ReversingLabs A1000

ReversingLabs A1000 Malware Analysis Appliance integrates the ReversingLabs TitaniumCore automated static analysis technology and the TitaniumCloud File Reputation Service database. The REST Services APIs enable analysts to input samples, access unpacked files and view extracted Proactive Threat Indicators. The platform performs an in-depth static analysis of a comprehensive array of file types including Windows, Linux, Mac OS, iOS, Android, email attachments, documents and firmware.

This connector is available in the following products and regions:

Service	Class	Regions
Logic Apps	Standard	All Logic Apps regions except the following: - Azure Government regions - Azure China regions - US Department of Defense (DoD)

Contact
Name	ReversingLabs support
URL	https://support.reversinglabs.com/
Email	support@reversinglabs.com

Connector Metadata
Publisher	ReversingLabs
Website	https://www.reversinglabs.com/
Privacy policy	https://www.reversinglabs.com/privacy-policy
Categories	Security

This connector allows users of the ReversingLabs A1000 to access the API functions of the appliance. Actions such as submitting a file for analysis, retrieving results, and checking the reputation of a file are supported. Refer to the A1000 user guide in the appliance's web interface for further information about the API.

Prerequisites

In order to use this connector one must have an A1000 that is reachable from the cloud, the URL of the A1000 appliance, and an A1000 API key.

How to get credentials

Authentication to the A1000 API is performed with an API key. This key can be configured by users with administrative access to the appliance's web interface. To create an API key refer to the help file in the A1000's web GUI interface.

Get started with your connector

To get started with the A1000 connector, begin by configuring a new connection. The connector configuration will ask for a connection name and an API key value. Ensure you enter the API key value in the format Token <apikey>, where <apikey> is the actual API token.
After configuring the API connection, select from the available actions and provide the required inputs.

Common errors and remedies

403 error: "Authentication credentials were not provided."
- Ensure that you have configured the API connection using the format mentioned above.

FAQ

Q1. How long should I wait for the results of a file I submitted for analysis?
- A1. Processing time will vary depending upon the load on the appliance, size, and complexity of the file. It is best practice to create a loop that sleeps and checks the status.
Q2. Where can I find documentation on the A1000 API or any other A1000 topic?
- A2. Complete product documentation is available in the A1000 interface. After logging into the web interface click the Help menu in the upper right corner. interface. After logging into the web interface click the Help menu in the upper right corner.

Creating a connection

The connector supports the following authentication types:


Default	Parameters for creating connection.	All regions	Not shareable

Default

Applicable: All regions

Parameters for creating connection.

This is not shareable connection. If the power app is shared with another user, another user will be prompted to create new connection explicitly.

Name	Type	Description	Required
Token	securestring	Your A1000 token	True
A1000 host URL	string	A1000 host URL (Example: https://a1000.reversinglabs.com). If not specified, host URL will default to https://a1000.reversinglabs.com.

Throttling Limits

Name	Calls	Renewal Period
API calls per connection	100	60 seconds

Actions

Check PDF report creation status	Check the creation status of a requested PDF report.
Check YARA Retro status on the appliance	Check the status of Local Retro on the A1000 appliance.
Create or update a YARA ruleset	Creates a new YARA ruleset if it doesn’t exist. If a ruleset with the specified name already exists, a new revision (update) of the ruleset is created.
Create PDF report	Create a PDF sample analysis report.
Create User Tags for a sample	Adds one or more User Tags to the requested sample, regardless of whether the sample already has any tags.
Delete a sample	Delete a sample from A1000.
Delete a YARA ruleset	Delete the specified YARA ruleset and its matches from the appliance.
Delete classification for a sample	Delete the classification of a sample.
Delete User Tags from a sample	Removes one or more User Tags from the requested sample.
Download files extracted from a local sample	Download files extracted from the requested sample to the local storage.
Download PDF Report	Download the generated PDF analysis Report.
Enable or disable a YARA ruleset	Enables a previously disabled YARA ruleset, or disables a currently enabled YARA ruleset.
Get YARA ruleset synchronization time	Information about the current synchronization status for TitaniumCloud-enabled rulesets.
List containers for every requested hash	Get a list of all top-level containers from which the requested sample has been extracted during analysis.
Manage YARA Cloud Retro scans	Start and stop a Cloud Retro scan for a specified ruleset on the A1000 appliance, as well as to clear all Cloud Retro results for the ruleset.
Perform advanced search	Search for samples available on the local A1000 instance and TitaniumCloud using the Advanced Search capabilities.
Reanalyze multiple samples	Reanalyze multiple samples with selected services.
Retrieve a list of files from the IP address	Provides a list of hashes and classifications for files found on the submitted IP address.
Retrieve a list of YARA rulesets	Retrieve a list of YARA rulesets that are on the A1000 appliance.
Retrieve classification for a sample	Retrieve classification status for a sample.
Retrieve information for a domain	Returns network threat intelligence about the provided domain.
Retrieve information for a URL	Returns network threat intelligence about the provided URL.
Retrieve information for an IP address	Returns network threat intelligence about the provided IP address.
Retrieve IP address resolutions	Provides a list of IP-to-domain mappings.
Retrieve processing status for files	Check status of submitted files.
Retrieve processing status for URL-s	Check status of submitted URL-s.
Retrieve summary analysis report	Retrieve a summary analysis report for local samples.
Retrieve the contents of a YARA ruleset	Retrieve the full contents of the requested ruleset in raw text/plain format.
Retrieve the detailed analysis report	Retrieve a detailed analysis report for local samples.
Retrieve the dynamic analysis report	Create and download a PDF or HTLM report for samples that have gone through dynamic analysis in the ReversingLabs Cloud Sandbox.
Retrieve the static analysis report	Retrieve TitaniumCore analysis results for a local sample.
Retrieve URL-s hosted on the IP address	Returns a list of URLs hosted on the submitted IP address.
Retrieve User Tags for a sample	Lists existing tags for the requested sample, if there are any.
Retrieve YARA matches for specified rulesets	Retrieve the list of YARA matches (both local and cloud) for requested rulesets.
Set classification for a sample	Set the classification of a sample.
Set YARA ruleset synchronization time	Modify the TitaniumCloud synchronization time for TitaniumCloud-enabled YARA rulesets.
Start or stop a YARA Local Retro scan	Allows users to initiate the Local Retro scan on the A1000 appliance, and stop the Local Retro scan that is in progress on the appliance.
Submit a sample for analysis	Submit a sample for analysis from a local directory or from a URL.
YARA Cloud Retro status	Check the status of Cloud Retro for the specified YARA ruleset.

Check PDF report creation status

Operation ID:: Check-pdf-report-status

Check the creation status of a requested PDF report.

Parameters

Name	Key	Required	Type	Description
Hash	hash	True	string	Hash string

Check YARA Retro status on the appliance

Operation ID:: Check-YARA-Retro-status-on-appliance

Check the status of Local Retro on the A1000 appliance.

Create or update a YARA ruleset

Operation ID:: Create-update-YARA-ruleset

Creates a new YARA ruleset if it doesn’t exist. If a ruleset with the specified name already exists, a new revision (update) of the ruleset is created.

Parameters

Name	Key	Required	Type	Description
Name	name	True	string	Name of the ruleset to create or update
Content	content	True	string	Content of the ruleset to create or update.
Publish	publish		boolean	Determines whether the ruleset should be synchronized to other appliances in the same C1000 cluster.
TiCloud	ticloud		boolean	Determines whether the ruleset should be synchronized with TitaniumCloud or not.

Create PDF report

Operation ID:: Create-pdf-report

Create a PDF sample analysis report.

Parameters

Name	Key	Required	Type	Description
Hash	hash	True	string	Hash string

Create User Tags for a sample

Operation ID:: Create-User-Tags-for-sample

Adds one or more User Tags to the requested sample, regardless of whether the sample already has any tags.

Parameters

Name	Key	Required	Type	Description
Sample hash	sample_hash	True	string	Hash of the sample to which the user wants to add one or more User Tags.
tags	tags	True	array of string	tags

Delete a sample

Operation ID:: Delete-sample

Delete a sample from A1000.

Parameters

Name	Key	Required	Type	Description
Hash value	hash_value	True	string	Hash of the sample that should be deleted from the appliance.

Delete a YARA ruleset

Operation ID:: Delete-YARA-ruleset

Delete the specified YARA ruleset and its matches from the appliance.

Parameters

Name	Key	Required	Type	Description
Name	name	True	string	Name of the ruleset to delete.
Publish	publish		boolean	Determines whether the ruleset deletion should be synchronized to other appliances in the same C1000 cluster.

Delete classification for a sample

Operation ID:: Delete-classification-for-sample

Delete the classification of a sample.

Parameters

Name	Key	Required	Type	Description
Hash value	hash_value	True	string	Hash value.
System	system	True	string	'local' or 'ticloud'.

Delete User Tags from a sample

Operation ID:: Delete-User-Tags-from-sample

Removes one or more User Tags from the requested sample.

Parameters

Name	Key	Required	Type	Description
Sample hash	sample_hash	True	string	Hash of the sample from which the user wants to remove one or more User Tags.
tags	tags	True	array of string	tags

Download files extracted from a local sample

Operation ID:: Download-files-extracted-from-local-sample

Download files extracted from the requested sample to the local storage.

Parameters

Name	Key	Required	Type	Description
Hash value	hash_value	True	string	Hash of the sample for which the extracted files should be downloaded.

Download PDF Report

Operation ID:: Download-pdf-report

Download the generated PDF analysis Report.

Parameters

Name	Key	Required	Type	Description
Hash	hash	True	string	Hash string

Enable or disable a YARA ruleset

Operation ID:: Enable-disable-YARA-ruleset

Enables a previously disabled YARA ruleset, or disables a currently enabled YARA ruleset.

Parameters

Name	Key	Required	Type	Description
enable or disable	enable \| disable	True	string	Whether to enable or disable the specified ruleset. Options are: enable, disable
Name	name	True	string	Name of the ruleset to enable/disable.
Publish	publish		boolean	Determines whether the ruleset action should be synchronized to other appliances in the same C1000 cluster.

Get YARA ruleset synchronization time

Operation ID:: Get-YARA-ruleset-synchronization-time

Information about the current synchronization status for TitaniumCloud-enabled rulesets.

List containers for every requested hash

Operation ID:: List-containers-for-every-hash

Get a list of all top-level containers from which the requested sample has been extracted during analysis.

Parameters

Name	Key	Required	Type	Description
Hash values	hash_values	True	array	A list of one or more hash values for which to retrieve the top-level container hashes.

Manage YARA Cloud Retro scans

Operation ID:: Manage-YARA-Cloud-Retro-scans

Start and stop a Cloud Retro scan for a specified ruleset on the A1000 appliance, as well as to clear all Cloud Retro results for the ruleset.

Parameters

Name	Key	Required	Type	Description
Ruleset name	ruleset_name	True	string	Name of the YARA ruleset that the Cloud Retro scan should be run on.
Operation	operation	True	string	Name of the operation to perform for YARA Cloud Retro scan. Accepted values: START, STOP, CLEAR

Perform advanced search

Operation ID:: Perform-advanced-search

Search for samples available on the local A1000 instance and TitaniumCloud using the Advanced Search capabilities.

Parameters

Name	Key	Type	Description
query	query	string	query
page	page	integer	Page number.
records_per_page	records_per_page	integer	records_per_page
sort	sort	string	Sorting criteria.

Reanalyze multiple samples

Operation ID:: Reanalyze-multiple-samples

Reanalyze multiple samples with selected services.

Parameters

Name	Key	Required	Type	Description
Analysis	analysis	True	string	Types of analysis that the requested sample(s) should be queued for. If providing multiple values, they should be comma-separated. Supported values: assemblyline, cloud, core, cape, cisco_secure_malware_analytics, cuckoo, fireeye, joe, rl_dynamic_analysis, vmray_tcbase
Hash value	hash_value	True	array	Hashes of the sample(s) that should be reanalyzed.
RL cloud sandbox platform	rl_cloud_sandbox_platform		string	The platform to be used when executing the sample on the RL Cloud Sandbox. Supported values: windows7, windows10, windows11, macos_11, ubuntu_20

Retrieve a list of files from the IP address

Operation ID:: Retrieve-files-from-ip

Provides a list of hashes and classifications for files found on the submitted IP address.

Parameters

Name	Key	Required	Type	Description
Ip	ip	True	string	IP address string
Page	page		string	SHA1 hash of the next page of results,
Page Size	page_size		integer	Results per page
Extended	extended		boolean	Include additional information on downloaded files.
Classification	classification		string	Return only samples with this classification

Retrieve a list of YARA rulesets

Operation ID:: Retrieve-list-of-YARA-rulesets

Retrieve a list of YARA rulesets that are on the A1000 appliance.

Parameters

Name	Key	Type	Description
Type	type	string	Only the rulesets matching the specified type are returned in the response. Supported values: my, user, system, all
Status	status	string	Only the rulesets matching the specified status are returned in the response. Supported values: all, error, active, disabled, pending, invalid, capped
Source	source	string	Only the rulesets matching the specified source are returned in the response. Supported values: all, local, cloud
Page	page	integer	Page marker. This parameter cannot be used without page_size.
Page size	page_size	integer	Number of results per page. This parameter cannot be used without page

Retrieve classification for a sample

Operation ID:: Retrieve-classification-for-sample

Retrieve classification status for a sample.

Parameters

Name	Key	Required	Type	Description
Hash Value	hash_value	True	string	Hash string
Localonly	localonly		integer	If set to 1, the request will only look for local samples on the appliance.
AV Scanners	av_scanners		integer	Include AV scanners summary information in the response.

Retrieve information for a domain

Operation ID:: Retrieve-domain-intelligence

Returns network threat intelligence about the provided domain.

Parameters

Name	Key	Required	Type	Description
Domain	domain	True	string	Domain string

Retrieve information for a URL

Operation ID:: Retrieve-URL-intelligence

Returns network threat intelligence about the provided URL.

Parameters

Name	Key	Required	Type	Description
Url	url	True	string	URL string

Retrieve information for an IP address

Operation ID:: Retrieve-ip-intelligence

Returns network threat intelligence about the provided IP address.

Parameters

Name	Key	Required	Type	Description
Ip	ip	True	string	IP address string

Retrieve IP address resolutions

Operation ID:: Retrieve-ip-to-domain-resolutions

Provides a list of IP-to-domain mappings.

Parameters

Name	Key	Required	Type	Description
Ip	ip	True	string	IP address string
Page	page		string	SHA1 hash of the next page of results.
Page Size	page_size		integer	Results per page

Retrieve processing status for files

Operation ID:: Retrieve-processing-status-files

Check status of submitted files.

Parameters

Name	Key	Required	Type	Description
Status	status		string	Filter hashes by their status. Consult the documentation for available values.
hash_values	hash_values	True	array of string	hash_values

Retrieve processing status for URL-s

Operation ID:: Retrieve-processing-status-urls

Check status of submitted URL-s.

Parameters

Name	Key	Required	Type	Description
Id	ID	True	integer	Identification number of the URL submission task.

Retrieve summary analysis report

Operation ID:: Retrieve-summary-report

Retrieve a summary analysis report for local samples.

Parameters

Name	Key	Required	Type	Description
hash_values	hash_values	True	array of string	hash_values
fields	fields		array of string	Consult the A1000 API documentation for the supported values in the 'fields' parameter. If the 'include_networkthreatintelligence' parameter is set to 'true', 'networkthreatintelligence' and 'domainthreatintelligence' have to be included in the 'fields' parameter.
include_networkthreatintelligence	include_networkthreatintelligence		string	Lowercase stringified boolean. Consult the A1000 API documentation for the supported values in the 'fields' parameter. If the 'include_networkthreatintelligence' parameter is set to 'true', 'networkthreatintelligence' and 'domainthreatintelligence' have to be included in the 'fields' parameter.
skip_reanalysis	skip_reanalysis		string	Lowercase stringified boolean.

Retrieve the contents of a YARA ruleset

Operation ID:: Retrieve-contents-of-YARA-ruleset

Retrieve the full contents of the requested ruleset in raw text/plain format.

Parameters

Name	Key	Required	Type	Description
Name	name	True	string	Name of the YARA ruleset to retrieve.

Retrieve the detailed analysis report

Operation ID:: Retrieve-detailed-report

Retrieve a detailed analysis report for local samples.

Parameters

Name	Key	Required	Type	Description
hash_values	hash_values	True	array of string	hash_values
fields	fields		array of string	Fields that will be returned in the report. Consult the A1000 API documentation for the supported values in the 'fields' parameter.
skip_reanalysis	skip_reanalysis		string	Lowercase stringified boolean

Retrieve the dynamic analysis report

Operation ID:: Retrieve-dynamic-analysis-report

Create and download a PDF or HTLM report for samples that have gone through dynamic analysis in the ReversingLabs Cloud Sandbox.

Parameters

Name	Key	Required	Type	Description
Hash Value	hash_value	True	string	The hash value must be a SHA-1 string.
Format	format	True	string	Analysis report format
Endpoint	endpoint	True	string	Select a task type.

Retrieve the static analysis report

Operation ID:: Retrieve-static-analysis-report

Retrieve TitaniumCore analysis results for a local sample.

Parameters

Name	Key	Required	Type	Description
Hash Value	hash_value	True	string	Hash string
Fields	fields		array	Fields that will be returned in the report. Consult the A1000 API documentation for the supported values in the 'fields' parameter.

Retrieve URL-s hosted on the IP address

Operation ID:: Retrieve-urls-from-ip

Returns a list of URLs hosted on the submitted IP address.

Parameters

Name	Key	Required	Type	Description
Ip	ip	True	string	IP address string
Page	page		string	SHA1 hash of the next page of results.
Page Size	page_size		integer	Results per page

Retrieve User Tags for a sample

Operation ID:: Retrieve-User-Tags-for-sample

Lists existing tags for the requested sample, if there are any.

Parameters

Name	Key	Required	Type	Description
Sample hash	sample_hash	True	string	Hash of the sample for which the user wants to list existing User Tags.

Retrieve YARA matches for specified rulesets

Operation ID:: Retrieve-YARA-matches-for-specified-rulesets

Retrieve the list of YARA matches (both local and cloud) for requested rulesets.

Parameters

Name	Key	Required	Type	Description
Name	name	True	string	Name of the YARA ruleset for which to retrieve matches.
Page	page		integer	Page marker. This parameter cannot be used without page_size.
Page size	page_size		integer	Number of results per page. This parameter cannot be used without page.

Set classification for a sample

Operation ID:: Set-classification-for-sample

Set the classification of a sample.

Parameters

Name	Key	Required	Type	Description
Hash value	hash_value	True	string	Hash value.
System	system	True	string	'local' or 'ticloud'.
Classification	classification	True	string	Classification of the sample - goodware, suspicious or malicious
Risk score	risk_score		string	If specified, it must be within range for the specified classification. If not specified, a default value is used: goodware: 0, suspicious: 6, malicious: 10
Threat platform	threat_platform		string	Define the threat platform.
Threat type	threat_type		string	Define the threat type.
Threat name	threat_name		string	Define the threat name.

Set YARA ruleset synchronization time

Operation ID:: Set-YARA-ruleset-synchronization-time

Modify the TitaniumCloud synchronization time for TitaniumCloud-enabled YARA rulesets.

Parameters

Name	Key	Required	Type	Description
Time	time	True	string	Date and time for YARA TitaniumCloud synchronization. Format should be UTC (YYYY-MM-DD hh:mm:ss) or Unix epoch time as the number of seconds since 1970-01-01

Start or stop a YARA Local Retro scan

Operation ID:: Start-stop-YARA-Retro-scan

Allows users to initiate the Local Retro scan on the A1000 appliance, and stop the Local Retro scan that is in progress on the appliance.

Parameters

Name	Key	Required	Type	Description
Operation	operation	True	string	Name of the operation to perform for YARA Local Retro scan. Accepted values: START, STOP

Submit a sample for analysis

Operation ID:: Submit-sample-for-analysis

Submit a sample for analysis from a local directory or from a URL.

Parameters

Name	Key	Type	Description
File	file	file	Submit a sample from a file. Required but mutually exclusive with the 'url' parameter.
Url	url	string	Submit a sample from a URL. Required but mutually exclusive with the 'file' parameter.
Filename	filename	string	Custom file name. Works only with the 'file' parameter.
Analysis	analysis	string	Select analysis type.
Tags	tags	string	Set custom tags. Works only with the 'file' parameter.
Comment	comment	string	Set a custom comment. Works only with the 'file' parameter.
Crawler	crawler	string	Select a crawler type. Works only with the 'url' parameter.
Archive Password	archive_password	string	Password for an archive.
RL Cloud Sandbox Platform	rl_cloud_sandbox_platform	string	Cloud sandbox platform.

YARA Cloud Retro status

Operation ID:: YARA-Cloud-Retro-status

Check the status of Cloud Retro for the specified YARA ruleset.

Parameters

Name	Key	Required	Type	Description
Ruleset name	ruleset_name	True	string	Name of the ruleset