Hatching Triage

Submit a high volume of samples to run in a sandbox and view reports.

Category

Forensics & Malware Analysis

Pack

HatchingTriage

Configuration parameters

• base_url — API URL (required)
• API Key — API Key
• credentials —
• Verify SSL — Verify SSL
• proxy — Use system proxy settings

Commands (22)

• triage-create-api-key — Creates a new key can be used to make API calls on behalf of the specified user. The user should have been granted the access_api permission beforehand.
• triage-create-profile — Create a new profile.
• triage-create-user — Creates a new user and returns it. The user will become a member of the company the requesting user is a member of.
• triage-delete-api-key — Delete the user's API key with the specified name.
• triage-delete-profile — Update the profile with the specified ID or name. The stored profile is overwritten, so it is important that the submitted profile has all fields, with the exception of the ID.
• triage-delete-sample — Deletes a sample from the sandbox.
• triage-delete-user — Delete a user and all associated data, invalidating any sessions and removing their API keys. Any samples submitted by this user are kept.
• triage-get-api-key — Lists all API keys that the user has.
• triage-get-dumped-file — Retrieves files dumped by the sample. The names can be found under the "dumped" section from the triage report output.
• triage-get-kernel-monitor — Retrieves the output of the kernel monitor.
• triage-get-pcap — Retrieves the PCAP of the analysis for further manual analysis.
• triage-get-profiles — List all profiles that your company has.
• triage-get-report-triage — Retrieves the generated Triage behavioral report for a single task.
• triage-get-sample — Pulls back basic information about the sample id given.
• triage-get-sample-summary — Gets a summary report of the sample id provided.
• triage-get-static-report — Get the static analysis of a sample.
• triage-get-users — Return all users within the company as a paginated list. Returns a single user if a userID is provided.
• triage-query-samples — Get a list of all samples either private or public.
• triage-query-search — Get a list of private and public samples matching the search query.
• triage-set-sample-profile — When a sample is in the static_analysis status, a profile should be selected in order to continue.
• triage-submit-sample — Submits a file or url for analysis.
• triage-update-profile — Update an existing profile.