category: Forensics & Malware Analysis provider: Recorded Future commonfields: id: Hatching Triage version: -1 fromversion: 5.5.0 configuration: - display: API URL additionalinfo: Private url is https://private.tria.ge/api/v0/ defaultvalue: https://api.tria.ge/v0/ name: base_url required: true type: 0 - display: API Key name: API Key required: false type: 4 additionalinfo: The API Key to use for the connection. hidden: true - name: credentials type: 9 required: false displaypassword: API Key hiddenusername: true - display: Verify SSL name: Verify SSL defaultvalue: 'true' type: 8 required: false - defaultvalue: 'false' display: Use system proxy settings name: proxy required: false type: 8 description: Submit a high volume of samples to run in a sandbox and view reports. display: Hatching Triage name: Hatching Triage script: commands: - arguments: - auto: PREDEFINED description: Get samples from either private or public reports. name: subset predefined: - owned - public name: triage-query-samples outputs: - contextPath: Triage.submissions.completed description: Date the sample analysis was completed. type: Date - contextPath: Triage.submissions.filename description: Name of the file submitted. type: String - contextPath: Triage.submissions.id description: Unique identifier of the submission. type: String - contextPath: Triage.submissions.kind description: Type of analysis. type: String - contextPath: Triage.submissions.private description: If the submissions is private or publically viewable. type: Boolean - contextPath: Triage.submissions.status description: Status of the submitted file. type: String - contextPath: Triage.submissions.submitted description: Date the sample was submitted. type: Date - contextPath: Triage.submissions.tasks.id description: Array of tasks that have been applied to the sample (static, behavioral, etc). type: String - contextPath: Triage.submissions.tasks.status description: Status of the task. type: String - contextPath: Triage.submissions.tasks.target description: Sample the task is being run on. type: String - contextPath: Triage.submissions.url description: URL that was submitted. type: String description: Get a list of all samples either private or public. - arguments: - auto: PREDEFINED description: Select if sample is a URL, file, or a file that should be fetched from a URL. name: kind predefined: - url - file - fetch required: true - auto: PREDEFINED defaultValue: 'false' description: Choose if the sample should be interacted with in the GUI glovebox. name: interactive predefined: - 'false' - 'true' - description: Select what profile to run the sample with. Requires the user to be registered with a company. name: profiles - description: Data to submit for analysis. For URLs and fetch, give the URL. For files, give the entry-id of the file. name: data required: true - name: password description: A password that may be used to decrypt the provided file, usually an archive. - name: timeout description: The timeout in seconds of the behavioral analysis. - name: network auto: PREDEFINED description: The type of network routing to use. predefined: - internet - drop - tor - sim200 - sim404 - simnx - nxdomain - name: user_tags description: An array of user-defined strings that lets the user mark a sample. The resulting tags are part of the overview and summary reports. isArray: true description: Submits a file or url for analysis. name: triage-submit-sample outputs: - contextPath: Triage.submissions.filename description: Name of the submitted file. type: String - contextPath: Triage.submissions.id description: Unique identifier of the submission. type: String - contextPath: Triage.submissions.kind description: Type of sample to analyze. type: String - contextPath: Triage.submissions.private description: If the file is private or publicly viewable. type: Boolean - contextPath: Triage.submissions.status description: Status of the analysis of the submission. type: String - contextPath: Triage.submissions.submitted description: Date that the sample was submitted on. type: Date - arguments: - description: Sample's unique identifier, can be found using the query samples command. name: sample_id required: true description: Pulls back basic information about the sample id given. name: triage-get-sample outputs: - contextPath: Triage.samples.completed description: Date the sample analysis was completed. type: Date - contextPath: Triage.samples.filename description: Name of the submitted sample. type: String - contextPath: Triage.samples.id description: Unique identifier of the sample. type: String - contextPath: Triage.samples.kind description: Type of sample submitted. type: String - contextPath: Triage.samples.private description: State of the visibility of the sample. type: Boolean - contextPath: Triage.samples.status description: Current status of the sample analysis. type: String - contextPath: Triage.samples.submitted description: Date the sample was submitted. type: Date - contextPath: Triage.samples.tasks.id description: Task name that was applied to the sample. type: String - contextPath: Triage.samples.tasks.status description: Status of the task. type: String - contextPath: Triage.samples.tasks.target description: Target of the task, e.g. filename for file submissions. type: String - arguments: - description: One or more comma-separated unique sample identifiers. These can be found using the query samples command. isArray: true name: sample_id required: true description: Gets a summary report of the sample id provided. name: triage-get-sample-summary outputs: - contextPath: Triage.sample-summaries.completed description: Date the sample analysis was completed. type: Date - contextPath: Triage.sample-summaries.created description: Date the analysis report was created. type: Date - contextPath: Triage.sample-summaries.custom description: '' type: String - contextPath: Triage.sample-summaries.owner description: '' type: String - contextPath: Triage.sample-summaries.sample description: Unique identifier of the sample. type: String - contextPath: Triage.sample-summaries.score description: Score of the sample on a scale of 0 to 10. type: Number - contextPath: Triage.sample-summaries.sha256 description: SHA256 of the sample. type: String - contextPath: Triage.sample-summaries.status description: Status of the analysis. type: String - contextPath: Triage.sample-summaries.target description: Target for analysis. type: String - contextPath: Triage.sample-summaries.tasks description: Tasks performed in the analysis. type: String - arguments: - description: Sample's unique identifier, can be found using the query samples command. name: sample_id required: true description: Deletes a sample from the sandbox. name: triage-delete-sample - arguments: - name: sample_id description: Sample's unique identifier, can be found using the query samples command. required: true - auto: PREDEFINED description: Let Triage automatically select a profile, default is True. name: auto predefined: - 'true' - 'false' - description: If submitting an archive file, select which files to analyze. Multiple files can be specified with a comma seperator.Format is archive_file_name/sample_file.exe,archive_file_name/sample_file2.exe. name: pick - description: Profile ID to use. name: profiles description: When a sample is in the static_analysis status, a profile should be selected in order to continue. name: triage-set-sample-profile - arguments: - name: sample_id description: Sample's unique identifier, can be found using the query samples command. required: true description: Get the static analysis of a sample. name: triage-get-static-report outputs: - contextPath: Triage.sample.reports.static.analysis.reported description: Date the sample was submitted. type: Unknown - contextPath: DBotScore.Indicator description: Triage analysis target. type: String - contextPath: DBotScore.Type description: The indicator type - File or URL. type: String - contextPath: DBotScore.Vendor description: The integration used to generate the indicator. type: String - contextPath: DBotScore.Score description: Analysis verdict as score from 1 to 10. type: Number - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA1 hash of the file. type: String - contextPath: URL.Data description: The URL. type: String - arguments: - name: sample_id description: Sample's unique identifier, can be found using the query samples command. required: true - name: task_id description: Name of a behavioral task part of the sample analysis (e.g. behavioral1, behavioral2). required: true description: Retrieves the generated Triage behavioral report for a single task. name: triage-get-report-triage outputs: - contextPath: Triage.sample.reports.triage description: Triage report of the submitted sample. type: Unknown - contextPath: DBotScore.Indicator description: Triage analysis target. type: String - contextPath: DBotScore.Type description: The indicator type - File or URL. type: String - contextPath: DBotScore.Vendor description: The integration used to generate the indicator. type: String - contextPath: DBotScore.Score description: Analysis verdict as score from 1 to 10. type: Number - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA1 hash of the file. type: String - contextPath: URL.Data description: The URL. type: String - arguments: - name: sample_id description: Sample's unique identifier, can be found using the query samples command. required: true - name: task_id description: Name of a behavioral task part of the sample analysis (e.g. behavioral1, behavioral2). required: true description: Retrieves the output of the kernel monitor. name: triage-get-kernel-monitor - arguments: - name: sample_id description: Sample's unique identifier, can be found using the query samples command. required: true - name: task_id description: Name of a behavioral task part of the sample analysis (e.g. behavioral1, behavioral2). required: true name: triage-get-pcap description: Retrieves the PCAP of the analysis for further manual analysis. - arguments: - name: sample_id description: Sample's unique identifier, can be found using the query samples command. required: true - name: task_id description: Name of the task for the sample (e.g. behavioral1, static1, etc). required: true - name: file_name description: Name of the dumped file. required: true name: triage-get-dumped-file description: Retrieves files dumped by the sample. The names can be found under the "dumped" section from the triage report output. - arguments: - name: userID description: Unique identifier of the user. Leave blank to query for all users. outputs: - contextPath: Triage.users.company_id description: Company unique identifier. type: String - contextPath: Triage.users.created_at description: Date users account was created. type: Date - contextPath: Triage.users.email description: Users email. type: String - contextPath: Triage.users.email_confirmed_at description: Date user confirmed their email/account. type: Date - contextPath: Triage.users.first_name description: Users first name. type: String - contextPath: Triage.users.id description: Users unique identifier. type: String - contextPath: Triage.users.last_name description: Users last name. type: String - contextPath: Triage.users.permissions description: Users permissions. type: String name: triage-get-users description: Return all users within the company as a paginated list. Returns a single user if a userID is provided. - arguments: - name: username description: Users username, usually their email. required: true - name: firstName description: Users first name. required: true - name: lastName description: Users last name. required: true - name: password description: Users password. required: true secret: true - auto: PREDEFINED name: permissions description: Users permissions. predefined: - view_samples - submit_samples - delete_samples - edit_profiles - access_api - manage_machines - manage_company required: true name: triage-create-user outputs: - contextPath: Triage.users.company_id description: Company unique identifier. type: String - contextPath: Triage.users.created_at description: Date users account was created. type: Date - contextPath: Triage.users.email description: Users email. type: String - contextPath: Triage.users.email_confirmed_at description: Date user confirmed their email/account. type: Date - contextPath: Triage.users.first_name description: Users first name. type: String - contextPath: Triage.users.id description: Users unique identifier. type: String - contextPath: Triage.users.last_name description: Users last name. type: String - contextPath: Triage.users.permissions description: Users permissions. type: String description: Creates a new user and returns it. The user will become a member of the company the requesting user is a member of. - arguments: - name: userID description: Users unique identifier, can be found by querying for all users. required: true name: triage-delete-user description: Delete a user and all associated data, invalidating any sessions and removing their API keys. Any samples submitted by this user are kept. - arguments: - name: userID description: Users unique identifier, can be found by querying for all users. required: true - defaultValue: Created from XSOAR name: name description: Name of the API key. name: triage-create-api-key outputs: - contextPath: Triage.apikey.key description: API Key. type: String - contextPath: Triage.apikey.name description: Name of the API Key. type: String description: Creates a new key can be used to make API calls on behalf of the specified user. The user should have been granted the access_api permission beforehand. - arguments: - name: userID description: Users unique identifier, can be found by querying for all users. required: true name: triage-get-api-key outputs: - contextPath: Triage.apikey.key description: API Key. type: String - contextPath: Triage.apikey.name description: Name of the API Key. type: String description: Lists all API keys that the user has. - arguments: - name: userID description: Users unique identifier, can be found by querying for all users. required: true - name: name description: Name of the API key to delete. required: true name: triage-delete-api-key description: Delete the user's API key with the specified name. - arguments: - name: profileID description: Unique identifier of the profile, can be found by querying for all profiles. name: triage-get-profiles outputs: - contextPath: Triage.profiles..id description: Unique identifier of the profile. type: String - contextPath: Triage.profiles..name description: Name of the profile. type: String - contextPath: Triage.profiles..network description: Network configuration. type: String - contextPath: Triage.profiles..options.browser description: Browser options. type: String - contextPath: Triage.profiles..tags description: Applied tags. type: String - contextPath: Triage.profiles..timeout description: Max run time of the profile. type: Number description: List all profiles that your company has. - arguments: - name: name description: Name of the profile to create. required: true - name: tags description: Tags to apply to the profile. required: true - name: timeout description: Length of time the profile should run for. - auto: PREDEFINED name: network description: Network configuration the profile should use. predefined: - drop - internet - proxy - tor - sim200 - sim404 name: triage-create-profile outputs: - contextPath: Triage.profiles.id description: Profile unique identifier. type: String - contextPath: Triage.profiles.name description: Profile name. type: String - contextPath: Triage.profiles.network description: Profile network configuration. type: String - contextPath: Triage.profiles.options description: Profile options. type: Unknown - contextPath: Triage.profiles.tags description: Profile tags. type: String - contextPath: Triage.profiles.timeout description: Profile max run time. type: Number description: Create a new profile. - arguments: - name: profileID description: Unique identifier of the profile to update. required: true - name: name description: Name of the profile. required: true - name: tags description: Tags to apply to the profile. required: true - name: timeout description: Length of time the profile should run for. name: triage-update-profile description: Update an existing profile. - arguments: - name: query description: The search query for Triage. required: true name: triage-query-search description: Get a list of private and public samples matching the search query. outputs: - contextPath: Triage.samples.completed description: Date the sample analysis was completed. type: date - contextPath: Triage.samples.filename description: Name of the file submitted. type: string - contextPath: Triage.samples.id description: Unique identifier of the submission. type: string - contextPath: Triage.samples.kind description: Type of analysis. type: string - contextPath: Triage.samples.private description: If the submissions is private or publically viewable. type: boolean - contextPath: Triage.samples.status description: Status of the submitted file. type: string - contextPath: Triage.samples.submitted description: Date the sample was submitted. type: date - contextPath: Triage.samples.tasks.id description: Array of tasks that have been applied to the sample (static, behavioral, etc). type: string - contextPath: Triage.samples.tasks.status description: Status of the task. type: string - contextPath: Triage.samples.tasks.target description: Sample the task is being run on. type: string - contextPath: Triage.samples.url description: URL that was submitted. type: string - arguments: - name: profileID description: Unique identifier of the profile to delete. required: true name: triage-delete-profile description: Update the profile with the specified ID or name. The stored profile is overwritten, so it is important that the submitted profile has all fields, with the exception of the ID. dockerimage: demisto/python3:3.12.8.3296088 runonce: false script: '' subtype: python3 type: python tests: - No tests (auto formatted)