Enricher - HybridAnalysis

Requirements

Users need an API key. Sign up and subscribe to the service to obtain the required credentials to access the API endpoint exposing the service.

Configure the enricher parameters

1. Edit the enricher.

2. From the Observable types drop-down menu, select one or more observable types you want to enrich with data retrieved through the HybridAnalysis enricher.

3. The API URL field is automatically filled in with the default domain for the endpoint.
   You can add a proxy or set up ports according to your needs.
   Default value: https://www.hybrid-analysis.com/api/v2.

4. In the API key field, enter the API key associated with your API user profile, so that you can log in and consume the API service.

5. The SSL verification checkbox is automatically selected.

6. In the Path to SSL certificate, you can enter the path to your PEM file.
   It is also possible to leave the field blank.

7. In the Indicator half-life field, enter a value between 0 and 100.
   You can specify the half-life for indicator entities created with the HybridAnalysis Enricher.
   Default value: 30.

8. In the Indicator confidence threshold (low) field, enter a value between 0 and 100.
   Entities with a higher HybridAnalysis risk score than the value defined here are flagged as Indicator with low confidence .
   After completing the analysis, enriched entities with a higher risk score than the low indicator threshold and lower than the medium and high indicator thresholds, are flagged as Indicator with low confidence.
   Default value: 0.

9. In the Indicator confidence threshold (medium) field, enter a value between 0 and 100.
   Entities with a higher HybridAnalysis risk score than the value defined here are flagged as Indicator with medium confidence .
   After completing the analysis, enriched entities with a higher risk score than the medium indicator threshold and lower than the high indicator thresholds, are flagged as Indicator with medium confidence.
   Default value: 70.

10. In the Indicator confidence threshold (high) field, enter a value between 0 and 100.
    Entities with a higher HybridAnalysis risk score than the value defined here are flagged as Indicator with high confidence .
    After completing the analysis, enriched entities with a higher risk score than the high indicator thresholds, are flagged as Indicator with high confidence.
    Default value: 70.

11. In the Malware confidence threshold (low) field, enter a value between 0 and 100.
    Entities with a higher HybridAnalysis risk score than the value defined here are flagged as Malware with low confidence .
    After completing the analysis, enriched entities with a higher risk score than the low malware threshold and lower than the medium and high malware thresholds, are flagged as Malware with low confidence.
    Default value: 0.

12. In the Malware confidence threshold (medium) field, enter a value between 0 and 100.
    Entities with a higher HybridAnalysis risk score than the value defined here are flagged as Malware with medium confidence .
    After completing the analysis, enriched entities with a higher risk score than the medium malware threshold and lower than the high malware thresholds, are flagged as Malware with medium confidence.
    Default value: 70.

13. In the Malware confidence threshold (high) field, enter a value between 0 and 100.
    Entities with a higher HybridAnalysis risk score than the value defined here are flagged as Malware with high confidence .
    After completing the analysis, enriched entities with a higher risk score than the high malware thresholds, are flagged as Malware with high confidence.
    Default value: 70.

14. The checkboxes Ingest mitre attacks with verdict value "informative"/"suspicious"/"malicious" are optional, and can be selected depending on your needs.

15. To store your changes, click Save; to discard them, click Cancel.

Additional information

Confidence mapping:

See also

• About enrichers

• Configure enrichers

• Enable and disable enrichers

• Run enrichers

• About enrichment rules

• List of enrichers