Secneurx Analysis

Details

ID	`Secneurx Analysis`
Provider	SecneurX
Category	Forensics & Malware Analysis
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Use SecneurX Analysis pack to provide threat analysts and incident response teams with the advanced malware isolation and inspection environment needed to safely execute advanced malware samples, and understand their behavior.
You can use the pack’s playbooks to detonate both files and URLs. SecneurX Analysis performs both static and dynamic analysis of advanced threats, including zero day and targeted attacks.

This integration was integrated and tested with version 1.0.0 of SecneurX Analysis

Configure SecneurX Analysis in Cortex

Parameter	Description	Required
Server URL	Input the url of SecneurX Analysis server.	True
API Key	Input the API key to access the sandbox.	True
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

snx-analysis-get-verdict

Get verdict summary report of the analyzed sample

Base Command

snx-analysis-get-verdict

Input

Argument Name	Description	Required
task_uuid	Input the Task UUID value obtained as response from submission.	Required
polling	Use Cortex XSOAR built-in polling to retrieve the result when it’s ready. Default is False.	Optional
interval	Frequency that the polling command will run (seconds). Default is set to “30”	Optional
timeout	Amount of time to poll before declaring a timeout and resuming the playbook (in seconds). Default is set “600”.	Optional

Context Output

Path	Type	Description
SecneurXAnalysis.Verdict.task_uuid	String	Task UUID is unique id of analyzed sample
SecneurXAnalysis.Verdict.verdict	String	Verdict is summary result of analyzed sample
SecneurXAnalysis.Verdict.sha256	String	SHA256 value find from analyzed sample
SecneurXAnalysis.Verdict.file_name	String	File Name of analyzed sample
SecneurXAnalysis.Verdict.status	String	Analysis queued sample state
SecneurXAnalysis.Verdict.submission_time	String	Analysis queued sample submission time value.

Human Readable Output

sha256	status	submission_time	task_uuid	url	verdict
2323714b7571c9c87e71799499d577126a487ff58177247e5b67a83a866f83a5	Completed	2022-07-22 07:37:10	2323714b7571c9c87e71799499d577126a487ff58177247e5b67a83a866f83a5-2022-07-22-07-37-10	https://google.com	Clean

snx-analysis-get-completed

Get the list of submitted samples whose status is marked as “Completed”

Base Command

snx-analysis-get-completed

Input

Argument Name	Description	Required
last_hours	Optional. Allows you to specify the number of hours. The value should be as number of hours (e.g. 5) - Lists all the queued samples submitted in the last 5 hrs.	Optional
last_count	Optional. Allows you to specify the max no.of queued samples to list. The value should be number type (e.g. 50) - Lists the last submitted 50 samples that are queued.	Optional

Context Output

There is no context output for this command.

Human Readable Output

task_uuid	verdict	file_name	report_available
ce5869808c1c4e99c7df7122118d06f0b38a7f302d5f5504a419626336156182-2022-07-22-07-45-21	No Threats		true

snx-analysis-get-pending

Get the list of submitted samples that are still in pending state

Base Command

snx-analysis-get-pending

Input

Argument Name	Description	Required
last_hours	Optional. Allows you to specify the number of hours. The value should be as number of hours (e.g. 5) - Lists all the queued samples submitted in the last 5 hrs.	Optional
last_count	Optional. Allows you to specify the max no.of queued samples to list. The value should be number type (e.g. 50) - Lists the last submitted 50 samples that are queued.	Optional

Context Output

There is no context output for this command.

Human Readable Output

task_uuid	file_name	status	sha256
4f751e74f7d05e6ebc27de36caa03c889b3d6bb57755aacd454bbce63a0da313-2022-07-21-15-28-20	4f751e74f7d05e6ebc27de36caa03c889b3d6bb57755aacd454bbce63a0da313	Analyzing	4f751e74f7d05e6ebc27de36caa03c889b3d6bb57755aacd454bbce63a0da313

snx-analysis-get-status

Get the status of all the submitted samples

Base Command

snx-analysis-get-status

Input

Argument Name	Description	Required
last_hours	Optional. Allows you to specify the number of hours. The value should be as number of hours (e.g. 5) - Lists all the queued samples submitted in the last 5 hrs.	Optional
last_count	Optional. Allows you to specify the max no.of queued samples to list. The value should be number type (e.g. 50) - Lists the last submitted 50 samples that are queued.	Optional

Context Output

There is no context output for this command.

Human Readable Output

task_uuid	file_name	status	sha256
ce5869808c1c4e99c7df7122118d06f0b38a7f302d5f5504a419626336156182-2022-07-22-07-45-21	sample.exe	Completed	ce5869808c1c4e99c7df7122118d06f0b38a7f302d5f5504a419626336156182
2323714b7571c9c87e71799499d577126a487ff58177247e5b67a83a866f83a5-2022-07-22-07-37-10	sample_2.dll	Completed	2323714b7571c9c87e71799499d577126a487ff58177247e5b67a83a866f83a5

snx-analysis-submit-file

Submit a file for Analysis

Base Command

snx-analysis-submit-file

Input

Argument Name	Description	Required
EntryID	Entry ID value of upload file.	Required
Platform	Type the OS platform on which the file to be analysed. Default is set to Windows7. Possible values are Windows7, Windows10, Android, Ubuntu.	Optional
Priority	Type the priority of the sample for analysis. Default is set to Normal. Possible values are High, Normal.	Optional
Duration	Type the duration of the analysis in seconds. Not all malicious programs are active right after the launch. Some of them take time to fully reveal the attack vectors. Default is set to 120. Possible values are 120, 180, 240, 300.	Optional
Extension	If you want the file for submission to be treated and analysed as a specific file extension, mention it.	Optional
Reboot	Reboot the system during the analysis. Default is set to ‘False’. Possible values are True, False.	Optional
File Password	If the file for submission is protected with a user-defined password, please enter the password for our system to open and detonate it.	Optional

Context Output

Path	Type	Description
SecneurXAnalysis.SubmitFile.task_uuid	String	Task UUID is unique ID for submitted file. Use this ID for get the report and verdict.
SecneurXAnalysis.SubmitFile.submission_time	String	Submission Time Created at the time the file was submitted

Human Readable Output

task_uuid	submission_time
2323714b7571c9c87e71799499d577126a487ff58177247e5b67a83a866f83a5-2022-07-22-07-27-42	2022-07-22 07:27:42

snx-analysis-submit-url

Submit the URL for Analysis

Base Command

snx-analysis-submit-url

Input

Argument Name	Description	Required
URL	Input the URL for analysis.	Required
Priority	Type the priority of the sample for analysis. Default is set to Normal. Possible values are High, Normal. Possible values are: High, Normal.	Optional
Duration	Type the duration of the analysis in seconds. Not all malicious programs are active right after the launch. Some of them take time to fully reveal the attack vectors. Default is set to 120. Possible values are 120, 180, 240, 300. Possible values are: 120, 180, 240, 300.	Optional
Reboot	Reboot the system during the analysis. Default is set to ‘False’. Possible values are True, False. Possible values are: True, False.	Optional

Context Output

Path	Type	Description
SecneurXAnalysis.SubmitURL.task_uuid	String	Task UUID is the unique ID for the submitted file. Use this ID to get the report.
SecneurXAnalysis.SubmitURL.submission_time	String	Submission Time Created at the time the file was submitted

Human Readable Output

task_uuid	submission_time
2323714b7571c9c87e71799499d577126a487ff58177247e5b67a83a866f8fff-2022-07-22-07-12-15	2022-07-22 07:12:15

snx-analysis-get-report

Get the detailed report of the analyzed sample.

Base Command

snx-analysis-get-report

Input

Argument Name	Description	Required
task_uuid	Input the Task UUID value obtained as response from submission.	Required
report_format	Mention the output format of the report. The value should be “json” or “html”. The default is set to “json”. Possible values are: html, json. Default is json.	Optional

Context Output

Path	Type	Description
SecneurXAnalysis.Report.SHA256	String	SHA256 value of the analyzed sample
SecneurXAnalysis.Report.Platform	String	Platform of the analyzed sample
SecneurXAnalysis.Report.Verdict	String	Summary result of the analyzed sample
SecneurXAnalysis.Report.Tags	String	More details of the analyzed sample
SecneurXAnalysis.Report.DnsRequests	String	List of DNS data observed in the analyzed sample
SecneurXAnalysis.Report.HttpRequests	String	List of HTTP data observed in the analyzed sample
SecneurXAnalysis.Report.JA3Digests	String	List of JA3 data observed in the analyzed sample
SecneurXAnalysis.Report.ProcessCreated	String	Process behaviour data observed in the analyzed sample
SecneurXAnalysis.Report.RegistrySet	String	List of Registry creations observed in the analyzed sample
SecneurXAnalysis.Report.RegistryDeleted	String	List of Registry deletions observed in the analyzed sample
SecneurXAnalysis.Report.FileCreated	String	List of File creations observed in the analyzed sample
SecneurXAnalysis.Report.FileDropped	String	List of File drops observed in the analyzed sample
SecneurXAnalysis.Report.FileDeleted	String	List of File deletions observed in the analyzed sample
SecneurXAnalysis.Report.FileModified	String	List of File changes observed in the analyzed sample
SecneurXAnalysis.Report.IOC	String	List of IOC’s observed in the analyzed sample
SecneurXAnalysis.Report.Status	String	Analysis queued sample state

snx-analysis-get-quota

Get the API Key quota usage details.

Base Command

snx-analysis-get-quota

Context Output

Path	Type	Description
SecneurXAnalysis.Quota.start_time	String	Creation Time of the API Key
SecneurXAnalysis.Quota.used	Integer	Used count of API Key
SecneurXAnalysis.Quota.allowed	Integer	Limitation count of API Key
SecneurXAnalysis.Quota.scale	String	API Key expiration renew scale type
SecneurXAnalysis.Quota.unused	String	Unused count of API Key

Human Readable Output

allowed	scale	start_time	unused	used
100	MONTH	01 Sep 2022 00:00:00 UTC	60	40

Configuration parameters

url — Server URL (required)
apiKey — API Key (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (8)

snx-analysis-get-completed
Get the list of submitted samples whose status is marked as "Completed".
snx-analysis-get-pending
Get the list of submitted samples that are still in pending state.
snx-analysis-get-quota
Get the API Key quota usage details.
snx-analysis-get-report
Get the detailed report of the analyzed sample.
snx-analysis-get-status
Get the status of all the submitted samples.
snx-analysis-get-verdict
Get verdict summary report of the analyzed sample.
snx-analysis-submit-file
Submit a file for Analysis.
snx-analysis-submit-url
Submit the URL for Analysis.

Source

SecneurXAnalysis.py SecneurXAnalysis_test.py SecneurXAnalysis.yml SecneurXAnalysis_description.md command_examples.txt

Download History Raw

category: Forensics & Malware Analysis
provider: SecneurX
commonfields:
  id: Secneurx Analysis
  version: -1
configuration:
- display: Server URL
  name: url
  defaultvalue: "https://analysis.secneurx.com"
  required: true
  additionalinfo: Input the url of SecneurX Analysis server.
  type: 0
- display: API Key
  name: apiKey
  required: true
  additionalinfo: Input the API key to access the sandbox.
  type: 4
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Fully automated malware dynamic analysis sandboxing.
display: SecneurX Analysis
name: Secneurx Analysis
script:
  commands:
  - arguments:
    - description: Input the Task UUID value obtained as response from submission.
      name: task_uuid
      required: true
    description: Get verdict summary report of the analyzed sample.
    name: snx-analysis-get-verdict
    outputs:
    - contextPath: SecneurXAnalysis.Verdict.task_uuid
      description: Task UUID is unique id of analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Verdict.verdict
      description: Verdict is summary result of analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Verdict.sha256
      description: SHA256 value find from analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Verdict.file_name
      description: File Name of analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Verdict.status
      description: Analysis queued sample state.
      type: String
    - contextPath: SecneurXAnalysis.Verdict.submission_time
      description: Analysis queued sample submission time value.
      type: String
  - arguments:
    - description: Optional. Allows you to specify the number of hours. The value should be as number of hours (e.g. 5) - Lists all the queued samples submitted in the last 5 hrs.
      name: last_hours
    - description: Optional. Allows you to specify the max no.of queued samples to list. The value should be number type (e.g. 50) - Lists the last submitted 50 samples that are queued.
      name: last_count
    description: Get the list of submitted samples whose status is marked as "Completed".
    name: snx-analysis-get-completed
  - arguments:
    - description: Optional. Allows you to specify the number of hours. The value should be as number of hours (e.g. 5) - Lists all the queued samples submitted in the last 5 hrs.
      name: last_hours
    - description: Optional. Allows you to specify the max no.of queued samples to list. The value should be number type (e.g. 50) - Lists the last submitted 50 samples that are queued.
      name: last_count
    description: Get the list of submitted samples that are still in pending state.
    name: snx-analysis-get-pending
  - arguments:
    - description: Optional. Allows you to specify the number of hours. The value should be as number of hours (e.g. 5) - Lists all the queued samples submitted in the last 5 hrs.
      name: last_hours
    - description: Optional. Allows you to specify the max no.of queued samples to list. The value should be number type (e.g. 50) - Lists the last submitted 50 samples that are queued.
      name: last_count
    description: Get the status of all the submitted samples.
    name: snx-analysis-get-status
  - arguments:
    - description: Entry ID value of upload file.
      name: EntryID
      required: true
    - description: Type the OS platform on which the file to be analysed. Default is set to Windows7. Possible values are Windows7, Windows10, Android, Ubuntu.
      name: Platform
    - description: Type the priority of the sample for analysis. Default is set to Normal. Possible values are High, Normal.
      name: Priority
    - description: Type the duration of the analysis in seconds. Not all malicious programs are active right after the launch. Some of them take time to fully reveal the attack vectors. Default is set to 120. Possible values are 120, 180, 240, 300.
      name: Duration
    - description: If you want the file for submission to be treated and analysed as a specific file extension, mention it.
      name: Extension
    - description: Reboot the system during the analysis. Default is set to 'False'. Possible values are True, False.
      name: Reboot
    - description: If the file for submission is protected with a user-defined password, please enter the password for our system to open and detonate it.
      name: File Password
    description: Submit a file for Analysis.
    name: snx-analysis-submit-file
    outputs:
    - contextPath: SecneurXAnalysis.SubmitFile.task_uuid
      description: Task UUID is unique ID for submitted file. Use this ID for get the report and verdict.
      type: String
    - contextPath: SecneurXAnalysis.SubmitFile.submission_time
      description: Submission Time Created at the time the file was submitted.
      type: String
  - arguments:
    - description: Input the URL for analysis.
      name: URL
      required: true
    - description: Type the priority of the sample for analysis. Default is set to Normal. Possible values are High, Normal.
      name: Priority
      auto: PREDEFINED
      predefined:
      - "High"
      - "Normal"
    - description: Type the duration of the analysis in seconds. Not all malicious programs are active right after the launch. Some of them take time to fully reveal the attack vectors. Default is set to 120. Possible values are 120, 180, 240, 300.
      name: Duration
      auto: PREDEFINED
      predefined:
      - "120"
      - "180"
      - "240"
      - "300"
    - description: Reboot the system during the analysis. Default is set to 'False'. Possible values are True, False.
      name: Reboot
      auto: PREDEFINED
      predefined:
      - "True"
      - "False"
    description: Submit the URL for Analysis.
    name: snx-analysis-submit-url
    outputs:
    - contextPath: SecneurXAnalysis.SubmitURL.task_uuid
      description: Task UUID is the unique ID for the submitted file. Use this ID to get the report.
      type: String
    - contextPath: SecneurXAnalysis.SubmitURL.submission_time
      description: Submission Time Created at the time the file was submitted.
      type: String
  - arguments:
    - description: Input the Task UUID value obtained as response from submission.
      name: task_uuid
      required: true
    - description: Mention the output format of the report. The value should be "json" or "html". The default is set to "json".
      defaultValue: "json"
      name: report_format
      auto: PREDEFINED
      predefined:
      - "html"
      - "json"
    description: Get the detailed report of the analyzed sample.
    name: snx-analysis-get-report
    outputs:
    - contextPath: SecneurXAnalysis.Report.SHA256
      description: SHA256 value of the analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Report.Platform
      description: Platform of the analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Report.Verdict
      description: Summary result of the analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Report.Tags
      description: More details of the analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Report.DnsRequests
      description: List of DNS data observed in the analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Report.HttpRequests
      description: List of HTTP data observed in the analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Report.JA3Digests
      description: List of JA3 data observed in the analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Report.ProcessCreated
      description: Process behaviour data observed in the analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Report.RegistrySet
      description: List of Registry creations observed in the analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Report.RegistryDeleted
      description: List of Registry deletions observed in the analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Report.FileCreated
      description: List of File creations observed in the analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Report.FileDropped
      description: List of File drops observed in the analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Report.FileDeleted
      description: List of File deletions observed in the analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Report.FileModified
      description: List of File changes observed in the analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Report.IOC
      description: List of IOC's observed in the analyzed sample.
      type: String
    - contextPath: SecneurXAnalysis.Report.Status
      description: Analysis queued sample state.
      type: String
  - description: Get the API Key quota usage details.
    name: snx-analysis-get-quota
    outputs:
    - contextPath: SecneurXAnalysis.Quota.start_time
      description: Creation Time of the API Key.
      type: String
    - contextPath: SecneurXAnalysis.Quota.used
      description: Used count of API Key.
      type: Integer
    - contextPath: SecneurXAnalysis.Quota.allowed
      description: Limitation count of API Key.
      type: Integer
    - contextPath: SecneurXAnalysis.Quota.scale
      description: API Key expiration renew scale type.
      type: String
    - contextPath: SecneurXAnalysis.Quota.unused
      description: Unused count of API Key.
      type: String
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.5.0
tests:
- Detonate File - SecneurX Analysis - Test
- Detonate URL - SecneurX Anlaysis - Test