Hybrid Analysis Deprecated

Deprecated. Use CrowdStrike Falcon Sandbox v2 instead.

Forensics & Malware Analysis · Hybrid Analysis (Deprecated)

Details

IDHybrid Analysis
ProviderCrowdStrike
CategoryForensics & Malware Analysis
From Version5.0.0
Supported ModulesAgentix

README

Deprecated. Use the CrowdStrike Falcon Sandbox v2 integration instead.

Supported File Types

The maximum file upload size is 100 MB.

  • PE (.exe, .scr, .pif, .dll, .com, .cpl, and so on)
  • Microsoft Word (.doc, .docx, .ppt, .pps, .pptx, .ppsx, .xls, .xlsx, .rtf, .pub)
  • PDF
  • APK
  • JAR executables
  • Windows Script Component (.sct)
  • Windows Shortcut (.lnk)
  • Windows Help (.chm)
  • HTML Application (.hta)
  • Windows Script File (*.wsf)
  • Javascript (.js)
  • Visual Basic (*.vbs, *.vbe)
  • Shockwave Flash (.swf)
  • Perl (.pl)
  • PowerShell (.ps1, .psd1, .psm1)
  • Scalable Vector Graphics (.svg)
  • Python scripts (.py)
  • Perl scripts (.pl)
  • Linux ELF executables
  • MIME RFC 822 (*.eml)
  • Outlook (*.msg files)

Configure the Hybrid Analysis Integration on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Hybrid Analysis.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • Server URI: for example, https://216.128.82
    • API Key: Cortex XSOAR creates an API key, do not populate this field.
    • Secret Key (applicable for v1)
    • Do not validate server certificate (insecure)
    • Use system proxy settings
  4. Click Test to validate the URLs and token.

Use Cases

  • Submit sample files for analysis.
  • Get result data of sample files.
  • Search the Hybrid Analysis database.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. Scan a file hash: hybrid-analysis-scan
  2. Submit a sample file: hybrid-analysis-submit-sample
  3. Search Hybrid Analysis: hybrid-analysis-search
  4. Detonate a file: hybrid-analysis-detonate-file
  5. Get the status of a file submission: hybrid-analysis-get-report-status
  6. Submit a website or file URL for quick analysis: hybrid-analysis-quick-scan-url
  7. Submit a website or file URL for analysis: hybrid-analysis-submit-url
  8. Get a list of scanners: hybrid-analysis-list-scanners
  9. Get scan results: hybrid-analysis-quick-scan-url-results

1. Scan a file hash

Returns summary information for a given MD5, SHA1 or SHA256 hash, and all reports generated for any environment ID.

Base Command

hybrid-analysis-scan

Input
Argument Name Description Required
file The MD5, SHA1, or SHA256 hash of the file. Required
malicious_threat_levels Threat level values, which will determine if the file is malicious. Optional

 

Context Output
Path Type Description
File.SHA256 string SHA256 hash of the file.
File.SHA1 string SHA1 hash of the file.
File.MD5 string MD5 hash of the file.
File.environmentId string The environment ID of the file.
File.analysis_start_time string The start time of the file analysis.
File.submitname string The submission name of the file.
File.classification_tags string A list of classification tags of the file.
File.vxfamily string The family classification of the file.
File.total_network_connections string The total number of network connections of the file.
File.total_processes string The total processes count of the file.
File.total_signatures string The total signatures count of the file.
File.hosts string A list of hosts of the file.
File.isinteresting string Whether the server found the file interesting.
File.domains string A list of domains related to the file.
File.isurlanalysis string Whether the file was analyzed by a URL.
File.Malicious.Vendor string For malicious files, the vendor that made the decision.
File.Malicious.Description string For malicious files, the reason that the vendor made the decision.
DBotScore.Indicator string The indicator.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The DBot score vendor.
DBotScore.Score number The DBot score.

 

Command Example
 !hybrid-analysis-scan file=bb3bed4a07c472ad7a51c19634e33ad2c9769a27fa750f096d9cca5b5b9e4616
Human Readable Output

2. Submit a file sample

Submits a file from the investigation to the analysis server. The minimum required authorization is "default".

Base Command

hybrid-analysis-submit-sample

Input
Argument Name Description Required
entryId The War Room entry ID of the sample file. Required
environmentID The environment ID to which to submit the file. Run the vx-get-environments command to get all environment IDs. Required

 

Context Output
Path Type Description
HybridAnalysis.Submit.JobID string JobID of the submission.
HybridAnalysis.Submit.SHA256 string The SHA256 hash of the submission.
HybridAnalysis.Submit.EnvironmentID string The environment ID of the submission.

 

Command Example
 !hybrid-analysis-submit-sample entryId=413@13 environmentID=100
Human Readable Output

 

3. Search Hybrid Analysis

Performs a search on the database using the Hybrid Analysis search syntax.

Base Command

hybrid-analysis-search

Input
Argument Name Description Required
query The query to run, in the Hybrid Analysis query syntax. For more information, see `/faq#advanced-search-options`. For example: url:google, host:95.181.53.78. Optional
filename The full file name, including the file extension. Optional
filetype Filetype e.g. docx Optional
filetype_desc A description of the file type, for example, PE32 executable. Optional
env_id The environment ID. Optional
country The ISO code of the country by which to filter results, for example: swe. Optional
verdict The verdict by which to filter results. Can be "1- whitelisted", "2- no verdict", "3- "no specific threat", "4- suspicious", or "5- malicious". Optional
av_detect The AV multi-scan range (0-100) by which to filter results, for example: "50-70". Optional
vx_family The AV family substring by which to filter results, for example: "nemucod". Optional
tag The hashtag by which to filter results, for example: "ransomware". Optional
port The port by which to filter results. Optional
host The host (IP address) by which to filter results. Optional
domain The domain by which to filter results. Optional
url The HTTP request substring by which to filter results. Optional
similar_to Similar samples, for example: . Optional
context Sample context, for example: . Optional
imp_hash The import hash. Optional
ssdeep The ssdeep hash. Optional
authentihash The authentication hash. Optional
min_malicious_scanners The number of scanners that report the file as malicious to determine whether the file is malicious. Default is "2". Optional

 

Context Output
Path Type Description
HybridAnalysis.Search.SHA256 string The SHA256 hash of the search result.
HybridAnalysis.Search.SHA1 string The SHA1 hash of the search result.
HybridAnalysis.Search.MD5 string The MD5 hash of the search result.
HybridAnalysis.Search.environmentId string The environment ID of the search result.
HybridAnalysis.Search.start_time date The start time of the search result.
HybridAnalysis.Search.threatscore string The threat score of the search result, by server.
HybridAnalysis.Search.verdict string The verdict of the search result.
HybridAnalysis.Search.environmentDescription string The environment description of search result.
HybridAnalysis.Search.submitname string The submission name of the search result.
HybridAnalysis.Search.vxfamily string The family of search result.
HybridAnalysis.Search.threatscore string The threat score of the search result.
HybridAnalysis.Search.type_short string The type of search result, for example: "url" or "host".
HybridAnalysis.Search.size number The size of the search result.
File.Malicious.Vendor string For malicious files, the vendor that made the decision.
File.Malicious.Description string For malicious files, the reason that the vendor made the decision.
DBotScore.Indicator unknown The indicator.
DBotScore.Type unknown The indicator type.
DBotScore.Vendor unknown The DBotScore vendor.
DBotScore.Score unknown The DBot score.

 

Command Example
 !hybrid-analysis-search filename=fvp_setup_3.2.1.53fi.exe min_malicious_scanners=2
Human Readable Output

4. Detonate a file

Submits a file for detonation in Hybrid Analysis.

Base Command

hybrid-analysis-detonate-file

Input
Argument Name Description Required
entryId The War Room entry ID of the sample file you want to detonate. Required
environmentID The environment ID to which to submit the file for detonation. Run the vx-get-environments command to get all environment IDs. Default is 100, or other WINDOWS ID. Optional
delay The amount of time (in seconds) to wait between calls. Default is "3". Optional
timeout The total wait time (in seconds) before timeout. Default is "60". Optional
malicious_threat_levels A comma separated list of threat level values. Files that have a threat level
specified in the list will be considered malicious.		 Optional

 

Context Output
Path Type Description
File.SHA256 string The SHA256 hash of the file.
File.SHA1 string The SHA1 hash of the file.
File.MD5 string The MD5 of the file.
File.environmentalId string The environmental ID of the file.
File.analysis_start_time string The start time of the file.
File.submitname string The submission name of the file.
File.classification_tags string A list of classification tags of the file.
File.vxfamily string The family classification of the file.
File.total_network_connections string The total number of network connections of the file.
File.total_processes string The total processes count of the file.
File.total_signatures string The total signatures count of the file.
File.hosts string A list of hosts of the file.
File.isinteresting string Whether the server found the file interesting.
File.domains string A list of domains related to the file.
File.isurlanalysis string Whether the file was analyzed by a URL.
File.Malicious.Vendor string For malicious files, the vendor that made the decision.
File.Malicious.Description string For malicious files, the reason that the vendor made the decision.
DBotScore.Indicator string The indicator.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The DBot score vendor.
DBotScore.Score number The DBot score.

 

5. Get the status of a file submission

Returns the state of the file submission.

Base Command

hybrid-analysis-get-report-status

Input
Argument Name Description Required
jobID The job ID of the submission. Optional
sha256 The submission SHA256. Optional
environmentID The environment ID of the submission. Optional
 
Context Output
Path Type Description
HybridAnalysis.Submit.State string The state of the process.
HybridAnalysis.Submit.SHA256 string The SHA256 hash of the submission.
HybridAnalysis.Submit.JobID string The job ID of the submission.
HybridAnalysis.Submit.EnvironmentID string The environment ID of the submission.

 

6. Submit a website or file URL for quick analysis

Submits the URL of a website, or the URL that contains the file, for analysis.

Base Command

hybrid-analysis-quick-scan-url

Input
Argument Name Description Required
scan_type The type of scan. Run the hybrid-analysis-list-scanners command to view available scanners. Optional
url The website URL, or the URL that contains the file to submit. Required

 

Context Output
Path Type Description
HybridAnalysis.URL.Data string The URL.
HybridAnalysis.URL.ScanID string The scan ID.
HybridAnalysis.URL.SHA256 string The SHA256 hash of the URL.
HybridAnalysis.URL.Finished boolean Whether the scan completed.
File.Name string The URL.
File.SHA256 string The SHA256 hash of the file.
HybridAnalysis.URL.SubmissionType string The type of the submission. Can be "file" or "url".

 

Command Example
 !hybrid-analysis-quick-scan-url url=www.google.com
Human Readable Output

7. Submit a website or file URL for analysis

Submits the URL of a website or the URL that contains the file, for analysis.

Base Command

hybrid-analysis-submit-url

Input
Argument Name Description Required
url The URL of the file to submit. Required
environmentID The environment ID to which to submit the file. Run the vx-get-environments command to get all environment IDs. Required

 

Context Output
Path Type Description
HybridAnalysis.Submit.JobID string The job ID of the submission.
HybridAnalysis.Submit.SHA256 string The SHA256 of the submission.
HybridAnalysis.Submit.EnvironmentID number The environment ID of the submission.
HybridAnalysis.Submit.SubmissionType string The type of the submission. Can be "file" or "url".

 

Command Example
!hybrid-analysis-submit-url environmentID=100 url=www.google.com
Human Readable Output

8. Get a list of scanners

Returns a list of available scanners.

Base Command

hybrid-analysis-list-scanners

Input

 There are no input arguments for this command.

Context Output
Path Type Description
HybridAnalysis.Scanner.Available unknown Whether the scanner is available.
HybridAnalysis.Scanner.Name unknown The scanner name.
HybridAnalysis.Scanner.Description unknown The scanner description.

 

Command Example
 !hybrid-analysis-list-scanners
Human Readable Output

9. Get scan results

Returns the scan results of the given URL ID.

Base Command

hybrid-analysis-quick-scan-url-results

Input
Argument Name Description Required
scanID The scan ID of the scanned URL. Required
min_malicious_scanners The number of scanners that report the file as malicious to determine whether the file is malicious. Default is "2". Optional

 

Context Output
Path Type Description
HybridAnalysis.URL.ScanID string The scan ID.
HybridAnalysis.URL.SHA256 string The SHA256 hash of the indicator.
HybridAnalysis.URL.Finished boolean Whether the process completed.
HybridAnalysis.URL.Scanner.Name string The scanner name.
HybridAnalysis.URL.Scanner.Positives number The number of positive results.
HybridAnalysis.URL.Scanner.Status string The status of the file.
HybridAnalysis.URL.Whitelist.ID string The type of ID.
HybridAnalysis.URL.Whitelist.Value boolean Whether the indicator is on the allow list.
File.SHA256 string The SHA256 hash of the file.

 

Command Example
!hybrid-analysis-quick-scan-url-results scanID=5d6cf460028838eb26d56dc4
Human Readable Output

Configuration parameters

  • serverUrl — Server URL (e.g. https://216.3.128.82) (required)
  • apiKey — API Key
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (9)

  • hybrid-analysis-detonate-file Deprecated

    Submits a file for detonation in Hybrid Analysis.

  • hybrid-analysis-get-report-status Deprecated

    Returns the state of the file submission.

  • hybrid-analysis-list-scanners Deprecated

    Returns a list of available scanners.

  • hybrid-analysis-quick-scan-url Deprecated

    Submits the URL of a website, or the URL that contains the file, for analysis.

  • hybrid-analysis-quick-scan-url-results Deprecated

    Returns the scan results of the given URL ID.

  • hybrid-analysis-scan Deprecated

    Returns summary information for a given MD5, SHA1 or SHA256 hash, and all reports generated for any environment ID.

  • hybrid-analysis-search Deprecated

    Performs a search on the database using the Hybrid Analysis search syntax.

  • hybrid-analysis-submit-sample Deprecated

    Submits a file from the investigation to the analysis server. The minimum required authorization is "default".

  • hybrid-analysis-submit-url Deprecated

    Submits The URL of a website or the URL that contains the file, for analysis.

Source

HybridAnalysis.js HybridAnalysis.yml
Download History Raw 
commonfields:
  id: Hybrid Analysis
  version: -1
fromversion: 5.0.0
name: Hybrid Analysis
display: Hybrid Analysis (Deprecated)
category: Forensics & Malware Analysis
provider: CrowdStrike
description: Deprecated. Use CrowdStrike Falcon Sandbox v2 instead.
configuration:
- display: Server URL (e.g. https://216.3.128.82)
  name: serverUrl
  defaultvalue: https://www.hybrid-analysis.com
  type: 0
  required: true
- display: API Key
  name: apiKey
  defaultvalue: ""
  type: 4
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: hybrid-analysis-scan
    arguments:
    - name: file
      required: true
      description: The MD5, SHA1, or SHA256 hash of the file.
    - name: malicious_threat_levels
      description: A CSV list of threat level values. Files that have a threat level specified in the list will be considered malicious.
      isArray: true
      defaultValue: "2"
    outputs:
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: string
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.environmentId
      description: 'The environment ID of the file. '
      type: string
    - contextPath: File.analysis_start_time
      description: The start time of the file analysis.
      type: string
    - contextPath: File.submitname
      description: The submission name of the file.
      type: string
    - contextPath: File.classification_tags
      description: A list of classification tags of the file.
      type: string
    - contextPath: File.vxfamily
      description: The family classification of the file.
      type: string
    - contextPath: File.total_network_connections
      description: The total number of network connections of the file.
      type: string
    - contextPath: File.total_processes
      description: The total processes count of the file.
      type: string
    - contextPath: File.total_signatures
      description: The total signatures count of the file.
      type: string
    - contextPath: File.hosts
      description: A list of hosts of the file.
      type: string
    - contextPath: File.isinteresting
      description: Whether the server found the file interesting.
      type: string
    - contextPath: File.domains
      description: A list of domains related to the file.
      type: string
    - contextPath: File.isurlanalysis
      description: Whether the file was analyzed by a URL.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the reason that the vendor made the decision.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The DBot score vendor.
      type: string
    - contextPath: DBotScore.Score
      description: The DBot score.
      type: number
    description: Returns summary information for a given MD5, SHA1 or SHA256 hash, and all reports generated for any environment ID.
    deprecated: true
  - name: hybrid-analysis-submit-sample
    arguments:
    - name: entryId
      required: true
      default: true
      description: TheWar-room entry ID of sample file
    - name: environmentID
      required: true
      description: The environment ID to which to submit the file. Run the vx-get-environments command to get all environment IDs.
    outputs:
    - contextPath: HybridAnalysis.Submit.JobID
      description: JobID of the submission
      type: string
    - contextPath: HybridAnalysis.Submit.SHA256
      description: 'The SHA256 hash of the submission. '
      type: string
    - contextPath: HybridAnalysis.Submit.EnvironmentID
      description: 'The environment ID of the submission. '
      type: string
    description: Submits a file from the investigation to the analysis server. The minimum required authorization is "default".
    deprecated: true
  - name: hybrid-analysis-search
    arguments:
    - name: query
      description: 'The query to run, in the Hybrid Analysis query syntax. For more information, see `<server url>/faq#advanced-search-options`. For example: url:google, host:95.181.53.78.'
    - name: filename
      description: The full file name, including the file extension.
    - name: filetype
      description: Filetype e.g. docx
    - name: filetype_desc
      description: A description of the file type, for example, PE32 executable.
    - name: env_id
      description: The environment ID.
    - name: country
      description: 'The ISO code of the country by which to filter results, for example: swe'
    - name: verdict
      description: 'The verdict by which to filter results. Can be "1- whitelisted", "2- no verdict", "3- "no specific threat", "4- suspicious", or "5- malicious".'
    - name: av_detect
      description: 'The AV multi-scan range (0-100) by which to filter results, for example: "50-70".'
    - name: vx_family
      description: 'The AV family substring by which to filter results, for example: "nemucod".'
    - name: tag
      description: 'The hashtag by which to filter results, for example: "ransomware".'
    - name: port
      description: The port by which to filter results.
    - name: host
      description: The host (IP address) by which to filter results.
    - name: domain
      description: The domain by which to filter results.
    - name: url
      description: The HTTP request substring by which to filter results.
    - name: similar_to
      description: 'Similar samples, for example: <sha256>.'
    - name: context
      description: 'Sample context, for example: <sha256>.'
    - name: imp_hash
      description: The import hash.
    - name: ssdeep
      description: The ssdeep hash.
    - name: authentihash
      description: The authentication hash.
    - name: min_malicious_scanners
      description: The number of scanners that report the file as malicious to determine whether the file is malicious. Default is "2".
      defaultValue: "2"
    outputs:
    - contextPath: HybridAnalysis.Search.SHA256
      description: The SHA256 hash of the search result.
      type: string
    - contextPath: HybridAnalysis.Search.SHA1
      description: The SHA1 hash of the search result.
      type: string
    - contextPath: HybridAnalysis.Search.MD5
      description: The MD5 hash of the search result.
      type: string
    - contextPath: HybridAnalysis.Search.environmentId
      description: The environment ID of the search result.
      type: string
    - contextPath: HybridAnalysis.Search.start_time
      description: The start time of the search result.
      type: date
    - contextPath: HybridAnalysis.Search.threatscore
      description: The threat score of the search result, by server.
      type: string
    - contextPath: HybridAnalysis.Search.verdict
      description: The verdict of the search result.
      type: string
    - contextPath: HybridAnalysis.Search.environmentDescription
      description: The environment description of search result.
      type: string
    - contextPath: HybridAnalysis.Search.submitname
      description: The submission name of the search result.
      type: string
    - contextPath: HybridAnalysis.Search.vxfamily
      description: The family of search result.
      type: string
    - contextPath: HybridAnalysis.Search.threatscore
      description: The threat score of the search result.
      type: string
    - contextPath: HybridAnalysis.Search.type_short
      description: 'The type of search result, for example: "url" or "host".'
      type: string
    - contextPath: HybridAnalysis.Search.size
      description: The size of the search result.
      type: number
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the reason that the vendor made the decision.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator.
    - contextPath: DBotScore.Type
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The DBotScore vendor.
    - contextPath: DBotScore.Score
      description: The DBot score.
    description: Performs a search on the database using the Hybrid Analysis search syntax.
    deprecated: true
  - name: hybrid-analysis-detonate-file
    arguments:
    - name: entryId
      required: true
      description: The War Room entry ID of the sample file you want to detonate.
    - name: environmentID
      required: true
      description: The environment ID to which to submit the file for detonation. Run the vx-get-environments command to get all environment IDs. Default is 100, or other WINDOWS ID.
    - name: delay
      description: The amount of time (in seconds) to wait between calls. Default is "3".
      defaultValue: "3"
    - name: timeout
      description: The total wait time (in seconds) before timeout. Default is "60".
      defaultValue: "60"
    - name: malicious_threat_levels
      description: A CSV list of threat level values. Files that have a threat level specified in the list will be considered malicious.
      isArray: true
      defaultValue: "2"
    outputs:
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: string
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.environmentId
      description: 'The environment ID of the file. '
      type: string
    - contextPath: File.analysis_start_time
      description: The start time of the file analysis.
      type: string
    - contextPath: File.submitname
      description: The submission name of the file.
      type: string
    - contextPath: File.classification_tags
      description: A list of classification tags of the file.
      type: string
    - contextPath: File.vxfamily
      description: The family classification of the file.
      type: string
    - contextPath: File.total_network_connections
      description: The total number of network connections of the file.
      type: string
    - contextPath: File.total_processes
      description: The total processes count of the file.
      type: string
    - contextPath: File.total_signatures
      description: The total signatures count of the file.
      type: string
    - contextPath: File.hosts
      description: A list of hosts of the file.
      type: string
    - contextPath: File.isinteresting
      description: Whether the server found the file interesting.
      type: string
    - contextPath: File.domains
      description: A list of domains related to the file.
      type: string
    - contextPath: File.isurlanalysis
      description: Whether the file was analyzed by a URL.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the reason that the vendor made the decision.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The DBot score vendor.
      type: string
    - contextPath: DBotScore.Score
      description: The DBot score.
      type: number
    description: Submits a file for detonation in Hybrid Analysis.
    deprecated: true
  - name: hybrid-analysis-get-report-status
    arguments:
    - name: jobID
      description: The Job ID of the submission.
    - name: sha256
      description: The submission SHA256.
    - name: environmentID
      description: The environmentID of the submission.
    outputs:
    - contextPath: HybridAnalysis.Submit.State
      description: The state of the process.
      type: string
    - contextPath: HybridAnalysis.Submit.SHA256
      description: The SHA256 hash of the submission.
      type: string
    - contextPath: HybridAnalysis.Submit.JobID
      description: The job ID of the submission.
      type: string
    - contextPath: HybridAnalysis.Submit.EnvironmentID
      description: The environment ID of the submission.
      type: string
    description: Returns the state of the file submission.
    deprecated: true
  - name: hybrid-analysis-quick-scan-url
    arguments:
    - name: scan_type
      description: The type of scan. Run the hybrid-analysis-list-scanners command to view available scanners.
      defaultValue: all
    - name: url
      required: true
      description: The website URL, or the URL that contains the file to submit.
    outputs:
    - contextPath: HybridAnalysis.URL.Data
      description: The URL.
      type: string
    - contextPath: HybridAnalysis.URL.ScanID
      description: The scan ID.
      type: string
    - contextPath: HybridAnalysis.URL.SHA256
      description: The SHA256 hash of the URL.
      type: string
    - contextPath: HybridAnalysis.URL.Finished
      description: Whether the scan completed.
      type: boolean
    - contextPath: File.Name
      description: The URL.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: HybridAnalysis.URL.SubmissionType
      description: The type of the submission. Can be "file" or "url".
      type: string
    description: Submits the URL of a website, or the URL that contains the file, for analysis.
    deprecated: true
  - name: hybrid-analysis-submit-url
    arguments:
    - name: url
      required: true
      description: The URL of the file to submit.
      defaultValue: The URL of the website, or the URL that contains the file to submit.
    - name: environmentID
      required: true
      description: The environment ID to which to submit the file. Run the vx-get-environments command to get all environment IDs.
    outputs:
    - contextPath: HybridAnalysis.Submit.JobID
      description: The job ID of the submission.
      type: string
    - contextPath: HybridAnalysis.Submit.SHA256
      description: The SHA256 of the submission.
      type: string
    - contextPath: HybridAnalysis.Submit.EnvironmentID
      description: The environment ID of the submission.
      type: number
    - contextPath: HybridAnalysis.Submit.SubmissionType
      description: The type of the submission. Can be "file" or "url".
      type: string
    description: Submits The URL of a website or the URL that contains the file, for analysis.
    deprecated: true
  - name: hybrid-analysis-list-scanners
    arguments: []
    outputs:
    - contextPath: HybridAnalysis.Scanner.Available
      description: Whether the scanner is available.
    - contextPath: HybridAnalysis.Scanner.Name
      description: The scanner name.
    - contextPath: HybridAnalysis.Scanner.Description
      description: The scanner description.
    description: ' Returns a list of available scanners.'
    deprecated: true
  - name: hybrid-analysis-quick-scan-url-results
    arguments:
    - name: scanID
      required: true
      description: The scan ID of the scanned URL.
    - name: min_malicious_scanners
      required: true
      description: The number of scanners that report the file as malicious to determine whether the file is malicious. Default is "2".
      defaultValue: "2"
    outputs:
    - contextPath: HybridAnalysis.URL.ScanID
      description: The scan ID.
      type: string
    - contextPath: HybridAnalysis.URL.SHA256
      description: The SHA256 hash of the indicator.
      type: string
    - contextPath: HybridAnalysis.URL.Finished
      description: Whether the process completed.
      type: boolean
    - contextPath: HybridAnalysis.URL.Scanner.Name
      description: The scanner name.
      type: string
    - contextPath: HybridAnalysis.URL.Scanner.Positives
      description: The number of positive results.
      type: number
    - contextPath: HybridAnalysis.URL.Scanner.Status
      description: The status of the file.
      type: string
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
    description: Returns the scan results of the given URL ID.
    deprecated: true
tests:
- No tests (deprecated)
deprecated: true