commonfields: id: OrionMalware version: -1 name: OrionMalware display: OrionMalware category: Forensics & Malware Analysis fromversion: 8.0.0 sectionorder: - Connect - Collect description: This is the Orion Malware integration. Analyzes hash and files with static and dynamic analysis. provider: Airbus configuration: - display: Server URL section: Connect name: base_url defaultvalue: https://orion.cyberrange.cloud/ type: 0 required: true - display: API Key (leave empty. Fill in the API key in the password field.) section: Connect displaypassword: API Key name: api_key type: 9 required: true hiddenusername: true - display: Use system proxy settings section: Connect advanced: true name: proxy defaultvalue: "false" type: 8 required: false - display: Trust any certificate (not secure) name: insecure section: Connect defaultvalue: "false" type: 8 required: false - display: Source Reliability section: Collect name: feedReliability defaultvalue: C - Fairly reliable type: 15 required: false options: - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability can not be judged additionalinfo: Reliability of the source providing intelligence data script: script: '' type: python subtype: python3 commands: - name: hash-scan arguments: - name: file_hash required: true default: true description: hash field, supports md5, sha1, sha256. isArray: true outputs: - contextPath: Orion.File.antivirus.antivirus_name description: antivirus_name analysis. type: string - contextPath: Orion.File.antivirus.threat_name description: threat detected by antivirus. type: string - contextPath: Orion.File.end_analysis description: end_analysis. type: date - contextPath: Orion.File.first_submission description: first_submission. type: date - contextPath: Orion.File.identification.filename description: filename of the file corresponding to the hash. type: string - contextPath: Orion.File.identification.md5 description: md5 hash of the file. type: string - contextPath: Orion.File.identification.sha1 description: sha1 hash of the file. type: string - contextPath: Orion.File.identification.sha256 description: sha256 hash of the file. type: string - contextPath: Orion.File.identification.size description: Byte size. type: number - contextPath: Orion.File.identification.type description: type of file. type: string - contextPath: Orion.File.last_updated description: last_updated. type: date - contextPath: Orion.File.matched_mitre_attacks.description description: mitre description. type: string - contextPath: Orion.File.matched_mitre_attacks.id description: mitre ttp. type: string - contextPath: Orion.File.matched_mitre_attacks.kill_chain_phases description: mitre tactics. type: unknown - contextPath: Orion.File.matched_mitre_attacks.name description: technique name. type: string - contextPath: Orion.File.networks.address description: network address detected. type: string - contextPath: Orion.File.payloads description: payloads. type: unknown - contextPath: Orion.File.risk.dynamic.descriptions.files description: dynmaic file analysis. type: unknown - contextPath: Orion.File.risk.dynamic.descriptions.network description: network dynamic analysis. type: unknown - contextPath: Orion.File.risk.dynamic.descriptions.persistence description: persistence dynamic analysis. type: unknown - contextPath: Orion.File.risk.dynamic.descriptions.processes description: processes dynamic analysis. type: unknown - contextPath: Orion.File.risk.dynamic.descriptions.system description: system dynamic analysis. type: unknown - contextPath: Orion.File.risk.dynamic.scores description: dynamic risk scoring. type: unknown - contextPath: Orion.File.risk.level description: dynamic risk. type: string - contextPath: Orion.File.risk.scanner.descriptions.system description: system static analysis. type: unknown - contextPath: Orion.File.risk.scanner.descriptions.processes description: processes static analysis. type: unknown - contextPath: Orion.File.risk.scanner.descriptions.persistence description: persistence static analysis. type: unknown - contextPath: Orion.File.risk.scanner.descriptions.files description: files static analysis. type: unknown - contextPath: Orion.File.risk.scanner.descriptions.network description: network static analysis. type: unknown - contextPath: Orion.File.risk.scanner.scores description: static risk scoring. - contextPath: Orion.File.rules description: rules. type: unknown - contextPath: Orion.File.start_analysis description: start analysis date. type: date - contextPath: File.MD5 description: Bad MD5 hash. type: string - contextPath: File.SHA1 description: bad SHA1 has h. type: string - contextPath: File.SHA256 description: bad SHA256 has h. type: string - contextPath: File.Orion.EngineDetections description: Number of engines that flagged the file as malicious. type: string - contextPath: File.Orion.EngineVendors description: engines. type: string - contextPath: File.Orion.EngineDetectionNames description: threat name. type: string - contextPath: IP.Address description: IP Linked to hash. type: string - contextPath: Orion.IP.Address description: IP Linked to hash. type: string - contextPath: File.Relationships.EntityA description: Source of relationship. type: string - contextPath: File.Relationships.EntityB description: Destination of relationship. type: string - contextPath: File.Relationships.EntityAType description: Source type of relationship. type: string - contextPath: File.Relationships.EntityBType description: Destination type of relationship. type: string - contextPath: File.Relationships.Relationship description: Kind of relation. type: string - contextPath: Orion.File.report_url description: report url. type: string description: Check hash value against Orion Malware database. - name: file-scan arguments: - name: entryID required: true default: true description: the file entry id to submit. isArray: true outputs: - contextPath: Orion.File.antivirus.antivirus_name description: antivirus_name analysis. type: string - contextPath: Orion.File.antivirus.threat_name description: threat detected by antivirus. type: string - contextPath: Orion.File.end_analysis description: end_analysis. type: date - contextPath: Orion.File.first_submission description: first_submission. type: date - contextPath: Orion.File.identification.filename description: filename of the file corresponding to the hash. type: string - contextPath: Orion.File.identification.md5 description: md5 hash of the file. type: string - contextPath: Orion.File.identification.sha1 description: sha1 hash of the file. type: string - contextPath: Orion.File.identification.sha256 description: sha256 hash of the file. type: string - contextPath: Orion.File.identification.size description: Byte size. type: number - contextPath: Orion.File.identification.type description: type of file. type: string - contextPath: Orion.File.last_updated description: last_updated. type: date - contextPath: Orion.File.matched_mitre_attacks.description description: mitre description. type: string - contextPath: Orion.File.matched_mitre_attacks.id description: mitre ttp. type: string - contextPath: Orion.File.matched_mitre_attacks.kill_chain_phases description: mitre tactics. type: unknown - contextPath: Orion.File.matched_mitre_attacks.name description: technique name. type: string - contextPath: Orion.File.networks.address description: network address detected. type: string - contextPath: Orion.File.payloads description: payloads. type: unknown - contextPath: Orion.File.risk.dynamic.descriptions.files description: dynmaic file analysis. type: unknown - contextPath: Orion.File.risk.dynamic.descriptions.network description: network dynamic analysis. type: unknown - contextPath: Orion.File.risk.dynamic.descriptions.persistence description: persistence dynamic analysis. type: unknown - contextPath: Orion.File.risk.dynamic.descriptions.processes description: processes dynamic analysis. type: unknown - contextPath: Orion.File.risk.dynamic.descriptions.system description: system dynamic analysis. type: unknown - contextPath: Orion.File.risk.dynamic.scores description: dynamic risk scoring. type: unknown - contextPath: Orion.File.risk.level description: dynamic risk. type: string - contextPath: Orion.File.risk.scanner.descriptions.system description: system static analysis. type: unknown - contextPath: Orion.File.risk.scanner.descriptions.processes description: processes static analysis. type: unknown - contextPath: Orion.File.risk.scanner.descriptions.persistence description: persistence static analysis. type: unknown - contextPath: Orion.File.risk.scanner.descriptions.files description: files static analysis. type: unknown - contextPath: Orion.File.risk.scanner.descriptions.network description: network static analysis. type: unknown - contextPath: Orion.File.risk.scanner.scores description: static risk scoring. - contextPath: Orion.File.rules description: rules. type: unknown - contextPath: Orion.File.start_analysis description: start analysis date. type: date - contextPath: File.MD5 description: Bad MD5 hash. type: string - contextPath: File.SHA1 description: bad SHA1 has h. type: string - contextPath: File.SHA256 description: bad SHA256 has h. type: string - contextPath: File.Orion.EngineDetections description: Number of engines that flagged the file as malicious. type: string - contextPath: File.Orion.EngineVendors description: engines. type: string - contextPath: File.Orion.EngineDetectionNames description: threat name. type: string - contextPath: IP.Address description: IP Linked to hash. type: string - contextPath: Orion.IP.Address description: IP Linked to hash. type: string - contextPath: File.Relationships.EntityA description: Source of relationship. type: string - contextPath: File.Relationships.EntityB description: Destination of relationship. type: string - contextPath: File.Relationships.EntityAType description: Source type of relationship. type: string - contextPath: File.Relationships.EntityBType description: Destination type of relationship. type: string - contextPath: File.Relationships.Relationship description: Kind of relation. type: string - contextPath: Orion.File.report_url description: report url. type: string description: Detonate file in Orion Malware. dockerimage: demisto/python3:3.12.13.9059085 tests: - No tests (auto formatted)