ReversingLabs Titanium Cloud Deprecated

Deprecated. Use the ReversingLabs TitaniumCloud v2 integration instead.

Data Enrichment & Threat Intelligence · ReversingLabs TitaniumCloud

Details

ID	`ReversingLabs Titanium Cloud`
Provider	ReversingLabs
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python:2.7.18.20958`
Supported Modules	Agentix XSIAM

README

Overview

Use the TitaniumCloud Integration Malware Analysis Platform to increase detection, analysis and response efficiency by identifying files with global goodware and malware database. It is a powerful threat intelligence solution with up-to-date, threat classification and rich context on over 6B goodware and malware files.

This integration was integrated and tested with ReversingLabs TitaniumCloud™.

Use Cases

Provide a file reputation status for a file to prepare for emerging threats by monitoring malware.

Prerequisites

You need to obtain the following ReversingLabs TitaniumCloud information.

Base URL for malware presence :
- Preconfigured on Cortex XSOAR - https://ticloud-aws1-api.reversinglabs.com
Base URL for extended RL Data :
- Preconfigured on Cortex XSOAR - https://ticloud-cdn-api.reversinglabs.com
Credentials for ReversingLabs TitaniumCloud
- UserName
- Password

Configure ReversingLabs Titanium Cloud on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for ReversingLabs Titanium Cloud.
Click Add instance to create and configure a new integration instance.
- Name: a meaningful name for the integration instance.
- Base URL for malware presence : https://ticloud-aws1-api.reversinglabs.com
- Base URL for extended RL Data : https://ticloud-cdn-api.reversinglabs.com
- Credentials and Password: paste the username and password for your TitaniumCloud account.
Click Test to validate the URLs and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Retrieve malware presence status of a sample: file

Retrieve malware presence status of a sample: file

Get the ReversingLabs malware presence status for a file. This service supports single has queries and the option to return additional response data. The ReversingLabs Malware Statuses are:

Malicious
Suspicious
Known
Unknown

Command Example

!file file="c4ab31a0e6bee10933367e74b8af630daed5bd5e" extended="true"

Input

Parameter	Description	Required?
file	The hash that you want to get reputation data for. Hexadecimal representation of SHA-1, SHA-256, SHA-512, or MD5 digest.	required
extended	Directs the data browser to return richer response schema, with additional classifications and facts about the queried sample. If you do not specify this parameter in the command, the default is false.	optional

Human Readable Output (extended = false)

Human Readable Output (extended = true)

Context Output

Parameter	Description
File.MD5	Bad hash detected.
File.SHA1	Bad hash SHA-1.
File.Malicious.Vendor	For malicious files, the vendor that made the decision.
File.Malicious.Detections	For malicious files, the total number of detections.
File.Malicious.TotalEngines	For malicious files, the total number of engines.
DBotScore.Indicator	The indicator that is being tested.
DBotScore.Type	Indicator type.
DBotScore.Vendor	Vendor used to calculate the score.
DBotScore.Score	The actual score.

Raw Output

{
   "malware_presence":{
      "first_seen":"2018-05-28T03:15:44",
      "last_seen":"2018-05-28T03:19:00",
      "query_hash":{
         sha1:c4ab31a0e6bee10933367e74b8af630daed5bd5e
      },
      "scanner_count":45,
      "scanner_match":2,
      "scanner_percent":4.44444465637207,
      "status":"KNOWN",
      "threat_level":0,
      "trust_factor":5,

   }
}

Configuration parameters

base — Base URL for malware presence (required)
baserl — Base URL for extended RL Data
credentials — Credentials (required)
extended — Return extended data if available
proxy — Use system proxy settings

Commands (1)

file Deprecated
Retrieve Malware Presence Status from ReversingLabs

Source

ReversingLabsTitaniumCloud.py ReversingLabsTitaniumCloud.yml

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: ReversingLabs
commonfields:
  id: ReversingLabs Titanium Cloud
  version: -1
configuration:
- defaultvalue: https://data.reversinglabs.com
  display: Base URL for malware presence
  name: base
  required: true
  type: 0
- defaultvalue: https://data.reversinglabs.com
  display: Base URL for extended RL Data
  name: baserl
  type: 0
  required: false
- display: Credentials
  name: credentials
  required: true
  type: 9
- defaultvalue: 'false'
  display: Return extended data if available
  name: extended
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Deprecated. Use the ReversingLabs TitaniumCloud v2 integration instead.
display: ReversingLabs TitaniumCloud (Deprecated)
name: ReversingLabs Titanium Cloud
deprecated: true
script:
  commands:
  - arguments:
    - default: true
      description: file hash
      name: file
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Return as much data as available. Overrides the default setting.
      name: extended
      predefined:
      - 'true'
      - 'false'
    deprecated: true
    description: Retrieve Malware Presence Status from ReversingLabs
    name: file
    outputs:
    - contextPath: File.MD5
      description: Bad hash found
      type: Unknown
    - contextPath: File.SHA1
      description: Bad hash SHA1
      type: Unknown
    - contextPath: File.SHA256
      description: Bad hash SHA256
      type: Unknown
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision
      type: Unknown
    - contextPath: File.Malicious.Detections
      description: For malicious files. Total detections.
      type: Unknown
    - contextPath: File.Malicious.TotalEngines
      description: For malicious files. Total engines
      type: Unknown
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
  runonce: false
  script: ''
  subtype: python2
  type: python
  dockerimage: demisto/python:2.7.18.20958
tests:
- ReversingLabsTCTest
fromversion: 5.0.0