Skip to content

Commit 6b8432d

Browse files
content-botMislavReversingLabs
authored and
sdaniel6
committed
ReversingLabs A1000 v2.4.4 (#38112) (#38170)
* Update version to 2.4.4 * Update readme * Fix minor bugs in classification commands. * Add the contributors file * Add release notes Co-authored-by: Mislav Sever <[email protected]>
1 parent 5f4f5c7 commit 6b8432d

File tree

6 files changed

+50
-31
lines changed

6 files changed

+50
-31
lines changed

‎Packs/ReversingLabs_A1000/CONTRIBUTORS.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[
2+
"Mislav Sever"
3+
]

‎Packs/ReversingLabs_A1000/Integrations/ReversingLabsA1000v2/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5740,6 +5740,7 @@ Retrieve classification report for a sample
57405740
| --- | --- | --- |
57415741
| hash | The hash of a desired sample. | Required |
57425742
| localOnly | Return only local classification data for the sample, without falling back to querying TitaniumCloud. Default is False. | Optional |
5743+
| avScanners | Return AV scanner data from TitaniumCloud. | Optional |
57435744

57445745
#### Context Output
57455746

‎Packs/ReversingLabs_A1000/Integrations/ReversingLabsA1000v2/ReversingLabsA1000v2.py

Lines changed: 36 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
from ReversingLabs.SDK.a1000 import A1000
33

44

5-
VERSION = "v2.4.0"
5+
VERSION = "v2.4.4"
66
USER_AGENT = f"ReversingLabs XSOAR A1000 {VERSION}"
77
HOST = demisto.getParam('host')
88
TOKEN = demisto.getParam('token')
@@ -427,11 +427,12 @@ def get_classification(a1000):
427427
"""
428428
hash_value = demisto.getArg('hash')
429429
local_only = argToBoolean(demisto.getArg('localOnly'))
430+
av_scanners = argToBoolean(demisto.getArg('avScanners'))
430431

431432
try:
432433
response_json = a1000.get_classification_v3(hash_value,
433434
local_only=local_only,
434-
av_scanners=True).json()
435+
av_scanners=av_scanners).json()
435436
except Exception as e:
436437
return_error(str(e))
437438

@@ -1211,36 +1212,41 @@ def sample_classification_output(resp_json, action, av_scanners, sample_hash):
12111212
markdown = f"""## ReversingLabs A1000 sample classification - {action}\n"""
12121213

12131214
if action == "GET CLASSIFICATION":
1214-
markdown = markdown + f"""**Classification**: {resp_json.get("classification")}
1215-
**Risk score**: {resp_json.get("riskscore")}
1216-
**First seen**: {resp_json.get("first_seen")}
1217-
**Last seen**: {resp_json.get("last_seen")}
1218-
**Classification result**: {resp_json.get("classification_result")}
1219-
**Classification reason**: {resp_json.get("classification_reason")}
1220-
**SHA-1**: {resp_json.get("sha1")}
1221-
**SHA-256**: {resp_json.get("sha256")}
1222-
**MD5**: {resp_json.get("md5")}
1223-
"""
1224-
if av_scanners:
1225-
scanners_table = tableToMarkdown("Scanner results", resp_json.get("av_scanners"))
1226-
markdown = markdown + f"\n{scanners_table}"
1215+
if resp_json.get("classification"):
1216+
markdown = markdown + f"""**Classification**: {resp_json.get("classification")}
1217+
**Risk score**: {resp_json.get("riskscore")}
1218+
**First seen**: {resp_json.get("first_seen")}
1219+
**Last seen**: {resp_json.get("last_seen")}
1220+
**Classification result**: {resp_json.get("classification_result")}
1221+
**Classification reason**: {resp_json.get("classification_reason")}
1222+
**SHA-1**: {resp_json.get("sha1")}
1223+
**SHA-256**: {resp_json.get("sha256")}
1224+
**MD5**: {resp_json.get("md5")}
1225+
"""
1226+
if av_scanners:
1227+
scanners_table = tableToMarkdown("Scanner results", resp_json.get("av_scanners"))
1228+
markdown = markdown + f"\n{scanners_table}"
1229+
1230+
d_bot_score = classification_to_score(resp_json.get("classification").upper())
1231+
dbot_score = Common.DBotScore(
1232+
indicator=sample_hash,
1233+
indicator_type=DBotScoreType.FILE,
1234+
integration_name='ReversingLabs A1000 v2',
1235+
score=d_bot_score,
1236+
malicious_description=resp_json.get("classification_result"),
1237+
reliability=RELIABILITY
1238+
)
12271239

1228-
d_bot_score = classification_to_score(resp_json.get("classification").upper())
1229-
dbot_score = Common.DBotScore(
1230-
indicator=sample_hash,
1231-
indicator_type=DBotScoreType.FILE,
1232-
integration_name='ReversingLabs A1000 v2',
1233-
score=d_bot_score,
1234-
malicious_description=resp_json.get("classification_result"),
1235-
reliability=RELIABILITY
1236-
)
1240+
indicator = Common.File(
1241+
md5=resp_json.get("md5"),
1242+
sha1=resp_json.get("sha1"),
1243+
sha256=resp_json.get("sha256"),
1244+
dbot_score=dbot_score
1245+
)
12371246

1238-
indicator = Common.File(
1239-
md5=resp_json.get("md5"),
1240-
sha1=resp_json.get("sha1"),
1241-
sha256=resp_json.get("sha256"),
1242-
dbot_score=dbot_score
1243-
)
1247+
else:
1248+
markdown = markdown + "There were no results for the given hash."
1249+
indicator = None
12441250

12451251
command_results = CommandResults(
12461252
outputs_prefix="ReversingLabs",

‎Packs/ReversingLabs_A1000/Integrations/ReversingLabsA1000v2/ReversingLabsA1000v2.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -236,6 +236,9 @@ script:
236236
- defaultValue: 'False'
237237
description: Return only local classification data for the sample, without falling back to querying TitaniumCloud.
238238
name: localOnly
239+
- defaultValue: 'True'
240+
description: Return AV scanner data from TitaniumCloud.
241+
name: avScanners
239242
description: Retrieve classification report for a sample.
240243
name: reversinglabs-a1000-get-classification
241244
outputs:

‎Packs/ReversingLabs_A1000/ReleaseNotes/2_4_4.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
2+
#### Integrations
3+
4+
##### ReversingLabs A1000 v2
5+
6+
- Fixed minor bugs in the ***reversinglabs-a1000-get-classification*** and ***reversinglabs-a1000-sample-classification*** commands.

‎Packs/ReversingLabs_A1000/pack_metadata.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "ReversingLabs A1000",
33
"description": "Powerful threat detection and file analysis platform. Get detailed information on each file's status and threat capabilities.",
44
"support": "partner",
5-
"currentVersion": "2.4.3",
5+
"currentVersion": "2.4.4",
66
"author": "ReversingLabs",
77
"url": "https://www.reversinglabs.com/products/malware-threat-hunting-and-investigations",
88
"email": "[email protected]",

0 commit comments

Comments
 (0)