Reversinglabs A1000 v2

Publisher: ReversingLabs
Connector Version: 1.1.1
Product Vendor: ReversingLabs
Product Name: A1000
Product Version Supported (regex): ".*"
Minimum Product Version: 6.2.1

App integrates with ReversingLabs A1000 Malware Analysis Appliance APIs

Reversinglabs A1000 v2

Publisher: ReversingLabs
Connector Version: 1.1.1
Product Vendor: ReversingLabs
Product Name: A1000
Product Version Supported (regex): ".*"
Minimum Product Version: 5.5.0

App integrates with ReversingLabs A1000 Malware Analysis Appliance APIs

Configuration Variables

The below configuration variables are required for this Connector to operate. These variables are specified when configuring a A1000 asset in SOAR.

VARIABLE	REQUIRED	TYPE	DESCRIPTION
url	required	string	A1000 url
token	required	password	A1000 token

Supported Actions

test connectivity - Validate the asset configuration for connectivity using supplied configuration
detonate file - Upload file to A1000
submit url - Detonate file from url
check submitted url status - Check submitted url status
create pdf report - Create pdf report
check pdf report creation - Check pdf report creation
download pdf report - Download pdf report
get titaniumcore report - Get TitaniumCore report
url reputation - Queries URL info
domain reputation - Queries domain info
ip reputation - Queries IP info
network ip to domain - Get a list of IP-to-domain mappings
network urls from ip - Get a list of URLs hosted on the requested IP address
network files from ip - Get a a list of hashes and classifications for files found on the requested IP address
advanced search - Search for samples using multi-part search criteria
advanced search ticloud - Search for samples available on the TitaniumCloud
advanced search local - Search for samples available on the A1000 appliance
create dynamic analysis report - Initiate the creation of dynamic analysis PDF report
check dynamic analysis report status - Get status of the report previously requested
download dynamic analysis report - Download previously requested dynamic analysis report in pdf
get summary report - Get a summary report for hash
get detailed report - Get detailed analysis report
get classification - Get classification for a sample
get user tags - List existing tags for the requested sample
create user tags - Add one or more user tags
delete user tags - Remove one or more user tags
set sample classification - Set the classification of a sample
delete sample classification - Delete the (user set) classification of a sample
yara get rulesets - Get a list of YARA rulesets that are on the A1000
yara get ruleset text - Get the full contents of the requested ruleset
yara get matches - Retrieve the list of YARA matches
yara create or update ruleset - Creates a new YARA ruleset if it doesn't exist
yara delete ruleset - Delete a specific YARA ruleset and its matches
yara enable or disable ruleset - Enable or disable a ruleset on the appliance
yara get synchronization time - Get the current synchronization time
yara set ruleset synchronization time - Modify the TiCloud sync time for TiCloud enabled rulesets
yara start or stop local retro scan - Allow users to start or stop the Local Retro scan on the appliance
yara manage cloud retro scan - Allow users to start, stop or clear a Cloud Retro scan
yara status retro scan local - Allow users to check the status of a Local Retro scan
yara status retro scan cloud - Allow users to check the status of Cloud Retro scan
list containers for hash - Get a list of containers from which the requested samples
delete sample - Delete the sample with the requested hash value
download extracted files - Download files extracted from local sample
reanalyze local samples - Submit a set of samples that already exist on the A1000

action: 'test connectivity'

Validate the asset configuration for connectivity using supplied configuration

Type: test
Read only: True

Validate the asset configuration for connectivity using supplied configuration.

Action Parameters

No parameters are required for this action

Action Output

No Output

action: 'detonate file'

Upload file to A1000

Type: investigate
Read only: True

Upload file to A1000.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
vault_id	required	Vault ID of file to detonate	string	vault_id
file_name	optional	Filename to use	string	file name
custom_file_name	optional	Custom file name for upload	string	file name
archive_password	optional	password for the file if it is password protected	password
rl_cloud_sandbox_platform	optional	Cloud Sandbox platform	string
tags	optional	Comma separated list of tags to assign to sample	string
comment	optional	Comment to add to sample	string
cloud_analysis	optional	Use cloud analysis	boolean

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.vault_id	string	vault_id
action_result.parameter.file_name	string	file name
action_result.parameter.custom_file_name	string	file name
action_result.parameter.rl_cloud_sandbox_platform	string		"windows7" "windows10" "macos_11" "windows11" "linux"
action_result.parameter.tags	string
action_result.parameter.comment	string
action_result.parameter.cloud_analysis	boolean
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'submit url'

Detonate file from url

Type: generic
Read only: False

Detonate file from url.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
file_url	required	URL from which the appliance should download the data	string	url
crawler	optional	Crawler method (local or cloud)	password
archive_password	optional	Password, if file is a password-protected archive	string
rl_cloud_sandbox_platform	optional	Cloud Sandbox platform	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.file_url	string	url
action_result.parameter.crawler	string		"local" "cloud"
action_result.parameter.rl_cloud_sandbox_platform	string		"windows7" "windows10" "macos_11" "windows11" "linux"
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'check submitted url status'

Check submitted url status

Type: generic
Read only: False

Check submitted url status. Returns report if ready.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
task_id	required	Id of the task	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.parameter.task_id	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'create pdf report'

Create pdf report

Type: generic
Read only: False

Initiate pdf report creation.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.parameter.hash	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'check pdf report creation'

Check pdf report creation

Type: generic
Read only: False

Check pdf report creation status.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.parameter.hash	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'download pdf report'

Download pdf report

Type: generic
Read only: False

Download pdf report.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.parameter.hash	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'get titaniumcore report'

Get TitaniumCore report

Type: generic
Read only: False

Accepts a single hash string and gets the full TitaniumCore static analysis report for the requested sample.The requested sample must be present on the appliance. If the optional fields parameter is not provided in the request, all available parts of the static analysis report are returned in the response.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.parameter.hash	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'url reputation'

Queries URL info

Type: investigate
Read only: True

Queries URL info.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
url	required	URL to query	string	url

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.parameter.url	string	url
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'domain reputation'

Queries domain info

Type: investigate
Read only: True

Queries domain info.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
domain	required	Domain to query	string	domain url

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.parameter.domain	string	domain url
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'ip reputation'

Queries IP info

Type: investigate
Read only: True

Queries IP info.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ip	required	IP to query	string	ip

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.parameter.ip	string	ip
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'network ip to domain'

Get a list of IP-to-domain mappings

Type: generic
Read only: False

Accepts an IP address string and returns a list of IP-to-domain mappings.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ip	required	IP address	string	ip
page	optional	SHA1 hash of page	string
page_size	optional	Page size	numeric

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ip	string	ip
action_result.parameter.page	string
action_result.parameter.page_size	numeric
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'network urls from ip'

Get a list of URLs hosted on the requested IP address

Type: generic
Read only: False

Accepts an IP address string and returns a list of URLs hosted on the requested IP address.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ip	required	IP address	string	ip
page	optional	SHA1 hash of page	string
page_size	optional	Page size	numeric

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ip	string	ip
action_result.parameter.page	string
action_result.parameter.page_size	numeric
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'network files from ip'

Get a a list of hashes and classifications for files found on the requested IP address

Type: generic
Read only: False

Accepts an IP address string and returns a list of hashes and classifications for files found on the requested IP address.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ip	required	IP address	string	ip
page	optional	SHA1 hash of page	string
page_size	optional	Page size	numeric

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ip	string	ip
action_result.parameter.page	string
action_result.parameter.page_size	numeric
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'advanced search'

Search for samples using multi-part search criteria

Type: generic
Read only: True

Search for samples available on the local A1000 instance and TitaniumCloud using the Advanced Search capabilities.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
query	required	Advanced Search query	string	search query
limit	optional	Maximum number of results	numeric
only_cloud_results	optional	Show only TiCloud results	boolean

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.query	string	search query	"classification:malicious"
action_result.parameter.limit	numeric
action_result.parameter.only_cloud_results	boolean
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'advanced search ticloud'

Search for samples available on the TitaniumCloud using the V3 endpoint

Type: generic
Read only: True

All restricted words and characters must be escaped with double quotation marks. This action will work only if A1000 is set up with the access to TiCloud.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
query	required	Advanced Search query	string	search query
start_search_date	required	The starting date for the search (later date)	string
end_search_date	required	The ending date for the search (earlier date)	string
sorting_order	optional	Ascending or descending	string
sorting_criteria	optional	Sort results on this column	string
limit	optional	Get at most search results, if page is set max value is 100	numeric
page	optional	Use pagination instead of aggregated getter, off by default, index starts at 1	numeric

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.query	string	search query	"classification:malicious"
action_result.parameter.start_search_date	string		"2024-05-30"
action_result.parameter.end_search_date	string		"2024-05-01"
action_result.parameter.sorting_order	string		"asc" "desc"
action_result.parameter.sorting_criteria	string		"sha1" "firstseen" "threatname" "sampletype" "filecount" "size"
action_result.parameter.limit	numeric
action_result.parameter.page	numeric
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'advanced search local'

Search for samples available on the A1000 appliance using the V3 endpoint

Type: generic
Read only: True

All restricted words and characters must be escaped with double quotation marks.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
query	required	Advanced Search query	string	search query
sorting_order	optional	Ascending or descending	string
sorting_criteria	optional	Sort results on this column	string
limit	optional	Get at most search results, if page is set max value is 100	numeric
page	optional	Use pagination instead of aggregated getter, off by default, index starts at 1	numeric

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.query	string	search query	"classification:malicious"
action_result.parameter.sorting_order	string		"asc" "desc"
action_result.parameter.sorting_criteria	string		"sha1" "firstseen" "threatname" "sampletype" "filecount" "size"
action_result.parameter.limit	numeric
action_result.parameter.page	numeric
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'create dynamic analysis report'

Initiate the creation of dynamic analysis PDF report

Type: generic
Read only: False

Accepts a single hash string and and a report format and initiates the creation of PDF or HTML reports for samples that have gone through dynamic analysis in the ReversingLabs Cloud Sandbox.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.parameter.hash	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'check dynamic analysis report status'

Get status of the report previously requested

Type: generic
Read only: False

Accepts a single hash string and report format parameters that should correspond to the parameters used in the request with create_dynamic_analysis_report method. The response includes an informative message about the status of the report previously requested.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.parameter.hash	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'download dynamic analysis report'

Download previously requested dynamic analysis report in pdf

Type: generic
Read only: False

Accepts a single hash string and report format parameters that should correspond to the parameters used in the request with create_dynamic_analysis_report method.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.parameter.hash	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'get summary report'

Get a summary report for hash

Type: generic
Read only: False

Get a summary report for hash.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string
retry	optional	If set to False there will only be one try at obtaining the analysis report	boolean
fields	optional	List of A1000 report 'fields' to query	string
include_network_threat_intelligence	optional	Include network threat intelligence in the summary report	boolean
skip_reanalysis	optional	Skip sample reanalysis when fetching the summary report	boolean

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.parameter.fields	string
action_result.parameter.hash	string
action_result.parameter.include_network_threat_intelligence	boolean
action_result.parameter.retry	boolean
action_result.parameter.skip_reanalysis	boolean
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'get detailed report'

Get detailed analysis report

Type: generic
Read only: False

Get detailed analysis report for sample.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string
retry	optional	If set to False there will only be one try at obtaining the analysis report	boolean
fields	optional	List of A1000 report 'fields' to query	string
skip_reanalysis	optional	Skip sample reanalysis when fetching the summary report	boolean

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.parameter.fields	string
action_result.parameter.hash	string
action_result.parameter.retry	boolean
action_result.parameter.skip_reanalysis	boolean
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'get classification'

Get classification for a sample

Type: generic
Read only: False

Get classification for one sample. The default value of local_only is False, which, if not changed, will send a request to TitaniumCloud to get the sample. The av_scanners parameter decides if the AV scanner results will be included in the classification report.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string
local_only	optional	Return only local samples without querying TitaniumCloud	boolean
av_scanners	optional	Return AV scanner results	boolean

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.parameter.av_scanners	boolean
action_result.parameter.hash	string
action_result.parameter.local_only	boolean
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'get user tags'

List existing tags for the requested sample

Type: generic
Read only: True

List existing tags for the requested sample, if there are any.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	sample hash	string	hash sha1 sha256 md5

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'create user tags'

Add one or more user tags

Type: generic
Read only: False

Add one or more User Tags to the sample, regardless of whether the sample already has any tags.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5
tags	required	List of comma separated tags	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.parameter.tags	string		tag1,tag2,tag3
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'delete user tags'

Remove one or more user tags

Type: generic
Read only: False

Remove one or more User Tags from the requested sample.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5
tags	required	List of comm separated tags	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.parameter.tags	string		tag1,tag2,tag3
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'set sample classification'

Set the classification of a sample

Type: generic
Read only: False

This API allows the user to set the classification of a sample, either in TitaniumCloud or locally on the A1000.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5
system	required	Where to set the classification	string
classification	required	Classification to set	string
risk_score	optional	Risk score to set for classification	string
threat_platform	optional	Threat platfrom to set, must be on the supported list	string
threat_type	optional	Threat type to set, must be on the supported list	string
threat_name	optional	Threat name to set, must be on the supported list	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.parameter.system	string		"cloud" "local"
action_result.parameter.classification	string		"goodware" "malicious" "suspicious"
action_result.parameter.risk_score	string		0 <= risk_score <= 10
action_result.parameter.threat_platform	string
action_result.parameter.threat_type	string
action_result.parameter.threat_name	string
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'delete sample classification'

Delete the (user set) classification of a sample

Type: generic
Read only: False

This API allows the user to delete the classification of a sample, either in TitaniumCloud or locally on the A1000.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5
system	required	Where to set the classification	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.parameter.system	string		"cloud" "local"
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara get rulesets'

Get a list of YARA rulesets that are on the A1000

Type: generic
Read only: True

For every ruleset in the list, the output includes additional info such as: rule name, number of matches, last matched date, and more.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
type	optional	Owner type	string
status	optional	Status	string
source	optional	Source	string
page	optional	Page	numeric
page_size	optional	Page size	numeric

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.type	string		"my" "user" "system" "all"
action_result.parameter.status	string		"all" "error" "active" "disabled" "pending" "invalid" "capped"
action_result.parameter.source	string		"all" "local" "cloud"
action_result.parameter.page	numeric
action_result.parameter.page_size	numeric
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara get ruleset text'

Get the full contents of the requested ruleset

Type: generic
Read only: True

Get the full contents of the requested ruleset in raw text. All rulesets can be retrieved.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ruleset_name	reuired	Ruleset name	string	ruleset name

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ruleset_name	string	ruleset_name
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara get matches'

Retrieve the list of YARA matches

Type: investigate
Read only: True

Retrieve the list of YARA matches (local & cloud) for requested ruleset. Names are case-sensitive.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ruleset_name	required	Ruleset name	string	ruleset name
page	optional	Page	numeric
page_size	optional	Page size	numeric

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ruleset_name	string	ruleset name
action_result.parameter.page	numeric
action_result.parameter.page_size	numeric
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara create or update ruleset'

Creates a new YARA ruleset if it doesn't exist

Type: generic
Read only: False

Creates a new YARA ruleset if it doesn't exist. If it exists a new revision is created. TiCloud rules cannot be updated using this API.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ruleset_name	required	Ruleset name	string	ruleset name
ruleset_text	required	Text of the yara ruleset	string
publish	optional	Publish to C1000 in the same cluster	boolean
ticloud	optional	Sync with TiCloud	boolean

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ruleset_name	string	ruleset name
action_result.parameter.ruleset_text	string
action_result.parameter.publish	boolean
action_result.parameter.ticloud	boolean
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara delete ruleset'

Delete a specific YARA ruleset and its matches

Type: generic
Read only: False

Delete a specific YARA ruleset and its matches from the appliance.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ruleset_name	required	Ruleset name	string	ruleset name
publish	optional	Publish to c1000 in the same cluster	boolean

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ruleset_name	string	ruleset name
action_result.parameter.publish	boolean
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara enable or disable ruleset'

Enable or disable a ruleset on the appliance

Type: generic
Read only: False

Administrators can manage any ruleset while regular A1000 users can only manage their own.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ruleset_name	required	Ruleset name	string	ruleset name
enabled	required	Enable or disable the ruleset	boolean
publish	optional	Publish to c1000 in the same cluster	boolean

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ruleset_name	string	ruleset name
action_result.parameter.enabled	boolean
action_result.parameter.publish	boolean
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara get synchronization time'

Get the current synchronization time

Type: generic
Read only: True

Provides information about the current synchronization status for TiCloud enabled rulesets.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara set ruleset synchronization time'

Modify the TiCloud sync time for TiCloud enabled rulesets

Type: generic
Read only: False

Modify the TiCloud sync time for TiCloud enabled rulesets. Time parameter must be a UTC timestamp ."

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
time	required	Synchronization time	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.time	string		"2024-05-29 10:00:00"
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara start or stop local retro scan'

Allow users to start or stop the local Retro scan on the appliance

Type: generic
Read only: False

Allow users to start or stop the Local Retro scan on the appliance.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
operation	required	START or STOP	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.operation	string
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara manage cloud retro scan'

Allow users to start, stop or clear a Cloud Retro scan

Type: generic
Read only: False

Start/Stop or Clear a Cloud Retro scan for a specified ruleset on the A1000.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ruleset_name	required	Ruleset name	string	ruleset name
operation	required	START, STOP or CLEAR	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ruleset_name	string	ruleset name
action_result.parameter.operation	string
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara status retro scan local'

Allow users to check the status of a Local Retro scan

Type: generic
Read only: True

The response indicates the current state of Local Retro scan, time and date when the latest Local Retro scan was started and/or stopped, and a list of previous Local Retro scans with the same details.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara status retro scan cloud'

Allow users to check the status of Cloud Retro scan for specified ruleset

Type: generic
Read only: True

The response indicates the current state of Cloud Retro, time and date when the latest Cloud Retro scan was started and/or stopped, and a list of previous Cloud Retro scans with the same details.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ruleset_name	required	Ruleset name	string	ruleset name

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ruleset_name	string	ruleset name
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'list containers for hash'

Get a list of containers from which the requested samples has been extracted

Type: investigate Read only: True

Get a list of all top-level containers from which the requested samples have been extracted during analysis. If a requested hash doesn't have a container, it will not be included in the response.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hashes	required	Comma separated list of hashes	string	hash sha1 sha256 md5

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hashes	string	hash sha1 sha256 md5
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'delete sample'

Delete the sample with the requested hash value

Type: generic
Read only: False

All related data, including extracted samples and metadata, will be deleted from the current A1000 instance.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash of a sample to e deleted	string	hash sha1 sha256 md5

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.data.*.results.code	numeric
action_result.data.*.results.message	string
action_result.data.*.results.detail.md5	string	hash md5
action_result.data.*.results.detail.sha1	string	hash sha1
action_result.data.*.results.detail.sha256	string	hash sha256
action_result.data.*.results.detail.sha512	string	hash sha512
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'download extracted files'

Download files extracted from local sample

Type: generic
Read only: True

The files are obtained through the unpacking process during sample analysis with the TitaniumCore static analysis engine.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash of a sample to e deleted	string	hash sha1 sha256 md5

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'reanalyze local samples'

Submit a set fo samples that already exist on the A1000

Type: investigate
Read only: False

Get classification for one sample. The default value of local_only is False, which, if not changed, will send a request to TitaniumCloud to get the sample. The av_scanners parameter decides if the AV scanner results will be included in the classification report.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hashes	required	Comma separated list of hashes	string	hash sha1 sha256 md5
titanium_cloud	optional	Titanium Cloud analysis	boolean
titanium_core	optional	Titanium Core analysis	boolean
rl_cloud_sandbox	optional	RL cloud sandbox analysis	boolean
cuckoo_sandbox	optional	Cuckoo sandbox analysis	boolean
fireeye	optional	FireEye analysis	boolean
joe_sandbox	optional	Joe sandbox analysis	boolean
cape	optional	Cape analysis	boolean
rl_cloud_sandbox_platform	optional	Platform on which the samples should be detonated	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hashes	string	hash sha1 sha256 md5
action_result.parameter.titanium_cloud	boolean
action_result.parameter.titanium_core	boolean
action_result.parameter.rl_cloud_sandbox	boolean
action_result.parameter.cuckoo_sandbox	boolean
action_result.parameter.fireeye	boolean
action_result.parameter.joe_sandbox	boolean
action_result.parameter.cape	boolean
action_result.parameter.rl_cloud_sandbox_platform	string
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

Configuration Variables

The below configuration variables are required for this Connector to operate. These variables are specified when configuring a A1000 asset in SOAR.

VARIABLE	REQUIRED	TYPE	DESCRIPTION
url	required	string	A1000 url
token	required	password	A1000 token

Supported Actions

test connectivity - Validate the asset configuration for connectivity using supplied configuration
detonate file - Upload file to A1000
submit url - Detonate file from url
check submitted url status - Check submitted url status
create pdf report - Create pdf report
check pdf report creation - Check pdf report creation
download pdf report - Download pdf report
get titaniumcore report - Get TitaniumCore report
url reputation - Queries URL info
domain reputation - Queries domain info
ip reputation - Queries IP info
network ip to domain - Get a list of IP-to-domain mappings
network urls from ip - Get a list of URLs hosted on the requested IP address
network files from ip - Get a a list of hashes and classifications for files found on the requested IP address
advanced search - Search for samples using multi-part search criteria
advanced search ticloud - Search for samples available on the TitaniumCloud
advanced search local - Search for samples available on the A1000 appliance
create dynamic analysis report - Initiate the creation of dynamic analysis PDF report
check dynamic analysis report status - Get status of the report previously requested
download dynamic analysis report - Download previously requested dynamic analysis report in pdf
get summary report - Get a summary report for hash
get detailed report - Get detailed analysis report
get classification - Get classification for a sample
get user tags - List existing tags for the requested sample
create user tags - Add one or more user tags
delete user tags - Remove one or more user tags
set sample classification - Set the classification of a sample
delete sample classification - Delete the (user set) classification of a sample
yara get rulesets - Get a list of YARA rulesets that are on the A1000
yara get ruleset text - Get the full contents of the requested ruleset
yara get matches - Retrieve the list of YARA matches
yara create or update ruleset - Creates a new YARA ruleset if it doesn't exist
yara delete ruleset - Delete a specific YARA ruleset and its matches
yara enable or disable ruleset - Enable or disable a ruleset on the appliance
yara get synchronization time - Get the current synchronization time
yara set ruleset synchronization time - Modify the TiCloud sync time for TiCloud enabled rulesets
yara start or stop local retro scan - Allow users to start or stop the Local Retro scan on the appliance
yara manage cloud retro scan - Allow users to start, stop or clear a Cloud Retro scan
yara status retro scan local - Allow users to check the status of a Local Retro scan
yara status retro scan cloud - Allow users to check the status of Cloud Retro scan for specified ruleset
list containers for hash - Get a list of containers from which the requested samples has been extracted
delete sample - Delete the sample with the requested hash value
download extracted files - Download files extracted from local sample
reanalyze local samples - Submit a set of samples that already exist on the A1000

action: 'test connectivity'

Validate the asset configuration for connectivity using supplied configuration

Type: test
Read only: True

Validate the asset configuration for connectivity using supplied configuration.

Action Parameters

No parameters are required for this action

Action Output

No Output

action: 'detonate file'

Upload file to A1000

Type: investigate
Read only: True

Upload file to A1000.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
vault_id	required	Vault ID of file to detonate	string	vault id
file_name	optional	Filename to use	string
custom_file_name	optional	Custom file name for upload	string	file name
archive_password	optional	Password for the file if it is password protected	password
rl_cloud_sandbox_platform	optional	Cloud Sandbox platform	string
tags	optional	Comma separated list of tags to assign to sample	string
comment	optional	Comment to add to a sample	string
cloud_analysis	optional	Use cloud analysis	boolean

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.vault_id	string	vault id
action_result.parameter.file_name	string
action_result.parameter.custom_file_name	string	file name
action_result.parameter.rl_cloud_sandbox_platform	string
action_result.parameter.tags	string
action_result.parameter.comment	string
action_result.parameter.cloud_analysis	boolean
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'submit url'

Detonate file from url

Type: generic
Read only: False

Detonate file from url.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
file_url	required	URL from which the appliance should download the data	string	url
crawler	optional	Crawler method (local or cloud)	string
archive_password	optional	Password, if file is a password-protected archive	password
rl_cloud_sandbox_platform	optional	Cloud Sandbox platform	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.file_url	string	url
action_result.parameter.crawler	string
action_result.parameter.rl_cloud_sandbox_platform	string
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'check submitted url status'

Check submitted url status

Type: generic
Read only: False

Check submitted url status. Returns report if ready.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
task_id	required	Id of the task	string	task id

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.task_id	string	task id
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'create pdf report'

Create pdf report

Type: generic
Read only: False

Initiate pdf report creation.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'check pdf report creation'

Check pdf report creation

Type: generic
Read only: False

Check pdf report creation status.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'download pdf report'

Download pdf report

Type: generic
Read only: False

Download pdf report.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'get titaniumcore report'

Get TitaniumCore report

Type: generic
Read only: False

Accepts a single hash string and gets the full TitaniumCore static analysis report for the requested sample.The requested sample must be present on the appliance. If the optional fields parameter is not provided in the request, all available parts of the static analysis report are returned in the response.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'url reputation'

Queries URL info

Type: investigate
Read only: True

Queries URL info.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
url	required	URL to query	string	url

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.url	string	url
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'domain reputation'

Queries domain info

Type: investigate
Read only: True

Queries domain info.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
domain	required	Domain to query	string	domain url

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.domain	string	domain url
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'ip reputation'

Queries IP info

Type: investigate
Read only: True

Queries IP info.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ip	required	IP to query	string	ip

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ip	string	ip
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'network ip to domain'

Get a list of IP-to-domain mappings

Type: generic
Read only: False

Accepts an IP address string and returns a list of IP-to-domain mappings.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ip	required	IP address	string	ip
page	optional	SHA1 hash of page	string
page_size	optional	Number of elements in the response	numeric

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ip	string	ip
action_result.parameter.page	string
action_result.parameter.page_size	numeric
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'network urls from ip'

Get a list of URLs hosted on the requested IP address

Type: generic
Read only: False

Accepts an IP address string and returns a list of URLs hosted on the requested IP address.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ip	required	IP address	string	ip
page	optional	SHA1 hash of page	string
page_size	optional	Number of elements in the response	numeric

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ip	string	ip
action_result.parameter.page	string
action_result.parameter.page_size	numeric
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'network files from ip'

Get a a list of hashes and classifications for files found on the requested IP address

Type: generic
Read only: False

Accepts an IP address string and returns a list of hashes and classifications for files found on the requested IP address.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ip	required	IP address	string	ip
page	optional	SHA1 hash of page	string
page_size	optional	Number of elements in the response	numeric

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ip	string	ip
action_result.parameter.page	string
action_result.parameter.page_size	numeric
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'advanced search'

Search for samples using multi-part search criteria

Type: generic
Read only: True

Search for samples available on the local A1000 instance and TitaniumCloud using the Advanced Search capabilities.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
query	required	Advanced Search query	string	search query
limit	optional	Maximum number of results	numeric
only_cloud_results	optional	Show only TitaniumCloud results, by default only local results are show	boolean

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.query	string	search query
action_result.parameter.limit	numeric
action_result.parameter.only_cloud_results	boolean
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'advanced search ticloud'

Search for samples available on the TitaniumCloud

Type: generic
Read only: False

All restricted words and characters must be escaped with double quotation marks. This action will work only if A1000 is set up with access to TiCloud.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
query	required	Advanced Search query	string	search query
start_search_date	required	The starting date for the search (later date)	string
end_search_date	required	The ending date for the search (earlier date)	string	date
sorting_order	optional	Ascending or descending	string
sorting_criteria	optional	Sort results on this column	string
limit	optional	Get at most search results, if page is set max value is 100	numeric
page	optional	Use pagination instead of aggregated getter, off by default, index starts at 1	numeric

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.query	string	search query
action_result.parameter.start_search_date	string
action_result.parameter.end_search_date	string	date
action_result.parameter.sorting_order	string
action_result.parameter.sorting_criteria	string
action_result.parameter.limit	numeric
action_result.parameter.page	numeric
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'advanced search local'

Search for samples available on the A1000 appliance

Type: generic
Read only: True

All restricted words and characters must be escaped with double quotation marks.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
query	required	Advanced Search query	string	search query
sorting_order	optional	Ascending or descending	string
sorting_criteria	optional	Sort results on this column	string
limit	optional	Get at most search results, if page is set max value is 100	numeric
page	optional	Use pagination instead of aggregated getter, off by default, index starts at 1	numeric

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.query	string	search query
action_result.parameter.sorting_order	string
action_result.parameter.sorting_criteria	string
action_result.parameter.limit	numeric
action_result.parameter.page	numeric
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'create dynamic analysis report'

Initiate the creation of dynamic analysis PDF report

Type: generic
Read only: False

Accepts a single hash string and and a report format and initiates the creation of PDF or HTML reports for samples that have gone through dynamic analysis in the ReversingLabs Cloud Sandbox.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'check dynamic analysis report status'

Get status of the report previously requested

Type: generic
Read only: False

Accepts a single hash string and report format parameters that should correspond to the parameters used in the request with create_dynamic_analysis_report method. The response includes an informative message about the status of the report previously requested.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'download dynamic analysis report'

Download previously requested dynamic analysis report in pdf

Type: generic
Read only: False

Accepts a single hash string and report format parameters that should correspond to the parameters used in the request with create_dynamic_analysis_report method.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'get summary report'

Get a summary report for hash

Type: generic
Read only: False

Get a summary report for hash.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5
retry	optional	If set to False there will only be one try at obtaining the analysis report	boolean
fields	optional	List of A1000 report 'fields' to query	string
include_network_threat_intelligence	optional	Include network threat intelligence in the summary report	boolean
skip_reanalysis	optional	Skip sample reanalysis when fetching the summary report	boolean

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.parameter.retry	boolean
action_result.parameter.fields	string
action_result.parameter.include_network_threat_intelligence	boolean
action_result.parameter.skip_reanalysis	boolean
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'get detailed report'

Get detailed analysis report

Type: generic
Read only: False

Get detailed analysis report for sample.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5
retry	optional	If set to False there will only be one try at obtaining the analysis report	boolean
fields	optional	List of A1000 report 'fields' to query	string
skip_reanalysis	optional	Skip sample reanalysis when fetching the summary report	boolean

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.parameter.retry	boolean
action_result.parameter.fields	string
action_result.parameter.skip_reanalysis	boolean
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'get classification'

Get classification for a sample

Type: generic
Read only: False

Get classification for one sample. The default value of local_only is False, which, if not changed, will send a request to TitaniumCloud to get the sample. The av_scanners parameter decides if the AV scanner results will be included in the classification report.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5
local_only	optional	Return only local samples without querying TitaniumCloud	boolean
av_scanners	optional	Return AV scanner results	boolean

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.parameter.local_only	boolean
action_result.parameter.av_scanners	boolean
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'get user tags'

List existing tags for the requested sample

Type: generic
Read only: True

List existing tags for the requested sample, if there are any.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'create user tags'

Add one or more user tags

Type: generic
Read only: False

Add one or more User Tags to the sample, regardless of whether the sample already has any tags.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5
tags	required	List of comma separated tags	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.parameter.tags	string
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'delete user tags'

Remove one or more user tags

Type: generic
Read only: False

Remove one or more User Tags from the requested sample.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5
tags	required	List of comma separated tags	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.parameter.tags	string
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'set sample classification'

Set the classification of a sample

Type: generic
Read only: False

This API allows the user to set the classification of a sample, either in TitaniumCloud or locally on the A1000.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash	string	hash sha1 sha256 md5
system	required	Where to set the classification	string
classification	required	Classification to set	string
risk_score	optional	Risk score to set for classification	numeric
threat_platform	optional	Threat platform to set, must be on the supported list	string
threat_type	optional	Threat type to set, must be on the supported list	string
threat_name	optional	Threat name to set, must be on the supported list	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.parameter.system	string
action_result.parameter.classification	string
action_result.parameter.risk_score	string
action_result.parameter.threat_platform	string
action_result.threat_type	string
action_result.threat_name	string
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'delete sample classification'

Delete the (user set) classification of a sample

Type: generic
Read only: False

This API allows the user to delete the classification of a sample, either in TitaniumCloud or locally on the A1000.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash string of a sample	string	hash sha1 sha256 md5
system	required	Where to delete the desired classification	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.parameter.system	string
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara get rulesets'

Get a list of YARA rulesets that are on the A1000

Type: generic
Read only: True

For every ruleset in the list, the output includes additional info such as: rule name, number of matches, last matched date, and more.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
type	optional	Owner type	string
status	optional	Status	string
source	optional	Source	string
page	optional	Page	numeric
page_size	optional	Page size	numeric

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.type	string
action_result.parameter.status	string
action_result.parameter.source	string
action_result.parameter.page	numeric
action_result.parameter.page_size	numeric
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara get ruleset text'

Get the full contents of the requested ruleset

Type: generic
Read only: True

Get the full contents of the requested ruleset in raw text. All rulesets can be retrieved.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ruleset_name	required	Ruleset Name	string	ruleset name

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ruleset_name	string	ruleset name
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara get matches'

Retrieve the list of YARA matches

Type: investigate
Read only: True

Retrieve the list of YARA matches (local & cloud) for requested ruleset. Names are case-sensitive.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ruleset_name	optional	Ruleset name	string	ruleset name
page	optional	Page	numeric
page_size	optional	Page size	numeric

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ruleset_name	string	ruleset name
action_result.parameter.page	numeric
action_result.parameter.page_size	numeric
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara create or update ruleset'

Creates a new YARA ruleset if it doesn't exist

Type: generic
Read only: False

Creates a new YARA ruleset if it doesn't exist. If it exists a new revision is created. TiCloud rules cannot be updated using this API.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ruleset_name	required	Ruleset name	string	ruleset name
ruleset_text	required	Text of the yara ruleset	string
publish	optional	Publish to C1000 in the same cluster	boolean
ticloud	optional	Sync with TiCloud	boolean

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ruleset_name	string	ruleset name
action_result.parameter.ruleset_text	string
action_result.parameter.publish	boolean
action_result.ticloud	boolean
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara delete ruleset'

Delete a specific YARA ruleset and its matches

Type: generic
Read only: False

Delete a specific YARA ruleset and its matches from the appliance.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ruleset_name	required	Ruleset name	string	ruleset name
publish	optional	Publish to C1000 in the same cluster	boolean

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ruleset_name	string	ruleset name
action_result.parameter.publish	boolean
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara enable or disable ruleset'

Enable or disable a ruleset on the appliance

Type: generic
Read only: False

Administrators can manage any ruleset while regular A1000 users can only manage their own.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ruleset_name	required	Ruleset name	string	ruleset name
enabled	required	Enable or disable the ruleset	boolean
publish	optional	Publish to C1000 in the same cluster	boolean

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ruleset_name	string	ruleset name
action_result.parameter.enabled	string
action_result.parameter.publish	boolean
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara get synchronization time'

Get the current synchronization time

Type: generic
Read only: True

Provides information about the current synchronization status for TiCloud enabled rulesets.

Action Parameters

No parameters are required for this action

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara set ruleset synchronization time'

Modify the TiCloud sync time for TiCloud enabled rulesets

Type: generic
Read only: False

Modify the TiCloud sync time for TiCloud enabled rulesets. Time parameter must be a UTC timestamp .

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
time	required	Synchronization time	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.time	string
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara start or stop local retro scan'

Allow users to start or stop the Local Retro scan on the appliance

Type: generic
Read only: False

Allow users to start or stop the Local Retro scan on the appliance.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
operation	required	START or STOP	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.operation	string
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara manage cloud retro scan'

Allow users to start, stop or clear a Cloud Retro scan

Type: generic
Read only: False

Start/Stop or Clear a Cloud Retro scan for a specified ruleset on the A1000.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ruleset_name	required	Ruleset name	string	ruleset name
operation	required	START, STOP or CLEAR	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ruleset_name	string	ruleset name
action_result.parameter.operation	string
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara status retro scan local'

Allow users to check the status of a Local Retro scan

Type: generic
Read only: True

The response indicates the current state of Local Retro scan, time and date when the latest Local Retro scan was started and/or stopped, and a list of previous Local Retro scans with same details.

Action Parameters

No parameters are required for this action

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'yara status retro scan cloud'

Allow users to check the status of Cloud Retro scan for specified ruleset

Type: generic
Read only: True

The response indicates the current state of Cloud Retro, time and date when the latest Cloud Retro scan was started and/or stopped, and a list of previous Cloud Retro scans with the same details.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
ruleset_name	required	Ruleset name	string	ruleset name

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.ruleset_name	string	ruleset name
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'list containers for hash'

Get a list of containers from which the requested samples has been extracted

Type: investigate
Read only: True

Get a list of all top-level containers from which the requested samples have been extracted during analysis. If a requested hash doesn't have a container, it will not be included in the response.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hashes	required	Comma separated list of hashes	string	hash sha1 sha256 md5

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.hashes	string	hash sha1 sha256 md5
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'delete sample'

Delete the sample with the requested hash value

Type: generic
Read only: False

All related data, including extracted samples and metadata, will be deleted from the current A1000 instance.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash of a sample to be deleted	string	hash sha1 sha256 md5

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.param.hash	string	hash sha1 sha256 md5
action_result.data.*.results.code	numeric
action_result.data.*.results.message	string
action_result.data.*.results.detail.md5	string	hash md5
action_result.data.*.results.detail.sha1	string	hash sha1
action_result.data.*.results.detail.sha256	string	hash sha256
action_result.data.*.results.detail.sha512	string	hash sha512
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'download extracted files'

Download files extracted from local sample

Type: generic
Read only: True

The files are obtained through the unpacking process during sample analysis with the TitaniumCore static analysis engine.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hash	required	Hash of a sample to be deleted	string	hash sha1 sha256 md5

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.parameter.hash	string	hash sha1 sha256 md5
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'reanalyze local samples'

Submit a set of samples that already exist on the A1000

Type: investigate
Read only: False

Submit a set of samples that were previously uploaded to be analyzed with one or more supported services.

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
hashes	required	Comma separated list of hashes	string	hash sha1 sha256 md5
titanium_cloud	optional	Titanium Cloud analysis	boolean
titanium_core	optional	Titanium Core analysis	boolean
rl_cloud_sandbox	optional	RL cloud sandbox analysis	boolean
cuckoo_sandbox	optional	Cuckoo sandbox analysis	boolean
fireeye	optional	FireEye analysis	boolean
joe_sandbox	optional	Joe sandbox analysis	boolean
cape	optional	Cape analysis	boolean
rl_cloud_sandbox_platform	optional	Platform on which the samples should be detonated	string

Action Output

DATA PATH	TYPE	CONTAINS	EXAMPLE VALUES
action_result.hashes	string	hash sha1 sha256 md5
action_result.titanium_cloud	string
action_result.titanium_core	string
action_result.rl_cloud_sandbox	string
action_result.cuckoo_sandbox	string
action_result.fireeye	string
action_result.joe_sandbox	string
action_result.cape	string
action_result.rl_cloud_sandbox_platform	string
action_result.status	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric