Anyrun
Version: 1.0.3
Anyrun is a service that allows cybersecurity specialists to detect, analyze, and monitor cybersecurity threats. It is the interactive online malware analysis sandbox, where the user controls the flow of the analysis.
Connect Anyrun with LogicHub
- Navigate to Automations > Integrations.
- Search for Anyrun.
- Click Details, then the + icon. Enter the required information in the following fields.
- Label: Enter a connection name.
- Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
- Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
- Remote Agent: Run this integration using the LogicHub Remote Agent.
- API Key: API Key for Anyrun.
- After you've entered all the details, click Connect.
Actions for Anyrun
Get History
Retrieves History.
Input Field
Choose a connection that you have previously created.
Output
JSON containing the following items:
{
"error": null,
"has_error": false,
"result": [
{
"date": "2024-06-10T11:26:58.260Z",
"file": "https://content.any.run/tasks/32ebb433-317f-4031-b894-0b232d3bc144/download/files/7ce93048-e032-41fb-87de-c33d06d33b6e",
"hashes": {
"head_hash": "87d87041b3d247e041e1fba72da73b21",
"md5": "87d87041b3d247e041e1fba72da73b21",
"sha1": "cddf08a54ca3f47b1d01de1fbd7880d8b0eb5f82",
"sha256": "55c584ca6b7938d690b295a1a2c1ece1b939c9748873d5887dd9b6ce94615062",
"ssdeep": "96:SzRUG+DiR39S2aSA/KSod/5w8SfXeA1dLpIHihGJS9VKG+jCqRj7/PbkG+iqyRPo:5jU9RaXSDH+Xj9pIEGJrDBBHbkHKYatK"
},
"json": "https://api.any.run/report/32ebb433-317f-4031-b894-0b232d3bc144/summary/json",
"misp": "https://api.any.run/report/32ebb433-317f-4031-b894-0b232d3bc144/summary/misp",
"name": "cc1bedc5d32d4cc2abcbac870db4585f",
"pcap": "https://content.any.run/tasks/32ebb433-317f-4031-b894-0b232d3bc144/download/pcap",
"related": "https://app.any.run/tasks/32ebb433-317f-4031-b894-0b232d3bc144",
"tags": [
"spam"
],
"uuid": "32ebb433-317f-4031-b894-0b232d3bc144",
"verdict": "No threats detected"
}
]
}
Get Report Details
Retrieves details of a report.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Task Id | Jinja Templated text containing Task ID. | Required |
Output
JSON containing the following items:
"data":{
"error": False
"data":{
"analysis":{}
"environments":{}
"counters":{}
"processes": []
"malconf":[]
"network":{}
"modified":{}
"incidents":[]
"debugStrings":[]
"mitre":[]
"status":"done"
}
"has_error":false
}
Run new analysis
This method submits a file and runs new analysis.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
File Id | Jinja Templated text containing ID of file that needs to be analysed. | Required |
Parameters | Jinja Templated JSON containing the parameters and options to submit along with file for analysis. | Optional |
Output
JSON containing the following items:
{
"error":null,
"data":{
"taskid":"544c787b-6390-402c-85ef-c69efb69c4f2"
},
"has_error":false
}
Get TI Data
This method makes a TI lookup.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Data | Jinja Templated JSON containing the data to submit. query field is a must, Example { "query": "SuricataClass:"Potential Corporate Privacy Violation""} | Required |
Output
JSON containing the following items:
"data":{
"DestinationPort":[],
"DestinationIPGeo":[],
"DestinationIPASN":[],
"related_tasks":[],
"ThreatName":[],
"summary":{},
"related_incidents":[],
"DestinationIp":[],
"related_files":[],
"related_dns":[],
"related_urls":[],
"source_tasks":[],
"related_synchronization_objects":[]
}
Release Notes
v1.0.3
- Initial Release
Updated 3 months ago