Skip to main content

Intezer v2

Use the Intezer v2 integration to detect and analyze malware, based on code reuse.

Configure Intezer v2 on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services .
  2. Search for Intezer v2.
  3. Click Add instance to create and configure a new integration instance.
    • Name : a textual name for the integration instance.
    • API Key
    • Use system proxy
    • Trust any certificate (not secure)
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. Check file reputation by hash: intezer-analyze-by-hash
  2. Check file reputation by latest report: intezer-get-latest-report
  3. Check file reputation by uploading a file: intezer-analyze-by-file
  4. Check analysis status and results: intezer-get-analysis-result

1. Check file reputation by hash

Checks file reputation of the given hash, supports SHA256, SHA1, and MD5.

Base Command

intezer-analyze-by-hash

Input
Argument Name Description Required
file_hash Hash of the file to query. Supports SHA256, MD5, and SHA1. Required

Context Output
Path Type Description
Intezer.Analysis.ID string Intezer analysis ID.
Intezer.Analysis.Status string Status of the analysis.
Intezer.Analysis.Type string Analysis type.

Command Example 
intezer-analyze-by-hash file_hash="8cbf90aeab2c93b2819fcfd6262b2cdb"
Context Example 
{
    "Intezer.Analysis": {
        "Status": "Created", 
        "type": "File", 
        "ID": "59e2f081-45f3-4822-bf45-407670dcb4d7"
    }
}
Human Readable Output

Analysis created successfully: 59e2f081-45f3-4822-bf45-407670dcb4d7

2. Check file reputation by latest report

Checks file reputation of the given hash, supports SHA256, SHA1, and MD5.

Base Command

intezer-get-latest-report

Input
Argument Name Description Required
file_hash Hash of the file to query. Supports SHA256, MD5, and SHA1. Required

Command Example 
intezer-get-latest-report file_hash="8cbf90aeab2c93b2819fcfd6262b2cdb"
Context Example 
{
    "DBotScore": {
        "Vendor": "Intezer", 
        "Indicator": "fa5953e0c34a4bbf69ac31f3a1360024101c1232bb45cccaad3611b682c92387", 
        "Score": 0, 
        "Type": "hash"
    }, 
    "File": {
        "ExistsInIntezer": true, 
        "SHA256": "fa5953e0c34a4bbf69ac31f3a1360024101c1232bb45cccaad3611b682c92387", 
        "Metadata": {
            "analysis_id": "9e3acdc3-b7ea-412b-88ae-7103eebc9398", 
            "sub_verdict": "file_type_not_supported", 
            "analysis_url": "https://analyze.intezer.com/analyses/9e3acdc3-b7ea-412b-88ae-7103eebc9398", 
            "verdict": "not_supported", 
            "sha256": "fa5953e0c34a4bbf69ac31f3a1360024101c1232bb45cccaad3611b682c92387", 
            "is_private": true, 
            "analysis_time": "Wed, 19 Jun 2019 07:48:12 GMT"
        }
    }
}
Human Readable Output

3. Check file reputation by uploading it

Checks file reputation for an uploaded file. Maximum file size is 150 MB.

Base Command

intezer-analyze-by-file

Input
Argument Name Description Required
file_entry_id The entry ID of the file to upload. Required

Context Output
Path Type Description
Intezer.Analysis.ID string Intezer analysis ID.
Intezer.Analysis.Status string Status of the analysis.
Intezer.Analysis.Type string Analysis type.

Command Example 
intezer-analyze-by-file file_entry_id=1188@6
Context Example 
{
    "Intezer.Analysis": {
        "Status": "Created", 
        "type": "File", 
        "ID": "675515a1-62e9-4d55-880c-fd46a7963a56"
    }
}
Human Readable Output

Analysis created successfully: 675515a1-62e9-4d55-880c-fd46a7963a56

4. Check analysis status and results

Checks the analysis status and gets the analysis result, supports file and endpoint analysis.

Base Command

intezer-get-analysis-result

Input
Argument Name Description Required
analysis_id The analysis ID for which to get results. Optional
analysis_type The type of analysis. Optional
indicator_name Indicator to classify. Optional

Context Output
Path Type Description
File.SHA256 string SHA256 hash of the file.
File.Malicious.Vendor string For malicious files, the vendor that made the decision.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string Vendor used to calculate the score.
DBotScore.Score number The actual score.
File.Metadata Unknown Metadata returned from Intezer analysis (analysis id, analysis url, family, family type, sha256, verdict, sub_verdict). Metedata will only be returned for supported files.
Endpoint.Metadata Unknown Metadata returned from Intezer analysis (endpoint analysis id, endpoint analysis url, families, verdict, host_name).

Command Example 
intezer-get-analysis-result analysis_id="9e3acdc3-b7ea-412b-88ae-7103eebc9398"
Context Example 
{
    "DBotScore": {
        "Vendor": "Intezer", 
        "Indicator": "fa5953e0c34a4bbf69ac31f3a1360024101c1232bb45cccaad3611b682c92387", 
        "Score": 0, 
        "Type": "hash"
    }, 
    "Intezer.Analysis": {
        "Status": "Done", 
        "ID": "9e3acdc3-b7ea-412b-88ae-7103eebc9398"
    }, 
    "File": {
        "ExistsInIntezer": true, 
        "SHA256": "fa5953e0c34a4bbf69ac31f3a1360024101c1232bb45cccaad3611b682c92387", 
        "Metadata": {
            "analysis_id": "9e3acdc3-b7ea-412b-88ae-7103eebc9398", 
            "sub_verdict": "file_type_not_supported", 
            "analysis_url": "https://analyze.intezer.com/analyses/9e3acdc3-b7ea-412b-88ae-7103eebc9398", 
            "verdict": "not_supported", 
            "sha256": "fa5953e0c34a4bbf69ac31f3a1360024101c1232bb45cccaad3611b682c92387", 
            "is_private": true, 
            "analysis_time": "Wed, 19 Jun 2019 07:48:12 GMT"
        }
    }
}
Human Readable Output

Intezer File analysis result

SHA256: fa5953e0c34a4bbf69ac31f3a1360024101c1232bb45cccaad3611b682c92387
Verdict: not_supported (file_type_not_supported)
Analysis Link

Edit this page
Report an Issue