SpectraIntelligence-EnrichFileHash
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
This playbook will enrich a Microsoft Sentinel Incident with file hash information from ReversingLabs Spectra Intelligence (formerly TitaniumCloud). A comment will be added to the incident with details about the file.
| Attribute | Value |
|---|---|
| Type | Playbook |
| Solution | ReversingLabs |
| Source | View on GitHub |
Logic App Connectors
This playbook uses 2 Logic App connectors / built-in actions:
| Connector / Action | Type | Connections | Actions |
|---|---|---|---|
azuresentinel |
Managed | 1 | 2 |
reversinglabstitaniu |
Managed | 1 | 2 |
Action parameters (URLs, paths, function IDs)
azuresentinel (Managed)
| Action | Method | Endpoint | Other |
|---|---|---|---|
| Entities_-_Get_FileHashes | post | /entities/filehash |
— |
| Add_comment_to_incident_(V3) | post | /Incidents/Comment |
— |
reversinglabstitaniu (Managed)
| Action | Method | Endpoint | Other |
|---|---|---|---|
| Get_file_analysis_(single_query) | get | /api/databrowser/rldata/query/@{encodeURIComponent(items('For_each_-_File_hash_reputation')?['Algorithm'])}/@{encodeURIComponent(items('For_each_-_File_hash_reputation')?['Value'])} |
— |
| Get_file_reputation_(single_query) | get | /api/databrowser/malware_presence/query/@{encodeURIComponent(items('For_each_-_File_hash_reputation')?['Algorithm'])}/@{encodeURIComponent(items('For_each_-_File_hash_reputation')?['Value'])} |
— |
Additional Documentation
Author: Aaron Hoffmann (ReversingLabs)
Summary
This playbook enriches file hash entities with information from ReversingLabs Spectra Intelligence (formerly TitaniumCloud).
Prerequisites
You'll need the following:
- A ReversingLabs Spectra Intelligence username
- A ReversingLabs Spectra Intelligence password
Deployment instructions
- Deploy the playbook by clicking on "Deploy to Azure" button. This will take you to deploying an ARM Template wizard.
Post-deployment
a. Authorize connections (Perform this action if needed) Once deployment is complete, you will need to authorize each connection.
- Click the Microsoft Sentinel connection resource
- Click edit API connection
- Click Authorize
- Sign in
- Click Save
- Repeat steps for the ReversingLabs TitaniumCloud Connection (For authorizing the connection, a TitaniumCloud username and password needs to be provided)
Screenshots
References
- ReversingLabs content pack installation guide
- Video - How to install and configure the ReversingLabs content pack
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊