category: Forensics & Malware Analysis provider: AnyRun sectionorder: - Connect - Collect commonfields: id: ANYRUN version: -1 configuration: - defaultvalue: https://api.any.run display: Server URL name: url required: true type: 0 section: Connect - display: Username name: credentials required: true type: 9 section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect advanced: true - display: Use system proxy settings name: proxy type: 8 required: false section: Connect advanced: true description: Deprecated. Use ANY.RUN TI Feeds, ANY.RUN TI Lookup, ANY.RUN Cloud Sandbox instead. display: ANY.RUN (Deprecated) name: ANYRUN script: commands: - arguments: - auto: PREDEFINED defaultValue: 'false' description: If true, gets team history. If empty, gets your submitted analyses history. name: team predefined: - 'true' - 'false' - defaultValue: '0' description: The number of analyses to skip. name: skip predefined: - '' - defaultValue: '25' description: Limits the history retrieved/searched to the specified number of executed analyses. The range is 1-100. name: limit - description: File name, hash, or task ID by which to filter the task history. name: filter description: Get analysis history. name: anyrun-get-history outputs: - contextPath: ANYRUN.Task.Name description: Task name. type: String - contextPath: ANYRUN.Task.Verdict description: ANY.RUN verdict for the submitted file's status. type: String - contextPath: ANYRUN.Task.Related description: ANY.RUN link to a related file. type: String - contextPath: ANYRUN.Task.File description: ANY.RUN link to download the submitted file. type: String - contextPath: ANYRUN.Task.Date description: The date that the file was submitted for analysis. type: Date - contextPath: ANYRUN.Task.Hash.MD5 description: MD5 hash of the submitted file. type: String - contextPath: ANYRUN.Task.Hash.SHA1 description: SHA1 hash of the submitted file. type: String - contextPath: ANYRUN.Task.Hash.SHA256 description: SHA256 hash of the submitted file. type: String - contextPath: ANYRUN.Task.Hash.HeadHash description: Head hash of the submitted file. type: String - contextPath: ANYRUN.Task.Hash.SSDeep description: SSDeep hash of the submitted file. type: String - arguments: - description: Unique task ID. A task ID is returned when submitting a file or URL for analysis using the `anyrun-run-analysis` command. Task IDs can also be located in the `ID` field of the output of executing the `anyrun-get-history` command. name: task required: true description: Gets the report of a task created for a submitted file or URL. name: anyrun-get-report outputs: - contextPath: ANYRUN.Task.AnalysisDate description: Date and time the analysis was executed. type: String - contextPath: ANYRUN.Task.Behavior.Category description: Category of a process behavior. type: String - contextPath: ANYRUN.Task.Behavior.Action description: Actions performed by a process. type: String - contextPath: ANYRUN.Task.Behavior.ThreatLevel description: Threat score associated with a process behavior. type: Number - contextPath: ANYRUN.Task.Behavior.ProcessUUID description: Unique ID of the process whose behaviors are being profiled. type: String - contextPath: ANYRUN.Task.Connection.Reputation description: Connection reputation. type: String - contextPath: ANYRUN.Task.Connection.ProcessUUID description: ID of the process that created the connection. type: String - contextPath: ANYRUN.Task.Connection.ASN description: Connection autonomous system network. type: String - contextPath: ANYRUN.Task.Connection.Country description: Connection country. type: String - contextPath: ANYRUN.Task.Connection.Protocol description: Connection protocol. type: String - contextPath: ANYRUN.Task.Connection.Port description: Connection port number. type: Number - contextPath: ANYRUN.Task.Connection.IP description: Connection IP number. type: String - contextPath: ANYRUN.Task.DnsRequest.Reputation description: Reputation of the DNS request. type: String - contextPath: ANYRUN.Task.DnsRequest.IP description: IP addresses associated with a DNS request. type: Unknown - contextPath: ANYRUN.Task.DnsRequest.Domain description: Domain resolution of a DNS request. type: String - contextPath: ANYRUN.Task.Threat.ProcessUUID description: Unique process ID from where the threat originated. type: String - contextPath: ANYRUN.Task.Threat.Msg description: Threat message. type: String - contextPath: ANYRUN.Task.Threat.Class description: Class of the threat. type: String - contextPath: ANYRUN.Task.Threat.SrcPort description: Port on which the threat originated. type: Number - contextPath: ANYRUN.Task.Threat.DstPort description: Destination port of the threat. type: Number - contextPath: ANYRUN.Task.Threat.SrcIP description: Source IP address where the threat originated. type: String - contextPath: ANYRUN.Task.Threat.DstIP description: Destination IP address of the threat. type: String - contextPath: ANYRUN.Task.HttpRequest.Reputation description: Reputation of the HTTP request. type: String - contextPath: ANYRUN.Task.HttpRequest.Country description: HTTP request country. type: String - contextPath: ANYRUN.Task.HttpRequest.ProcessUUID description: ID of the process making the HTTP request. type: String - contextPath: ANYRUN.Task.HttpRequest.Body description: HTTP request body parameters and details. type: Unknown - contextPath: ANYRUN.Task.HttpRequest.HttpCode description: HTTP request response code. type: Number - contextPath: ANYRUN.Task.HttpRequest.Status description: Status of the HTTP request. type: String - contextPath: ANYRUN.Task.HttpRequest.ProxyDetected description: Whether the HTTP request was made through a proxy. type: Boolean - contextPath: ANYRUN.Task.HttpRequest.Port description: HTTP request port. type: Number - contextPath: ANYRUN.Task.HttpRequest.IP description: HTTP request IP address. type: String - contextPath: ANYRUN.Task.HttpRequest.URL description: HTTP request URL. type: String - contextPath: ANYRUN.Task.HttpRequest.Host description: HTTP request host. type: String - contextPath: ANYRUN.Task.HttpRequest.Method description: HTTP request method type. type: String - contextPath: ANYRUN.Task.FileInfo description: Details of the submitted file. type: String - contextPath: ANYRUN.Task.OS description: OS of the sandbox in which the file was analyzed. type: String - contextPath: ANYRUN.Task.ID description: The unique ID of the task. type: String - contextPath: ANYRUN.Task.MIME description: The MIME of the file submitted for analysis. type: String - contextPath: ANYRUN.Task.MD5 description: The MD5 hash of the file submitted for analysis. type: String - contextPath: ANYRUN.Task.SHA1 description: The SHA1 hash of the file submitted for analysis. type: String - contextPath: ANYRUN.Task.SHA256 description: The SHA256 hash of the file submitted for analysis. type: String - contextPath: ANYRUN.Task.SSDeep description: SSDeep hash of the file submitted for analysis. type: String - contextPath: ANYRUN.Task.Verdict description: ANY.RUN verdict for the maliciousness of the submitted file or URL. type: String - contextPath: ANYRUN.Task.Process.FileName description: File name of the process. type: String - contextPath: ANYRUN.Task.Process.PID description: Process identification number. type: Number - contextPath: ANYRUN.Task.Process.PPID description: Parent process identification number. type: Number - contextPath: ANYRUN.Task.Process.ProcessUUID description: Unique process ID (used by ANY.RUN). type: String - contextPath: ANYRUN.Task.Process.CMD description: Process command. type: String - contextPath: ANYRUN.Task.Process.Path description: Path of the executed command. type: String - contextPath: ANYRUN.Task.Process.User description: User who executed the command. type: String - contextPath: ANYRUN.Task.Process.IntegrityLevel description: The process integrity level. type: String - contextPath: ANYRUN.Task.Process.ExitCode description: Process exit code. type: Number - contextPath: ANYRUN.Task.Process.MainProcess description: Whether the process is the main process. type: Boolean - contextPath: ANYRUN.Task.Process.Version.Company description: Company responsible for the program executed. type: String - contextPath: ANYRUN.Task.Process.Version.Description description: Description of the type of program. type: String - contextPath: ANYRUN.Task.Process.Version.Version description: Version of the program executed. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: Type of indicator. type: String - contextPath: DBotScore.Vendor description: Vendor used to calculate the score. type: String - contextPath: File.Extension description: Extension of the file submitted for analysis. type: String - contextPath: File.Name description: The name of the file submitted for analysis. type: String - contextPath: File.MD5 description: MD5 hash of the file submitted for analysis. type: String - contextPath: File.SHA1 description: SHA1 hash of the file submitted for analysis. type: String - contextPath: File.SHA256 description: SHA256 hash of the file submitted for analysis. type: String - contextPath: File.SSDeep description: SSDeep hash of the file submitted for analysis. type: String - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: String - contextPath: File.Malicious.Description description: For malicious files, the reason that the vendor made the decision. type: String - contextPath: URL.Data description: URL data. type: String - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision. type: String - contextPath: URL.Malicious.Description description: For malicious URLs, the reason that the vendor made the decision. type: String - contextPath: ANYRUN.Task.Status description: Task analysis status. type: String - arguments: - auto: PREDEFINED defaultValue: file description: Type of new task. name: obj_type predefined: - file - url - remote file - description: EntryID of the file to analyze. name: file - description: URL, used only if 'obj_type' command argument is 'url' or 'download'. Permitted size is 5-512 characters long. name: obj_url - auto: PREDEFINED defaultValue: '32' description: Bitness of OS. name: env_bitness predefined: - '32' - '64' - name: obj_ext_browser auto: PREDEFINED predefined: - Internet Explorer - Google Chrome - Mozilla Firefox - Opera - Microsoft Edge description: Browser name, used only for "url" type. - name: obj_ext_cmd description: Command line, used only if 'obj_type' command argument is 'file' or 'download'. Permitted size is 2-256 characters long. - auto: PREDEFINED defaultValue: Windows 7 description: Version of Windows OS. name: env_version predefined: - Windows Vista - Windows 7 - Windows 8.1 - Windows 10 - Windows 11 - auto: PREDEFINED defaultValue: complete description: Environment preset type. name: env_type predefined: - complete - clean - office - auto: PREDEFINED defaultValue: 'true' description: Network connection state. name: opt_network_connect predefined: - 'true' - 'false' - auto: PREDEFINED defaultValue: 'false' description: Heavy evasion option. name: opt_kernel_heavyevasion predefined: - 'true' - 'false' - auto: PREDEFINED defaultValue: owner description: Privacy settings for generated task. name: opt_privacy_type predefined: - owner - bylink - public - byteam description: Submit a file or url for analysis. name: anyrun-run-analysis outputs: - contextPath: ANYRUN.Task.ID description: ID of the task created to analyze the submission. type: String dockerimage: demisto/python3:3.12.8.3296088 subtype: python3 runonce: false script: '-' type: python tests: - ANYRUN-Test fromversion: 5.0.0 deprecated: true