Threat Grid

Deprecated. Use Cisco Secure Malware Analytics (Threat Grid) v2 instead.

Category

Forensics & Malware Analysis

Pack

ThreatGrid

Configuration parameters

• server — Server URL (e.g. https://192.168.0.1) (required)
• token — API token (required)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings

Commands (43)

• threat-grid-advanced-search — Advanced search that allows searching URLS, Submissions, Samples etc...
• threat-grid-detonate-file — Detonates URL address through Threat Grid
• threat-grid-download-artifact — Download an artifact by using its ID.
• threat-grid-download-sample-by-id — Download a sample by using its ID. The downloaded file is an archive of the sample itself, in a zip format as a form of quarantine.
• threat-grid-feeds-artifacts — Get artifacts threat feed
• threat-grid-feeds-domain — Get domain threat feed
• threat-grid-feeds-ip — Get ips threat feed
• threat-grid-feeds-network-stream — Get network stream threat feed
• threat-grid-feeds-path — Get path threat feed
• threat-grid-feeds-url — Get url threat feed
• threat-grid-get-analysis-annotations — Returns data regarding the annotations of the anlysis
• threat-grid-get-analysis-artifact — Returns the sample id artifact with artifact id
• threat-grid-get-analysis-artifacts — Returns the sample id artifacts
• threat-grid-get-analysis-by-id — The detailed overview of dynamic and static analysis results for the sample
• threat-grid-get-analysis-ioc — Returns data regarding the specified Indicator of Compromise
• threat-grid-get-analysis-iocs — Returns a JSON list of the Indicators of Compromise identified in this sample run
• threat-grid-get-analysis-metadata — Returns metadata about the analysis
• threat-grid-get-analysis-network-stream — Returns data regarding a specific network stream
• threat-grid-get-analysis-network-streams — Returns the network stream analysis
• threat-grid-get-analysis-process — Returns data regarding the specifiic process id in the analysis
• threat-grid-get-analysis-processes — Returns data regarding the analysis processes
• threat-grid-get-html-report-by-id — Get the report.html file for a specific Sample ID. This is a stand-alone file with a complete report on the sample run. It is designed to be emailed or printed.
• threat-grid-get-pcap-by-id — Get the tcpdump PCAP file for a specific Sample ID, with all the network activity of the sample
• threat-grid-get-processes-by-id — Get a JSON object which contains a timeline of all process activities as determined by the dynamic analysis engine.
• threat-grid-get-sample-by-id — Get threat grid sample by id
• threat-grid-get-sample-state-by-id — Get threat grid sample state by id
• threat-grid-get-samples — Search samples on the Threat Grid platform. Input parameters are ANDed together. Only finished samples can be searched (that is, the ones that are having a status of succ or fail.)
• threat-grid-get-samples-state — Get threat grid samples state
• threat-grid-get-specific-feed — Gets a specific threat feed
• threat-grid-get-summary-by-id — Returns summary analysis information
• threat-grid-get-threat-summary-by-id — Returns a summary of the threats detected during analysis
• threat-grid-get-video-by-id — Get the sample analysis video by id
• threat-grid-get-warnings-by-id — Gets a JSON structure describing any warnings that occured during the analysis
• threat-grid-organization-get-rate-limit — Get rate limits applied to an organization. ThreatGrid employs a simple rate limiting method for sample submissions by specifying the number of samples which can be submitted within some variable time period by an entire organization and/or per a license basis. Multiple rate limits can be employed to form overlapping submission limits. For example, 20 submissions per hour AND 400 per day.
• threat-grid-search-ips — Search IPs. Please provide a single argument (only one) to use this command, as the API supports 1 filter at a time.
• threat-grid-search-samples — Search Samples. Please provide a single argument (only one) to use this command, as the API supports 1 filter at a time.
• threat-grid-search-submissions — Search threat grid submissions
• threat-grid-search-urls — Search urls. Please provide a single argument (only one) to use this command, as the API supports 1 filter at a time.
• threat-grid-submit-urls — Submit urls for analysis.
• threat-grid-upload-sample — Submits a sample to threat grid for analysis
• threat-grid-url-to-file — Convert a URL into a file for Threat Grid file detonation.
• threat-grid-user-get-rate-limit — Get rate limit for a specific user name. ThreatGrid employs a simple rate limiting method for sample submissions by specifying the number of samples which can be submitted within some variable time period by a user. Multiple rate limits can be employed to form overlapping submission limits. For example, 20 submissions per hour AND 400 per day.
• threat-grid-who-am-i — Get logged in user