Skip to content

Commit

Permalink
Merge pull request #4 from splunk-soar-connectors/next
Browse files Browse the repository at this point in the history
Merging next to main for release 1.1.0
  • Loading branch information
mishalp-crest authored Jul 6, 2023
2 parents d5e67aa + af14cec commit 78598f4
Show file tree
Hide file tree
Showing 7 changed files with 52 additions and 53 deletions.
52 changes: 26 additions & 26 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
[comment]: # "Auto-generated SOAR connector documentation"
# OPSWAT Filescan
# OPSWAT Filescan Sandbox

Publisher: OPSWAT
Connector Version: 1.0.1
Connector Version: 1.1.0
Product Vendor: OPSWAT
Product Name: Filescan
Product Name: Filescan Sandbox
Product Version Supported (regex): ".\*"
Minimum Product Version: 6.0.0

OPSWAT Filescan (Sandbox) is a unique adaptive threat analysis technology, enabling zero-day malware detection and comprehensive Indicator of Compromise (IOC) extraction
OPSWAT Filescan Sandbox is a unique adaptive threat analysis technology, enabling zero-day malware detection and comprehensive Indicator of Compromise (IOC) extraction

[comment]: # " File: README.md"
[comment]: # " Copyright (c) OPSWAT, 2023"
Expand All @@ -21,14 +21,14 @@ OPSWAT Filescan (Sandbox) is a unique adaptive threat analysis technology, enabl
[comment]: # "either express or implied. See the License for the specific language governing permissions"
[comment]: # "and limitations under the License."
[comment]: # ""
# OPSWAT Filescan App
# OPSWAT Filescan Sandbox App

OPSWAT Filescan (Sandbox) is a unique adaptive threat analysis technology, enabling zero-day malware
OPSWAT Filescan Sandbox is a unique adaptive threat analysis technology, enabling zero-day malware
detection and comprehensive Indicator of Compromise (IOC) extraction.

## What does this App do?

This app includes the OPSWAT Filescan basic integration that does the following:
This app includes the OPSWAT Filescan Sandbox basic integration that does the following:

**Detonate file**
Retrieve detonation analysis results for file
Expand All @@ -37,35 +37,35 @@ Retrieve detonation analysis results for file
Retrieve detonation analysis results for URL

**Search report**
Search for scan reports on Filescan using parameters specified in the 'query' field.
Search for scan reports on Filescan Sandbox using parameters specified in the 'query' field.

**File reputation**
Get the fast reputation for one given hash (returns the last 10 Filescan reports)
Get the fast reputation for one given hash (returns the last 10 Filescan Sandbox reports)

**IP/Domain/URL reputation**
Get the fast reputation for one given IOC. E.g.: IP, Domain or URL (returns the last 10 Filescan
reports)
Sandbox reports)

This app requires a correctly set up OPSWAT Filescan API key to use.
This app requires a correctly set up OPSWAT Filescan Sandbox API key to use.

## Port Information

The app uses HTTPS protocol if it uses the OPSWAT Filescan community server (default). You can
deviate from this if you want to use your own, on-prem OPSWAT Filescan server. Below are the default
ports used by Splunk SOAR.
The app uses HTTPS protocol if it uses the OPSWAT Filescan Sandbox community server (default). You
can deviate from this if you want to use your own, on-prem OPSWAT Filescan Sandbox server. Below are
the default ports used by Splunk SOAR.

|         Service Name | Transport Protocol | Port |
|----------------------|--------------------|------|
|         https | tcp | 443 |


### Configuration Variables
The below configuration variables are required for this Connector to operate. These variables are specified when configuring a Filescan asset in SOAR.
The below configuration variables are required for this Connector to operate. These variables are specified when configuring a Filescan Sandbox asset in SOAR.

VARIABLE | REQUIRED | TYPE | DESCRIPTION
-------- | -------- | ---- | -----------
**server_url** | required | string | Server URL (e.g. https://www.filescan.io)
**api_key** | required | password | The OPSWAT Filescan API Key to use for connection
**api_key** | required | password | The OPSWAT Filescan Sandbox API Key to use for connection
**poll_interval** | optional | numeric | Number of seconds to poll for a detonation result (Default: 5, Range: [1:30])
**timeout** | optional | numeric | Request Timeout (Default: 60 seconds, Range: [30:300])

Expand All @@ -74,10 +74,10 @@ VARIABLE | REQUIRED | TYPE | DESCRIPTION
[detonate url](#action-detonate-url) - Retrieve detonation analysis results for URL
[detonate file](#action-detonate-file) - Retrieve detonation analysis results for file
[search terms](#action-search-terms) - Search for scan reports on Filescan using parameters specified in the 'query' field
[file reputation](#action-file-reputation) - Get the reputation for one given hash (returns with the last 10 Filescan reports)
[ip reputation](#action-ip-reputation) - Get the reputation for one given IP address (returns with the last 10 Filescan reports)
[domain reputation](#action-domain-reputation) - Get the reputation for one given Domain address (returns with the last 10 Filescan reports)
[url reputation](#action-url-reputation) - Get the reputation for one given URL address (returns with the last 10 Filescan reports)
[file reputation](#action-file-reputation) - Get the reputation for one given hash (returns with the last 10 Filescan Sandbox reports)
[ip reputation](#action-ip-reputation) - Get the reputation for one given IP address (returns with the last 10 Filescan Sandbox reports)
[domain reputation](#action-domain-reputation) - Get the reputation for one given Domain address (returns with the last 10 Filescan Sandbox reports)
[url reputation](#action-url-reputation) - Get the reputation for one given URL address (returns with the last 10 Filescan Sandbox reports)

## action: 'test connectivity'
Validate the asset configuration for connectivity using supplied configuration
Expand All @@ -97,7 +97,7 @@ Retrieve detonation analysis results for URL
Type: **investigate**
Read only: **True**

Detonate url will send an URL to OPSWAT Filescan for analysis.
Detonate url will send an URL to OPSWAT Filescan Sandbox for analysis.

#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
Expand Down Expand Up @@ -229,7 +229,7 @@ Retrieve detonation analysis results for file
Type: **investigate**
Read only: **True**

Detonate url will send a file from Vault to OPSWAT Filescan for analysis.
Detonate url will send a file from Vault to OPSWAT Filescan Sandbox for analysis.

#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
Expand Down Expand Up @@ -416,7 +416,7 @@ summary.total_objects | numeric | | 2
summary.total_objects_successful | numeric | | 2

## action: 'file reputation'
Get the reputation for one given hash (returns with the last 10 Filescan reports)
Get the reputation for one given hash (returns with the last 10 Filescan Sandbox reports)

Type: **investigate**
Read only: **True**
Expand Down Expand Up @@ -449,7 +449,7 @@ summary.total_objects | numeric | | 2
summary.total_objects_successful | numeric | | 2

## action: 'ip reputation'
Get the reputation for one given IP address (returns with the last 10 Filescan reports)
Get the reputation for one given IP address (returns with the last 10 Filescan Sandbox reports)

Type: **investigate**
Read only: **True**
Expand Down Expand Up @@ -480,7 +480,7 @@ summary.total_objects | numeric | | 2
summary.total_objects_successful | numeric | | 2

## action: 'domain reputation'
Get the reputation for one given Domain address (returns with the last 10 Filescan reports)
Get the reputation for one given Domain address (returns with the last 10 Filescan Sandbox reports)

Type: **investigate**
Read only: **True**
Expand Down Expand Up @@ -511,7 +511,7 @@ summary.total_objects | numeric | | 2
summary.total_objects_successful | numeric | | 2

## action: 'url reputation'
Get the reputation for one given URL address (returns with the last 10 Filescan reports)
Get the reputation for one given URL address (returns with the last 10 Filescan Sandbox reports)

Type: **investigate**
Read only: **True**
Expand Down
2 changes: 1 addition & 1 deletion logo_opswatfilescan.svg
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading

0 comments on commit 78598f4

Please sign in to comment.