Binalyze AIR

Details

ID	`Binalyze AIR`
Provider	Binalyze
Category	Forensics & Malware Analysis
From Version	6.2.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Binalyze AIR Integration

This integration allows you to use the Binalyze AIR’s isolation and evidence collecting features easily

Collect your forensics data under 10 minutes.
This integration was integrated and tested with version 2.6.2 of Binalyze AIR

Configure Binalyze AIR in Cortex

Parameter	Description	Required
Binalyze AIR Server URL	Binalyze AIR Server URL	True
API Key	e.g.: api_1234567890abcdef1234567890abcdef	True
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

binalyze-air-isolate

Isolate an endpoint

Base Command

binalyze-air-isolate

Input

Argument Name	Description	Required
hostname	Hostname of endpoint.	Required
organization_id	Organization ID of the endpoint. For the use of a custom organization ID, you can specify a custom value outside the predefined set.	Required
isolation	To isolate use enable. Possible values are: enable, disable.	Required

Context Output

Path	Type	Description
BinalyzeAIR.Isolate.result._id	string	Isolation unique task ID
BinalyzeAIR.Isolate.result.name	string	Isolation task name
BinalyzeAIR.Isolate.result.organizationId	number	Organization Id of endpoint

binalyze-air-acquire

Acquire evidence from an endpoint

Base Command

binalyze-air-acquire

Input

Argument Name	Description	Required
hostname	Hostname of endpoint.	Required
profile	Acquisition profile. To use a custom acquisition profile, you can specify a custom value outside the predefined set. Possible values are: compromise-assessment, browsing-history, event-logs, memory-ram-pagefile, quick, full.	Required
case_id	ID for the case,e.g. C-2022-0001.	Required
organization_id	Organization ID of the endpoint. For the use of a custom organization ID, you can specify a custom value outside the predefined set.	Required

Context Output

Path	Type	Description
BinalyzeAIR.Acquire.result._id	string	Acquisition unique task ID
BinalyzeAIR.Acquire.result.name	string	Acquisiton task name
BinalyzeAIR.Acquire.result.organizationId	number	Organization Id of endpoint

Configuration parameters

server — Binalyze AIR Server URL (required)
api_key — API Key (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (2)

binalyze-air-acquire
Acquire evidence from an endpoint.
binalyze-air-isolate
Isolate an endpoint.

Source

BinalyzeAIR.py BinalyzeAIR_test.py BinalyzeAIR.yml BinalyzeAIR_description.md command_examples.txt

Download History Raw

commonfields:
  id: Binalyze AIR
  version: -1
name: Binalyze AIR
display: Binalyze AIR
category: Forensics & Malware Analysis
provider: Binalyze
description: Collect your forensics data under 10 minutes.
configuration:
- display: Binalyze AIR Server URL
  name: server
  type: 0
  required: true
  additionalinfo: Binalyze AIR Server URL
- display: API Key
  name: api_key
  type: 4
  required: true
  additionalinfo: 'e.g.: api_1234567890abcdef1234567890abcdef'
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  script: ''
  type: python
  commands:
  - name: binalyze-air-isolate
    arguments:
    - name: hostname
      required: true
      description: Hostname of endpoint.
    - name: organization_id
      required: true
      auto: PREDEFINED
      predefined:
      - '0'
      - '1'
      - '2'
      description: Organization ID of the endpoint. For a custom organization ID, you can specify a custom value outside the predefined set.
    - name: isolation
      required: true
      auto: PREDEFINED
      predefined:
      - enable
      - disable
      description: To isolate use enable.
    outputs:
    - contextPath: BinalyzeAIR.Isolate.result._id
      description: Isolation unique task ID.
      type: string
    - contextPath: BinalyzeAIR.Isolate.result.name
      description: Isolation task name.
      type: string
    - contextPath: BinalyzeAIR.Isolate.result.organizationId
      description: Organization Id of endpoint.
      type: number
    description: Isolate an endpoint.
  - name: binalyze-air-acquire
    arguments:
    - name: hostname
      required: true
      description: Hostname of endpoint.
    - name: profile
      required: true
      auto: PREDEFINED
      predefined:
      - compromise-assessment
      - browsing-history
      - event-logs
      - memory-ram-pagefile
      - quick
      - full
      description: Acquisition profile. To use a custom acquisition profile, you can specify a custom profile outside the predefined set.
    - name: case_id
      required: true
      description: ID for the case,e.g. C-2022-0001.
    - name: organization_id
      required: true
      auto: PREDEFINED
      predefined:
      - '0'
      - '1'
      - '2'
      description: Organization ID of the endpoint. For a custom organization ID, you can specify a custom value outside the predefined set.
    outputs:
    - contextPath: BinalyzeAIR.Acquire.result._id
      description: Acquisition unique task ID.
      type: string
    - contextPath: BinalyzeAIR.Acquire.result.name
      description: Acquisition task name.
      type: string
    - contextPath: BinalyzeAIR.Acquire.result.organizationId
      description: Organization Id of endpoint.
      type: number
    description: Acquire evidence from an endpoint.
  dockerimage: demisto/python3:3.12.13.10116658
  subtype: python3
fromversion: 6.2.0
tests:
- No tests (auto formatted)