Symantec Blue Coat Content and Malware Analysis

Playbooks

• Detonate File - Symantec Blue Coat Content and Malware Analysis Beta
• Detonate URL - Symantec Blue Coat Content and Malware Analysis Beta

Configure Symantec Blue Coat Content and Malware Analysis on Cortex XSOAR

1. Navigate to Settings > Integrations  > Servers & Services.
2. Search for Symantec Blue Coat Content and Malware Analysis.
3. Click Add instance to create and configure a new integration instance.
   • Name: a textual name for the integration instance.
   • Server URL
   • API Key
   • Use system proxy settings
   • Trust any certificate (not secure)
   • Max. Polling Time (in seconds):
   • Verbose (show log in case of error)
   • Environment Images (sbx or ivm or drd)
4. Click Test to validate the new instance.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

1. Submit a URL for analysis: symantec-cma-upload-url
2. Submit a file for analysis: symantec-cma-upload-file
3. Retrieves an analysis report: symantec-cma-get-report

1. symantec-cma-upload-url

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

---

Submit a URL for analysis.

Base Command

symantec-cma-upload-url

Input

Argument Name	Description	Required
url	The URL to upload.	Required

 

Context Output

There are no context output for this command.

 

Command Example

!symantec-cma-upload-url url=www.demisto.com

Human Readable Output

2. symantec-cma-upload-file

---

Submit a file for analysis.

Base Command

symantec-cma-upload-file

Input

Argument Name	Description	Required
file_id	The file entry to analyze.	Optional

 

Context Output

There are no context output for this command.

 

Command Example

symantec-cma-upload-file file_id ={entry_id}

Human Readable Output

3. symantec-cma-get-report

---

Retrieves an analysis report.

Base Command

symantec-cma-get-report

Input

Argument Name	Description	Required
task_id	The task ID.	Required

 

Context Output

There are no context output for this command.

 

Command Example

symantec-cma-get-report task_id={task_id}

Human Readable Output