA-0407 - Get reputation of a requested URL, domain or IP address +[get list user overrides](#action-get-list-user-overrides) - TCA-0408 - Get user URL classification overrides +[get list user overrides aggregated](#action-get-list-user-overrides-aggregated) - TCA-0408 - Get user URL classification overrides aggregated +[network reputation user override](#action-network-reputation-user-override) - TCA-0408 - Override user network location reputation + +## action: 'test connectivity' +Validate the asset configuration for connectivity using supplied configuration + +Type: **test** +Read only: **True** + +Validate the asset configuration for connectivity using supplied configuration. + +#### Action Parameters +No parameters are required for this action + +#### Action Output +No Output + +## action: 'yara create ruleset' +TCA-0303 - Create a new YARA ruleset + +Type: **generic** +Read only: **False** + +TCA-0303 - Create a new YARA ruleset. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**ruleset_name** | required | YARA ruleset name | string | +**ruleset_text** | required | Stringified YARA ruleset / a Unicode string | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.ruleset_name | string | | +action_result.parameter.ruleset_text | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'yara delete ruleset' +TCA-0303 - Delete YARA ruleset + +Type: **generic** +Read only: **False** + +TCA-0303 - Delete YARA ruleset. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**ruleset_name** | required | YARA ruleset name | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.ruleset_name | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'yara get ruleset info' +TCA-0303 - Get YARA ruleset info + +Type: **generic** +Read only: **False** + +TCA-0303 - Get information for a specific YARA ruleset or all YARA rulesets in the collection. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**ruleset_name** | optional | YARA ruleset name | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.ruleset_name | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'yara get ruleset text' +TCA-0303 - Get YARA ruleset text + +Type: **generic** +Read only: **False** + +TCA-0303 - Get the text of a YARA ruleset. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**ruleset_name** | required | YARA ruleset name | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.ruleset_name | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get yara matches' +TCA-0303 - Get a recordset of YARA ruleset matches in the specified time range + +Type: **generic** +Read only: **False** + +TCA-0303 - Get a recordset of YARA ruleset matches in the specified time range. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**time_format** | required | 'utc' or 'timestamp' | string | +**time_value** | required | 'YYYY-MM-DDThh:mm:ss' or Unix timestamp string | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.time_format | string | | +action_result.parameter.time_value | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'yara retro enable hunt' +TCA-0319 - Enable YARA retro hunt + +Type: **generic** +Read only: **False** + +TCA-0319 - Enable the retro hunt for the specified ruleset that has been submitted to TitaniumCloud prior to deployment of YARA retro. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**ruleset_name** | required | YARA ruleset name | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.ruleset_name | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'yara retro start hunt' +TCA-0319 - Start YARA retro hunt for the specified ruleset + +Type: **generic** +Read only: **False** + +TCA-0319 - Start YARA retro hunt for the specified ruleset. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**ruleset_name** | required | YARA ruleset name | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.ruleset_name | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'yara retro check status' +TCA-0319 - Check the retro hunt status for the specified ruleset + +Type: **generic** +Read only: **False** + +TCA-0319 - Check the retro hunt status for the specified ruleset. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**ruleset_name** | required | YARA ruleset name | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.ruleset_name | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'yara retro cancel hunt' +TCA-0319 - Cancel the retro hunt for the specified ruleset + +Type: **generic** +Read only: **False** + +TCA-0319 - Cancel the retro hunt for the specified ruleset. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**ruleset_name** | required | YARA ruleset name | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.ruleset_name | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get yara retro matches' +TCA-0319 - Get a recordset of YARA ruleset matches in the specified time range + +Type: **generic** +Read only: **False** + +TCA-0319 - Get a recordset of YARA ruleset matches in the specified time range. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**time_format** | required | 'utc' or 'timestamp' | string | +**time_value** | required | 'YYYY-MM-DDThh:mm:ss' or Unix timestamp string | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.time_format | string | | +action_result.parameter.time_value | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'imphash similarity' +TCA-0302 - Get a a list of all available SHA1 hashes for files sharing the same import hash (imphash) + +Type: **generic** +Read only: **False** + +TCA-0302 - Imphash Index provides a list of all available SHA1 hashes for files sharing the same import hash (imphash). An imphash is a hash calculated from a string which contains the libraries imported by a Windows Portable Executable (PE) file. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**imphash** | required | Imphash | string | +**limit** | optional | Maximum number of results | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.imphash | string | | +action_result.parameter.limit | numeric | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'advanced search' +TCA-0320 - Search for hashes using multi-part search criteria + +Type: **generic** +Read only: **False** + +TCA-0320 - Search for hashes using multi-part search criteria. Supported criteria include more than 60 keywords, 35 antivirus vendors, 137 sample types and subtypes, and 283 tags that enable creating 510 unique search expressions with support for Boolean operators and case-insensitive wildcard matching. A number of search keywords support relational operators '<=' and '>='. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**query** | required | Advanced Search query | string | +**limit** | optional | Maximum number of results | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.limit | numeric | | +action_result.parameter.query | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'av scanners' +TCA-0103 - Retrieve AV Scanner data from TitaniumCloud + +Type: **generic** +Read only: **False** + +TCA-0103 - Provides AV vendor cross-reference data for a desired sample from multiple AV scanners. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**hash** | required | File hash | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.hash | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'file reputation' +TCA-0101 - Queries for file reputation info + +Type: **investigate** +Read only: **True** + +TCA-0101 - Queries for file reputation info. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**hash** | required | File hash to query | string | `hash` `sha256` `sha1` `md5` + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.hash | string | `hash` `sha256` `sha1` `md5` | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'file analysis' +TCA-0104 - Retrieve File Analysis by hash data from TitaniumCloud + +Type: **generic** +Read only: **False** + +TCA-0104 - Provides file analysis data on hashes. Metadata can include relevant portions of static analysis, AV scan information, file sources and any related IP/domain information. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**hash** | required | File hash | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.hash | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'functional similarity' +TCA-0301 - Retrieve a list of functionally similar hashes to the provided one + +Type: **generic** +Read only: **False** + +TCA-0301 - Provides a list of SHA1 hashes of files that are functionally similar to the provided file (SHA1 hash) at the selected precision level. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**hash** | required | File hash | string | +**limit** | optional | Maximum number of results | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.hash | string | | +action_result.parameter.limit | numeric | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'url reputation' +TCA-0403 - Queries URL Threat Intelligence + +Type: **investigate** +Read only: **True** + +TCA-0403 - Queries URL Threat Intelligence. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**url** | required | URL to query | string | `url` + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.url | string | `url` | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get downloaded files' +TCA - 0403 - Get files downloaded from url + +Type: **generic** +Read only: **False** + +Accepts a URL string and returns a list of downloaded files aggregated through multiple pages of results. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**url** | required | URL string | string | +**extended** | optional | Return extended report | boolean | +**classification** | optional | Return only files of this classification | string | +**last_analysis** | optional | Return only files from the last analysis | boolean | +**analysis_id** | optional | Return only files from this analysis | string | +**results_per_page** | optional | Number of results to be returned in one page, maximum value is 1000 | numeric | +**max_results** | optional | Maximum results to be returned in the list | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.parameter.url | string | | +action_result.parameter.extended | boolean | | +action_result.parameter.classification | string | | +action_result.parameter.last_analysis | boolean | | +action_result.parameter.analysis_id | string | | +action_result.parameter.results_per_page | numeric | | +action_result.parameter.max_results | numeric | | +action_result.status | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get latest url analysis feed' +TCA - 0403 - Get latest url analysis feed + +Type: **generic** +Read only: **False** + +Returns the latest URL analyses reports aggregated as list. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**results_per_page** | optional | Number of results to be returned in one page, maximum value is 1000 | numeric | +**max_results** | optional | Maximum results to be returned in the list | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.parameter.results_per_page | numeric | | +action_result.parameter.max_results | numeric | | +action_result.status | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get url analysis feed from date' +TCA - 0403 - Get url analysis feed from date + +Type: **generic** +Read only: **False** + +Accepts time format and a start time and returns URL analyses reports from that defined time onward aggregated as a list. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**time_format** | required | Possible values: 'utc' or 'timestamp' | string | +**start_time** | required | Time from which to retrieve results onwards | string | +**results_per_page** | optional | Number of results to be returned in one page, maximum value is 1000 | numeric | +**max_results** | optional | Maximum results to be returned in the list | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.parameter.time_format | string | | +action_result.parameter.start_time | string | | +action_result.parameter.results_per_page | numeric | | +action_result.parameter.max_results | numeric | | +action_result.status | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'analyze url' +TCA-0404 - Analyze a given URL + +Type: **investigate** +Read only: **False** + +TCA-0404 - This service allows users to submit a URL for analysis. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**url** | required | URL to analyze | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.url | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'uri statistics' +TCA-0402 - Retrieve the number of MALICIOUS, SUSPICIOUS and KNOWN files associated with a specific URI + +Type: **generic** +Read only: **False** + +TCA-0402 - Provides the number of MALICIOUS, SUSPICIOUS and KNOWN files associated with a specific URI (domain, IP address, email or URL). + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**uri** | required | Uri | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.uri | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'uri index' +TCA-0401 - Retrieve a list of all available file hashes associated with a given URI + +Type: **generic** +Read only: **False** + +TCA-0401 - Provides a list of all available file hashes associated with a given URI (domain, IP address, email or URL) regardless of file classification. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**uri** | required | Desired URI string | string | +**limit** | optional | Maximum number of results | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.limit | numeric | | +action_result.parameter.uri | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'submit for dynamic analysis' +TCA-0207 - Submit an existing sample for dynamic analysis + +Type: **generic** +Read only: **False** + +TCA-0207 - This service allows users to detonate a file in the ReversingLabs TitaniumCloud sandbox. To submit a file for analysis, it must exist in TitaniumCloud. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**sha1** | required | Selected sample's SHA-1 hash | string | +**platform** | required | Selected platform on which the analysis will be performed. See TCA-0207 API documentation for available options | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.platform | string | | +action_result.parameter.sha1 | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'dynamic analysis results' +TCA-0106 - Retrieve dynamic analysis results + +Type: **generic** +Read only: **False** + +TCA-0106 - This service allows users to retrieve dynamic analysis results for a file that was submitted for dynamic analysis. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**sha1** | required | Selected sample's SHA-1 hash | string | +**analysis_id** | optional | Return only the results of this analysis | string | +**latest** | optional | Return only the latest analysis results | boolean | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.analysis_id | string | | +action_result.parameter.latest | boolean | | +action_result.parameter.sha1 | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'reanalyze file' +TCA-0205 - Reanalyze sample + +Type: **generic** +Read only: **False** + +TCA-0205 - This query sends a sample with the requested hash for rescanning. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**hash** | required | File hash | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.hash | string | | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'upload file' +TCA-0202 - Upload file to TitaniumCloud + +Type: **generic** +Read only: **False** + +TCA-0202 - Upload file to TitaniumCloud. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**vault_id** | required | Vault ID of file to upload | string | `vault id` +**file_name** | optional | Filename to use | string | `file name` + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.file_name | string | `file name` | +action_result.parameter.vault_id | string | `pe file` `pdf` `flash` `apk` `jar` `doc` `xls` `ppt` | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get file' +TCA-0201 - Download a sample from TitaniumCloud + +Type: **investigate** +Read only: **True** + +TCA-0201 - Download a sample from TitaniumCloud and add it to the vault. + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**hash** | required | Hash of file/sample to download | string | `md5` `sha1` `sha256` + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.hash | string | `md5` `sha1` `sha256` | +action_result.data | string | | +action_result.summary | string | | +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get network reputation' +TCA-0407 - Get reputation of a requested URL, domain or IP address + +Type: **generic** +Read only: **False** + +TCA-0407 - Get reputation of a requested URL, domain or IP address + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**network_locations** | required | domain, url or ip | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.network_locations | string | | 92.123.37.9 or multiple separated by space (92.123.37.9 reversinglabs.com) +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get list user overrides' +TCA-0408 - Get user URL classification overrides + +Type: **generic** +Read only: **False** + +TCA-0408 - Get user URL classification overrides + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**next_page_sha1** | optional | Optional parameter used for pagination | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.next_page_sha1 | string | | 23e725d8923bf46bb776f15f26f410f829b75e7f +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'get list user overrides aggregated' +TCA-0408 - Get user URL classification overrides aggregated + +Type: **generic** +Read only: **False** + +TCA-0408 - Get user URL classification overrides aggregated + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**max_results** | optional | | numeric | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.max_results | numeric | | 50 +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | + +## action: 'network reputation user override' +TCA-0408 - Override user network location reputation + +Type: **generic** +Read only: **False** + +TCA-0408 - Override user network location reputation + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**override_list** | required | Network Reputation User Override | string | +**remove_overrides_list** | optional | List of network locations whose classification override needs to be removed | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success or failed +action_result.parameter.override_list | string | | { "network_location": "http://example.com", "type": "url", "classification": "malicious", "categories": ["phishing"] } +action_result.parameter.remove_overrides_list | string | | { "network_location": "http://example.com", "type": "url" } +action_result.message | string | | +summary.total_objects | numeric | | +summary.total_objects_successful | numeric | | diff --git a/readme.html b/readme.html deleted file mode 100644 index b7bfa24..0000000 --- a/readme.html +++ /dev/null @@ -1,11 +0,0 @@ - diff --git a/release_notes/1.1.0.md b/release_notes/1.1.0.md new file mode 100644 index 0000000..2b8e4fa --- /dev/null +++ b/release_notes/1.1.0.md @@ -0,0 +1,4 @@ +* Added new actions: + * get url analysis feed from date - TCA - 0403 - Get url analysis feed from date + * get latest url analysis feed - TCA - 0403 - Get latest url analysis feed + * get downloaded files - TCA - 0403 - Get files downloaded from url \ No newline at end of file diff --git a/release_notes/1.2.0.md b/release_notes/1.2.0.md new file mode 100644 index 0000000..95a3bf9 --- /dev/null +++ b/release_notes/1.2.0.md @@ -0,0 +1,8 @@ +* Added new actions: + * get network reputation - TCA - 0407 - Get reputation of a requested URL, domain or IP address + * get list user overrides - TCA - 0408 - Get user URL classification overrides + * get list user overrides aggregated - TCA - 0408 - Get user URL classification overrides aggregated + * network reputation user override - TCA - 0408 - Override user network location reputation +* Updated ReversingLabs SDK library version: + * reversinglabs_sdk_py3-2.1.1 upgraded to reversinglabs_sdk_py3-2.3.0 +* Adjusted and unified CSS styles accross all custom views \ No newline at end of file diff --git a/requirements.txt b/requirements.txt index 10af50f..4e1cb03 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1 +1 @@ -reversinglabs-sdk-py3==2.1.1 +reversinglabs-sdk-py3==2.3.0 diff --git a/reversinglabs_ticloudv2.json b/reversinglabs_ticloudv2.json index 9eed816..c5b4613 100644 --- a/reversinglabs_ticloudv2.json +++ b/reversinglabs_ticloudv2.json @@ -12,12 +12,12 @@ "publisher": "ReversingLabs", "contributors": [ { - "name": "ivukovicRL" + "name": "DinkoReversingLabs" } ], "license": "Copyright (c) ReversingLabs, 2023", - "app_version": "1.0.1", - "utctime_updated": "2023-03-14T11:16:58.519975Z", + "app_version": "1.2.0", + "utctime_updated": "2023-10-20T11:31:29.572259Z", "package_name": "phantom_reversinglabs_ticloudv2", "main_module": "reversinglabs_ticloudv2_connector.py", "min_phantom_version": "5.5.0", @@ -1231,6 +1231,378 @@ }, "versions": "EQ(*)" }, + { + "action": "get downloaded files", + "identifier": "get_url_downloaded_files", + "description": "TCA - 0403 - Get files downloaded from url", + "verbose": "Accepts a URL string and returns a list of downloaded files aggregated through multiple pages of results.", + "type": "generic", + "read_only": false, + "parameters": { + "url": { + "description": "URL string", + "data_type": "string", + "required": true, + "primary": true, + "contains": [], + "value_list": [], + "default": "", + "order": 0, + "name": "url", + "id": 1, + "param_name": "url" + }, + "extended": { + "description": "Return extended report", + "data_type": "boolean", + "required": false, + "primary": false, + "contains": [], + "default": true, + "order": 1, + "name": "extended", + "id": 2, + "param_name": "extended" + }, + "classification": { + "description": "Return only files of this classification", + "data_type": "string", + "required": false, + "primary": false, + "contains": [], + "value_list": [], + "default": "", + "order": 2, + "name": "classification", + "id": 3, + "param_name": "classification" + }, + "last_analysis": { + "description": "Return only files from the last analysis", + "data_type": "boolean", + "required": false, + "primary": false, + "contains": [], + "default": false, + "order": 3, + "name": "last_analysis", + "id": 4, + "param_name": "last_analysis" + }, + "analysis_id": { + "description": "Return only files from this analysis", + "data_type": "string", + "required": false, + "primary": false, + "contains": [], + "value_list": [], + "default": "", + "order": 4, + "name": "analysis_id", + "id": 5, + "param_name": "analysis_id" + }, + "results_per_page": { + "description": "Number of results to be returned in one page, maximum value is 1000", + "data_type": "numeric", + "required": false, + "primary": false, + "contains": [], + "value_list": [], + "default": 1000, + "order": 5, + "name": "results_per_page", + "id": 6, + "param_name": "results_per_page" + }, + "max_results": { + "description": "Maximum results to be returned in the list", + "data_type": "numeric", + "required": false, + "primary": false, + "contains": [], + "value_list": [], + "default": 5000, + "order": 6, + "name": "max_results", + "id": 7, + "param_name": "max_results" + } + }, + "output": [ + { + "data_path": "action_result.parameter.url", + "data_type": "string", + "contains": [], + "column_name": "url", + "column_order": 0 + }, + { + "data_path": "action_result.parameter.extended", + "data_type": "boolean", + "contains": [], + "column_name": "extended", + "column_order": 1 + }, + { + "data_path": "action_result.parameter.classification", + "data_type": "string", + "contains": [], + "column_name": "classification", + "column_order": 2 + }, + { + "data_path": "action_result.parameter.last_analysis", + "data_type": "boolean", + "contains": [], + "column_name": "last_analysis", + "column_order": 3 + }, + { + "data_path": "action_result.parameter.analysis_id", + "data_type": "string", + "contains": [], + "column_name": "analysis_id", + "column_order": 4 + }, + { + "data_path": "action_result.parameter.results_per_page", + "data_type": "numeric", + "contains": [], + "column_name": "results_per_page", + "column_order": 5 + }, + { + "data_path": "action_result.parameter.max_results", + "data_type": "numeric", + "contains": [], + "column_name": "max_results", + "column_order": 6 + }, + { + "data_path": "action_result.status", + "data_type": "string", + "column_name": "status", + "column_order": 7 + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "render": { + "type": "custom", + "width": 10, + "height": 5, + "view": "reversinglabs_ticloudv2_views.url_downloaded_files", + "title": "TitaniumCloud Url Downloaded Files" + }, + "versions": "EQ(*)" + }, + { + "action": "get latest url analysis feed", + "identifier": "get_latest_url_analysis_feed", + "description": "TCA - 0403 - Get latest url analysis feed", + "verbose": "Returns the latest URL analyses reports aggregated as list.", + "type": "generic", + "read_only": false, + "parameters": { + "results_per_page": { + "description": "Number of results to be returned in one page, maximum value is 1000", + "data_type": "numeric", + "required": false, + "primary": false, + "contains": [], + "value_list": [], + "default": 1000, + "order": 0, + "name": "results_per_page", + "id": 1, + "param_name": "results_per_page" + }, + "max_results": { + "description": "Maximum results to be returned in the list", + "data_type": "numeric", + "required": false, + "primary": false, + "contains": [], + "value_list": [], + "default": 5000, + "order": 1, + "name": "max_results", + "id": 2, + "param_name": "max_results" + } + }, + "output": [ + { + "data_path": "action_result.parameter.results_per_page", + "data_type": "numeric", + "contains": [], + "column_name": "results_per_page", + "column_order": 0 + }, + { + "data_path": "action_result.parameter.max_results", + "data_type": "numeric", + "contains": [], + "column_name": "max_results", + "column_order": 1 + }, + { + "data_path": "action_result.status", + "data_type": "string", + "column_name": "status", + "column_order": 2 + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "render": { + "type": "custom", + "width": 10, + "height": 5, + "view": "reversinglabs_ticloudv2_views.latest_url_analysis_feed", + "title": "TitaniumCloud Latest Url Analysis Feed" + }, + "versions": "EQ(*)" + }, + { + "action": "get url analysis feed from date", + "identifier": "get_url_analysis_feed_from_date", + "description": "TCA - 0403 - Get url analysis feed from date", + "verbose": "Accepts time format and a start time and returns URL analyses report from that defined time onward aggregated as a list.", + "type": "generic", + "read_only": false, + "parameters": { + "time_format": { + "description": "Possible values: 'utc' or 'timestamp'", + "data_type": "string", + "required": true, + "primary": false, + "contains": [], + "value_list": [], + "default": "timestamp", + "order": 0, + "name": "time_format", + "id": 1, + "param_name": "time_format" + }, + "start_time": { + "description": "Time from which to retrieve results onwards", + "data_type": "string", + "required": true, + "primary": false, + "contains": [], + "value_list": [], + "default": "", + "order": 1, + "name": "start_time", + "id": 2, + "param_name": "start_time" + }, + "results_per_page": { + "description": "Number of results to be returned in one page, maximum value is 1000", + "data_type": "numeric", + "required": false, + "primary": false, + "contains": [], + "value_list": [], + "default": 1000, + "order": 2, + "name": "results_per_page", + "id": 3, + "param_name": "results_per_page" + }, + "max_results": { + "description": "Maximum results to be returned in the list", + "data_type": "numeric", + "required": false, + "primary": false, + "contains": [], + "value_list": [], + "default": 5000, + "order": 3, + "name": "max_results", + "id": 4, + "param_name": "max_results" + } + }, + "output": [ + { + "data_path": "action_result.parameter.time_format", + "data_type": "string", + "contains": [], + "column_name": "time_format", + "column_order": 0 + }, + { + "data_path": "action_result.parameter.start_time", + "data_type": "string", + "contains": [], + "column_name": "start_time", + "column_order": 1 + }, + { + "data_path": "action_result.parameter.results_per_page", + "data_type": "numeric", + "contains": [], + "column_name": "results_per_page", + "column_order": 2 + }, + { + "data_path": "action_result.parameter.max_results", + "data_type": "numeric", + "contains": [], + "column_name": "max_results", + "column_order": 3 + }, + { + "data_path": "action_result.status", + "data_type": "string", + "column_name": "status", + "column_order": 4 + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "render": { + "type": "custom", + "width": 10, + "height": 5, + "view": "reversinglabs_ticloudv2_views.url_analysis_feed_from_date", + "title": "TitaniumCloud Url Analysis Feed From Date" + }, + "versions": "EQ(*)" + }, { "action": "analyze url", "identifier": "analyze_url", @@ -1840,6 +2212,250 @@ "type": "table" }, "versions": "EQ(*)" + }, + { + "action": "get network reputation", + "identifier": "get_network_reputation", + "description": "Network Reputation API", + "verbose": "Service provides information regarding the reputation of a requested URL, domain, or IP address.", + "type": "generic", + "read_only": false, + "parameters": { + "network_locations": { + "description": "Network location to check (URL,DNS,IP)", + "data_type": "string", + "required": true, + "primary": false, + "contains": [], + "value_list": [], + "default": "", + "order": 0, + "name": "network_locations", + "id": 1, + "param_name": "network_locations" + } + }, + "output": [ + { + "data_path": "action_result.parameter.network_locations", + "data_type": "string", + "contains": [], + "column_name": "network_locations", + "column_order": 0 + }, + { + "data_path": "action_result.status", + "data_type": "string", + "column_name": "status", + "column_order": 1 + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "render": { + "type": "custom", + "width": 10, + "height": 5, + "view": "reversinglabs_ticloudv2_views.network_reputation", + "title": "TitaniumCloud Network Reputation" + }, + "versions": "EQ(*)" + }, + { + "action": "get list user overrides", + "identifier": "get_list_user_overrides", + "description": "List User Overrides", + "verbose": "The Network Reputation User Override service enables URL classification overrides. Any URL can be overridden to malicious, suspicious, or known.", + "type": "generic", + "read_only": false, + "parameters": { + "next_page_sha1": { + "description": "Optional parameter used for pagination", + "data_type": "string", + "required": false, + "primary": false, + "contains": [], + "value_list": [], + "default": "", + "order": 0, + "name": "next_page_sha1" + } + }, + "output": [ + { + "data_path": "action_result.parameter.next_page_sha1", + "data_type": "string", + "contains": [], + "column_name": "next_page_sha1", + "column_order": 0 + }, + { + "data_path": "action_result.status", + "data_type": "string", + "column_name": "status", + "column_order": 1 + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "render": { + "type": "custom", + "width": 10, + "height": 5, + "view": "reversinglabs_ticloudv2_views.list_user_overrides", + "title": "TitaniumCloud List User Overrides" + }, + "versions": "EQ(*)" + }, + { + "action": "get list user overrides aggregated", + "identifier": "get_list_user_overrides_aggregated", + "description": "Returns a list of overrides that the user has made", + "verbose": "This API automatically handles paging and returns a list of results instead of a Response object.", + "type": "generic", + "read_only": false, + "parameters": { + "max_results": { + "description": "Maximum number of results to be returned in the list", + "data_type": "numeric", + "required": false, + "primary": false, + "contains": [], + "value_list": [], + "default": "", + "order": 0, + "name": "max_results" + } + }, + "output": [ + { + "data_path": "action_result.parameter.max_results", + "data_type": "numeric", + "contains": [], + "column_name": "max_results", + "column_order": 0 + }, + { + "data_path": "action_result.status", + "data_type": "string", + "column_name": "status", + "column_order": 1 + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "render": { + "type": "custom", + "width": 10, + "height": 5, + "view": "reversinglabs_ticloudv2_views.list_user_overrides_aggregated", + "title": "TitaniumCloud List User Overrides Aggregated" + }, + "versions": "EQ(*)" + }, + { + "action": "network reputation user override", + "identifier": "network_reputation_user_override", + "description": "Network Reputation User Override", + "verbose": "The Network Reputation User Override service enables URL classification overrides.", + "type": "generic", + "read_only": false, + "parameters": { + "override_list": { + "description": "List of network locations whose classification needs to be overriden", + "data_type": "string", + "required": true, + "primary": false, + "contains": [], + "value_list": [], + "default": "", + "order": 0, + "name": "override_list" + }, + "remove_overrides_list": { + "description": "List of network locations whose classification override needs to be removed", + "data_type": "string", + "required": false, + "primary": false, + "contains": [], + "value_list": [], + "default": "", + "order": 1, + "name": "remove_overrides_list" + } + }, + "output": [ + { + "data_path": "action_result.parameter.override_list", + "data_type": "string", + "contains": [], + "column_name": "override_list", + "column_order": 0 + }, + { + "data_path": "action_result.parameter.remove_overrides_list", + "data_type": "string", + "contains": [], + "column_name": "remove_overrides_list", + "column_order": 1 + }, + { + "data_path": "action_result.status", + "data_type": "string", + "column_name": "status", + "column_order": 2 + }, + { + "data_path": "action_result.message", + "data_type": "string" + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric" + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric" + } + ], + "render": { + "type": "custom", + "width": 10, + "height": 5, + "view": "reversinglabs_ticloudv2_views.network_reputation_user_override", + "title": "TitaniumCloud Network Reputation User Overrides" + }, + "versions": "EQ(*)" } ], "custom_made": true, @@ -1867,7 +2483,7 @@ }, { "module": "reversinglabs_sdk_py3", - "input_file": "wheels/py3/reversinglabs_sdk_py3-2.1.1-py3-none-any.whl" + "input_file": "wheels/py3/reversinglabs_sdk_py3-2.3.0-py3-none-any.whl" }, { "module": "urllib3", @@ -1875,4 +2491,4 @@ } ] } -} \ No newline at end of file +} diff --git a/reversinglabs_ticloudv2_connector.py b/reversinglabs_ticloudv2_connector.py index 89b04e3..2fc3092 100644 --- a/reversinglabs_ticloudv2_connector.py +++ b/reversinglabs_ticloudv2_connector.py @@ -27,8 +27,8 @@ from phantom.base_connector import BaseConnector from phantom.vault import Vault from ReversingLabs.SDK.ticloud import (AdvancedSearch, AnalyzeURL, AVScanners, DynamicAnalysis, FileAnalysis, FileDownload, FileReputation, - ImpHashSimilarity, ReanalyzeFile, RHA1FunctionalSimilarity, URIIndex, URIStatistics, - URLThreatIntelligence, YARAHunting, YARARetroHunting) + ImpHashSimilarity, NetworkReputation, NetworkReputationUserOverride, ReanalyzeFile, + RHA1FunctionalSimilarity, URIIndex, URIStatistics, URLThreatIntelligence, YARAHunting, YARARetroHunting) # Our helper lib reversinglabs-sdk-py3 internally utilizes pypi requests (with named parameters) which is shadowed by Phantom # requests (which has renamed parameters (url>>uri), hence this workarounds @@ -62,7 +62,7 @@ def new_delete(url, **kwargs): class ReversinglabsTitaniumCloudV2Connector(BaseConnector): ticloud_spex_url = "/api/spex/upload/" - USER_AGENT = "ReversingLabs Splunk SOAR TitaniumCloud v1.0.0" + USER_AGENT = "ReversingLabs Splunk SOAR TitaniumCloudv2 v1.2.0" # The actions supported by this connector ACTION_ID_TEST_CONNECTIVITY = "test_connectivity" @@ -91,6 +91,13 @@ class ReversinglabsTitaniumCloudV2Connector(BaseConnector): ACTION_ID_YARA_RETRO_CHECK_STATUS = "yara_retro_check_status" ACTION_ID_YARA_RETRO_CANCEL_HUNT = "yara_retro_cancel_hunt" ACTION_ID_GET_YARA_RETRO_MATCHES = "get_yara_retro_matches" + ACTION_ID_GET_URL_DOWNLOADED_FILES = "get_url_downloaded_files" + ACTION_ID_GET_LATEST_URL_ANALYSIS_FEED = "get_latest_url_analysis_feed" + ACTION_ID_GET_URL_ANALYSIS_FEED_FROM_DATE = "get_url_analysis_feed_from_date" + ACTION_ID_GET_NETWORK_REPUTATION = "get_network_reputation" + ACTION_ID_GET_LIST_USER_OVERRIDES = "get_list_user_overrides" + ACTION_ID_GET_LIST_USER_OVERRIDES_AGGREGATED = "get_list_user_overrides_aggregated" + ACTION_ID_NETWORK_REPUTATION_USER_OVERRIDE = "network_reputation_user_override" def __init__(self): # Call the BaseConnectors init first @@ -123,6 +130,13 @@ def __init__(self): self.ACTION_ID_YARA_RETRO_CHECK_STATUS: self._handle_yara_retro_check_status, self.ACTION_ID_YARA_RETRO_CANCEL_HUNT: self._handle_yara_retro_cancel_hunt, self.ACTION_ID_GET_YARA_RETRO_MATCHES: self._handle_get_yara_retro_matches, + self.ACTION_ID_GET_URL_DOWNLOADED_FILES: self._handle_get_url_downloaded_files, + self.ACTION_ID_GET_LATEST_URL_ANALYSIS_FEED: self._handle_get_latest_url_analysis_feed, + self.ACTION_ID_GET_URL_ANALYSIS_FEED_FROM_DATE: self._handle_get_url_analysis_feed_from_date, + self.ACTION_ID_GET_NETWORK_REPUTATION: self._handle_get_network_reputation, + self.ACTION_ID_GET_LIST_USER_OVERRIDES: self._handle_get_list_user_overrides, + self.ACTION_ID_GET_LIST_USER_OVERRIDES_AGGREGATED: self._handle_get_list_user_overrides_aggregated, + self.ACTION_ID_NETWORK_REPUTATION_USER_OVERRIDE: self._handle_network_reputation_user_override } self._state = None @@ -282,6 +296,68 @@ def _handle_url_reputation(self, action_result, param): action_result.add_data(response.json()) + def _handle_get_url_downloaded_files(self, action_result, param): + self.debug_print("Action handler", self.get_action_identifier()) + + url_intelligence = URLThreatIntelligence( + host=self.ticloud_base_url, + username=self.ticloud_username, + password=self.ticloud_password, + user_agent=self.USER_AGENT + ) + response = url_intelligence.get_downloaded_files_aggregated( + url_input=param.get("url"), + extended=param.get("extended"), + classification=param.get("classification"), + last_analysis=param.get("last_analysis"), + analysis_id=param.get("analysis_id"), + results_per_page=param.get("results_per_page"), + max_results=param.get("max_results") + ) + + self.debug_print("Executed", self.get_action_identifier()) + for x in response: + action_result.add_data(x) + + def _handle_get_latest_url_analysis_feed(self, action_result, param): + self.debug_print("Action handler", self.get_action_identifier()) + + url_intelligence = URLThreatIntelligence( + host=self.ticloud_base_url, + username=self.ticloud_username, + password=self.ticloud_password, + user_agent=self.USER_AGENT + ) + response = url_intelligence.get_latest_url_analysis_feed_aggregated( + results_per_page=param.get("results_per_page"), + max_results=param.get("max_results") + ) + + self.debug_print("Executed", self.get_action_identifier()) + for x in response: + action_result.add_data(x) + + def _handle_get_url_analysis_feed_from_date(self, action_result, param): + self.debug_print("Action handler", self.get_action_identifier()) + + url_intelligence = URLThreatIntelligence( + host=self.ticloud_base_url, + username=self.ticloud_username, + password=self.ticloud_password, + user_agent=self.USER_AGENT + ) + + response = url_intelligence.get_url_analysis_feed_from_date_aggregated( + time_format=param.get("time_format"), + start_time=param.get("start_time"), + results_per_page=param.get("results_per_page"), + max_results=param.get("max_results") + ) + + self.debug_print("Executed", self.get_action_identifier()) + for x in response: + action_result.add_data(x) + def _handle_analyze_url(self, action_result, param): self.debug_print("Action handler", self.get_action_identifier()) @@ -611,6 +687,77 @@ def _handle_get_yara_retro_matches(self, action_result, param): action_result.add_data(response.json()) + def _handle_get_network_reputation(self, action_result, param): + self.debug_print("Action handler", self.get_action_identifier()) + + network_reputation = NetworkReputation( + host=self.ticloud_base_url, + username=self.ticloud_username, + password=self.ticloud_password, + user_agent=self.USER_AGENT + ) + + response = network_reputation.get_network_reputation( + network_locations=list(param.get("network_locations").split()) + ) + + self.debug_print("Executed", self.get_action_identifier()) + action_result.add_data(response.json()) + + def _handle_get_list_user_overrides(self, action_result, param): + self.debug_print("Action handler", self.get_action_identifier()) + + list_user_override = NetworkReputationUserOverride( + host=self.ticloud_base_url, + username=self.ticloud_username, + password=self.ticloud_password, + user_agent=self.USER_AGENT + ) + + response = list_user_override.list_overrides( + next_page_sha1=param.get("next_page_sha1") + ) + + self.debug_print("Executed", self.get_action_identifier()) + action_result.add_data(response.json()) + + def _handle_get_list_user_overrides_aggregated(self, action_result, param): + self.debug_print("Action handler", self.get_action_identifier()) + + override_list = NetworkReputationUserOverride( + host=self.ticloud_base_url, + username=self.ticloud_username, + password=self.ticloud_password, + user_agent=self.USER_AGENT + ) + + response = override_list.list_overrides_aggregated( + max_results=param.get("max_results") + ) + + self.debug_print("Executed", self.get_action_identifier()) + action_result.add_data(response) + + def _handle_network_reputation_user_override(self, action_result, param): + self.debug_print("Action handler", self.get_action_identifier()) + + override_list = NetworkReputationUserOverride( + host=self.ticloud_base_url, + username=self.ticloud_username, + password=self.ticloud_password, + user_agent=self.USER_AGENT + ) + + list_override = [json.loads(param.get("override_list"))] + + response = override_list.reputation_override( + override_list=list_override, + remove_overrides_list=[] + ) + + self.debug_print("Executed", self.get_action_identifier()) + action_result.add_data(response.json()) + def _handle_test_connectivity(self, action_result, param): self.debug_print("Action handler", self.get_action_identifier()) diff --git a/reversinglabs_ticloudv2_views.py b/reversinglabs_ticloudv2_views.py index 8e3c9aa..8485fc6 100644 --- a/reversinglabs_ticloudv2_views.py +++ b/reversinglabs_ticloudv2_views.py @@ -8,11 +8,11 @@ # # http://www.apache.org/licenses/LICENSE-2.0 # -# Unless required by applicable law or agreed to in writing, software distributed under -# the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, -# either express or implied. See the License for the specific language governing permissions -# and limitations under the License. -# +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. + def file_reputation(provides, all_app_runs, context): for summary, action_results in all_app_runs: @@ -89,6 +89,37 @@ def url_reputation(provides, all_app_runs, context): return 'views/reversinglabs_ticloudv2_url_reputation.html' +def url_downloaded_files(provides, all_app_runs, context): + for summary, action_results in all_app_runs: + for result in action_results: + context['data'] = result.get_data() + for x in context['data']: + x["classification_color"] = color_code_classification(x.get("classification").upper()) + + context['param'] = result.get_param() + return 'views/reversinglabs_ticloudv2_url_downloaded_files.html' + + +def latest_url_analysis_feed(provides, all_app_runs, context): + for summary, action_results in all_app_runs: + for result in action_results: + context['data'] = result.get_data() + + context['param'] = result.get_param() + + return 'views/reversinglabs_ticloudv2_url_analysis_feed.html' + + +def url_analysis_feed_from_date(provides, all_app_runs, context): + for summary, action_results in all_app_runs: + for result in action_results: + context['data'] = result.get_data() + + context['param'] = result.get_param() + + return 'views/reversinglabs_ticloudv2_url_analysis_feed.html' + + def analyze_url(provides, all_app_runs, context): for summary, action_results in all_app_runs: for result in action_results: @@ -182,6 +213,58 @@ def uri_index(provides, all_app_runs, context): return 'views/reversinglabs_ticloudv2_uri_index.html' +def network_reputation(provides, all_app_runs, context): + for summary, action_results in all_app_runs: + for result in action_results: + data = {} + + entries = result.get_data()[0].get("rl", {}).get("entries") + data["entries"] = entries + + context["data"] = data + + return 'views/reversinglabs_ticloudv2_network_reputation_view.html' + + +def list_user_overrides(provides, all_app_runs, context): + for summary, action_results in all_app_runs: + for result in action_results: + data = {} + + user_override = result.get_data()[0].get("rl", {}).get("user_override") + data["user_override"] = user_override + + context["data"] = data + + return 'views/reversinglabs_ticloudv2_list_user_overrides_view.html' + + +def list_user_overrides_aggregated(provides, all_app_runs, context): + for summary, action_results in all_app_runs: + for result in action_results: + data = {} + + network_locations = result.get_data()[0] + data["network_locations"] = network_locations + + context["data"] = data + + return 'views/reversinglabs_ticloudv2_list_user_overrides_aggregated_view.html' + + +def network_reputation_user_override(provides, all_app_runs, context): + for summary, action_results in all_app_runs: + for result in action_results: + data = {} + + user_override = result.get_data()[0].get("rl", {}).get("user_override") + data["user_override"] = user_override + + context["data"] = data + + return 'views/reversinglabs_ticloudv2_network_reputation_user_override_view.html' + + def color_code_classification(classification): color = "" classification = classification.upper() diff --git a/views/reversinglabs_ticloudv2_advanced_search.html b/views/reversinglabs_ticloudv2_advanced_search.html index 90460ab..619dda9 100644 --- a/views/reversinglabs_ticloudv2_advanced_search.html +++ b/views/reversinglabs_ticloudv2_advanced_search.html @@ -16,6 +16,20 @@ background-repeat: no-repeat; background-image: url('/app_resource/{{ title_logo }}');"{% endif %}{% endblock %} {% block widget_content %} +
+ {% if data.network_locations == None %} + There is no network location overrides object in the response JSON. + {% else %} + + + + + {% for net_loc in data.network_locations %} + + + + + + + + + + {% endfor %} +
Network location {{net_loc.network_location}}
Type {{net_loc.type}}
+ {% endif %} +
+{% endblock %} \ No newline at end of file diff --git a/views/reversinglabs_ticloudv2_list_user_overrides_view.html b/views/reversinglabs_ticloudv2_list_user_overrides_view.html new file mode 100644 index 0000000..b93df92 --- /dev/null +++ b/views/reversinglabs_ticloudv2_list_user_overrides_view.html @@ -0,0 +1,121 @@ + + +{% extends 'widgets/widget_template.html' %} +{% load custom_template %} +{% block custom_title_prop %}{% if title_logo %}style="background-size: auto 60%; background-position: 50%; +background-repeat: no-repeat; background-image: url('/app_resource/{{ title_logo }}');"{% endif %}{% endblock %} +{% block widget_content %} + +
+ {% if data.user_override == None %} + There is no overrides for network locations object in the response JSON. + {% else %} + + + + + {% for net_loc in data.user_override.network_locations %} + + + + + + + + + + {% endfor %} +
Network location {{net_loc.network_location}}
Type {{net_loc.type}}
+ {% endif %} +
+{% endblock %} \ No newline at end of file diff --git a/views/reversinglabs_ticloudv2_network_reputation_user_override_view.html b/views/reversinglabs_ticloudv2_network_reputation_user_override_view.html new file mode 100644 index 0000000..d7e314e --- /dev/null +++ b/views/reversinglabs_ticloudv2_network_reputation_user_override_view.html @@ -0,0 +1,136 @@ + + +{% extends 'widgets/widget_template.html' %} +{% load custom_template %} +{% block custom_title_prop %}{% if title_logo %}style="background-size: auto 60%; background-position: 50%; +background-repeat: no-repeat; background-image: url('/app_resource/{{ title_logo }}');"{% endif %}{% endblock %} +{% block widget_content %} + +
+ {% if data.user_override == None %} + There is no network location object in the response JSON. + {% else %} + + + + + {% for over in data.user_override.created_overrides %} + + + + + + + + + + + + + + + + + + + + + + + + + {% endfor %} +
Network reputation user override
Network location {{over.network_location}}
Type {{over.type}}
Classification {{over.classification}}
Categories {{over.categories}}
Reason {{over.reason}}
+ {% endif %} +
+{% endblock %} \ No newline at end of file diff --git a/views/reversinglabs_ticloudv2_network_reputation_view.html b/views/reversinglabs_ticloudv2_network_reputation_view.html new file mode 100644 index 0000000..3459b94 --- /dev/null +++ b/views/reversinglabs_ticloudv2_network_reputation_view.html @@ -0,0 +1,235 @@ + + +{% extends 'widgets/widget_template.html' %} +{% load custom_template %} +{% block custom_title_prop %}{% if title_logo %}style="background-size: auto 60%; background-position: 50%; +background-repeat: no-repeat; background-image: url('/app_resource/{{ title_logo }}');"{% endif %}{% endblock %} +{% block widget_content %} + + + + + +
+ {% if data.entries == None %} + There is no network location object in the response JSON. + {% else %} + {% for net_loc in data.entries %} +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ReversingLabs Network Reputation for {{net_loc.type}}
Requested network location {{net_loc.requested_network_location}}
Type {{net_loc.type}}
Associated malware {{net_loc.associated_malware}}
First seen {{net_loc.first_seen}}
Last seen {{net_loc.last_seen}}
Third party reputations + Total: {{net_loc.third_party_reputations.total}} + Clean: {{net_loc.third_party_reputations.clean}} + Malicious: {{net_loc.third_party_reputations.malicious}} + Undetected: {{net_loc.third_party_reputations.undetected}} +
+ +
+ + {% endfor %} + {% endif %} +
+ +{% endblock %} diff --git a/views/reversinglabs_ticloudv2_submit_for_dynamic.html b/views/reversinglabs_ticloudv2_submit_for_dynamic.html index 47727ee..19a9482 100644 --- a/views/reversinglabs_ticloudv2_submit_for_dynamic.html +++ b/views/reversinglabs_ticloudv2_submit_for_dynamic.html @@ -16,6 +16,20 @@ background-repeat: no-repeat; background-image: url('/app_resource/{{ title_logo }}');"{% endif %}{% endblock %} {% block widget_content %} +
+ + + + + + + + + + + + + + {% for x in data %} + + + + + + + + {% endfor %} + + +
ReversingLabs TitaniumCLoud Url Analysis Feed
+ {% if param.time_format != None %} +
{{param.time_format}}: {{param.start_time}}
+ {% endif %} +
Results found: {{data|length}}
+
Url Analysis id Analysis time Availability status
{{ forloop.counter}}.{{ x.url}} {{ x.analysis_id }}{{ x.analysis_time }}{{ x.availability_status }}
+
+{% endblock %} diff --git a/views/reversinglabs_ticloudv2_url_downloaded_files.html b/views/reversinglabs_ticloudv2_url_downloaded_files.html new file mode 100644 index 0000000..3443f87 --- /dev/null +++ b/views/reversinglabs_ticloudv2_url_downloaded_files.html @@ -0,0 +1,116 @@ +{% extends 'widgets/widget_template.html' %} +{% load custom_template %} +{% block custom_title_prop %}{% if title_logo %}style="background-size: auto 60%; background-position: 50%; +background-repeat: no-repeat; background-image: url('/app_resource/{{ title_logo }}');"{% endif %}{% endblock %} +{% block widget_content %} + +
+ + + + + + + + + + + + + + + + + {% for x in data %} + + + + + + + + + + + {% endfor %} + + +
ReversingLabs TitaniumCloud Downloaded Files From Url
+
{{param.url}}
+
Results found: {{data|length}}
+
SHA1 Sample type Threat name Malware type Threat level Trust factor Classification
{{ forloop.counter}}.{{ x.sha1}}{{ x.sample_type }}{{ x.threat_name }}{{ x.malware_type }}{{ x.threat_level }}{{ x.trust_factor }} + {{ x.classification }} +
+
+{% endblock %} diff --git a/views/reversinglabs_ticloudv2_url_reputation.html b/views/reversinglabs_ticloudv2_url_reputation.html index f711a4a..ca81339 100644 --- a/views/reversinglabs_ticloudv2_url_reputation.html +++ b/views/reversinglabs_ticloudv2_url_reputation.html @@ -16,6 +16,20 @@ background-repeat: no-repeat; background-image: url('/app_resource/{{ title_logo }}');"{% endif %}{% endblock %} {% block widget_content %}