Symantec Blue Coat Content and Malware Analysis

Details

ID	`Symantec Blue Coat Content and Malware Analysis`
Provider	Broadcom
Category	Forensics & Malware Analysis
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Playbooks

Detonate File - Symantec Blue Coat Content and Malware Analysis Beta
Detonate URL - Symantec Blue Coat Content and Malware Analysis Beta

Configure Symantec Blue Coat Content and Malware Analysis on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Symantec Blue Coat Content and Malware Analysis.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Server URL
- API Key
- Use system proxy settings
- Trust any certificate (not secure)
- Max. Polling Time (in seconds):
- Verbose (show log in case of error)
- Environment Images (sbx or ivm or drd)
Click Test to validate the new instance.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Submit a URL for analysis: symantec-cma-upload-url
Submit a file for analysis: symantec-cma-upload-file
Retrieves an analysis report: symantec-cma-get-report

1. symantec-cma-upload-url

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Submit a URL for analysis.

Base Command

symantec-cma-upload-url

Input

Argument Name	Description	Required
url	The URL to upload.	Required

Context Output

There are no context output for this command.

Command Example

!symantec-cma-upload-url url=www.demisto.com

Human Readable Output

2. symantec-cma-upload-file

Submit a file for analysis.

Base Command

symantec-cma-upload-file

Input

Argument Name	Description	Required
file_id	The file entry to analyze.	Optional

Context Output

There are no context output for this command.

Command Example

symantec-cma-upload-file file_id ={entry_id}

Human Readable Output

3. symantec-cma-get-report

Retrieves an analysis report.

Base Command

symantec-cma-get-report

Input

Argument Name	Description	Required
task_id	The task ID.	Required

Context Output

There are no context output for this command.

Command Example

symantec-cma-get-report task_id={task_id}

Human Readable Output

Configuration parameters

url — Server URL (required)
api_key — API Key
api_key_creds —
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
environment — Environment Images (sbx or ivm or drd)

Commands (3)

symantec-cma-get-report
Retrieves an analysis report.
symantec-cma-upload-file
Submit a file for analysis.
symantec-cma-upload-url
Submit a URL for analysis.

Source

SymantecBlueCoatMalwareAnalysis.py SymantecBlueCoatMalwareAnalysis.yml SymantecBlueCoatMalwareAnalysis_description.md

Download History Raw

category: Forensics & Malware Analysis
provider: Broadcom
commonfields:
  id: Symantec Blue Coat Content and Malware Analysis
  version: -1
configuration:
- display: Server URL
  name: url
  required: true
  type: 0
- display: API Key
  name: api_key
  type: 4
  hidden: true
  required: false
- name: api_key_creds
  type: 9
  displaypassword: API Key
  hiddenusername: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Environment Images (sbx or ivm or drd)
  name: environment
  type: 0

  required: false
description: Symantec Blue Coat Content and Malware Analysis integration.
display: Symantec Blue Coat Content and Malware Analysis (Beta)
name: Symantec Blue Coat Content and Malware Analysis
beta: true
script:
  commands:
  - arguments:
    - description: The URL to upload.
      name: url
      required: true
    description: Submit a URL for analysis.
    name: symantec-cma-upload-url
  - arguments:
    - description: The file entry to analyze.
      name: file_id
    description: Submit a file for analysis.
    name: symantec-cma-upload-file
  - arguments:
    - description: The task ID.
      name: task_id
      required: true
    description: Retrieves an analysis report.
    name: symantec-cma-get-report
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- no test
fromversion: 5.0.0