feat(intezer): new Intezer enrichment integration

9 commands: analyze by file/hash/URL, analysis result, IOCs, metadata and sub-analyses. API-key (token-exchange) auth, stdlib-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-11 22:58:15 +02:00
parent b8afff7678
commit 1bdc71abee
10 changed files with 579 additions and 0 deletions
@@ -0,0 +1,96 @@
+id: intezer
+name: Intezer
+version: 1.0.0
+description: "Intezer Analyze (API v2) — genetic malware analysis: analyze files (base64), hashes and URLs, retrieve analysis verdicts, IOCs, metadata and sub-analyses. API-key authentication (exchanged for a short-lived access token); stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: analyze by file/hash/URL, analysis result, IOCs, metadata and sub-analyses."
+category: enrichment
+
+config_schema:
+  properties:
+    api_key:
+      type: string
+      description: "Intezer API key (from your Intezer account)"
+      x-soar-sensitive: true
+  required:
+    - api_key
+
+commands:
+  - id: analyze_by_hash
+    name: intezer-analyze-by-hash
+    description: "Submit a file hash (SHA256, SHA1 or MD5) for analysis. Returns an analysis_id; poll with intezer-get-file-analysis."
+    inputs_schema:
+      properties:
+        hash: { type: string, description: "File hash" }
+      required: [hash]
+    outputs_schema: { properties: {} }
+  - id: analyze_by_file
+    name: intezer-analyze-by-file
+    description: "Submit a file (base64) for analysis. Returns an analysis_id."
+    inputs_schema:
+      properties:
+        file_name: { type: string, description: "File name" }
+        content_base64: { type: string, description: "File content, base64-encoded" }
+      required: [file_name, content_base64]
+    outputs_schema: { properties: {} }
+  - id: analyze_url
+    name: intezer-analyze-url
+    description: "Submit a URL for analysis. Returns an analysis_id (use intezer-get-url-analysis)."
+    inputs_schema:
+      properties:
+        url: { type: string, description: "URL to analyze" }
+      required: [url]
+    outputs_schema: { properties: {} }
+  - id: get_file_analysis
+    name: intezer-get-file-analysis
+    description: "Get the result/verdict of a file analysis by ID."
+    risk: read
+    inputs_schema:
+      properties:
+        analysis_id: { type: string, description: "Analysis ID" }
+      required: [analysis_id]
+    outputs_schema: { properties: {} }
+  - id: get_url_analysis
+    name: intezer-get-url-analysis
+    description: "Get the result/verdict of a URL analysis by ID."
+    risk: read
+    inputs_schema:
+      properties:
+        analysis_id: { type: string, description: "Analysis ID" }
+      required: [analysis_id]
+    outputs_schema: { properties: {} }
+  - id: get_analysis_iocs
+    name: intezer-get-analysis-iocs
+    description: "Get the IOCs extracted from a file analysis."
+    risk: read
+    inputs_schema:
+      properties:
+        analysis_id: { type: string, description: "Analysis ID" }
+      required: [analysis_id]
+    outputs_schema: { properties: {} }
+  - id: get_analysis_metadata
+    name: intezer-get-analysis-metadata
+    description: "Get the metadata of a file analysis."
+    risk: read
+    inputs_schema:
+      properties:
+        analysis_id: { type: string, description: "Analysis ID" }
+      required: [analysis_id]
+    outputs_schema: { properties: {} }
+  - id: get_sub_analyses
+    name: intezer-get-sub-analyses
+    description: "List the sub-analyses of a file analysis (per-component genetic breakdown)."
+    risk: read
+    inputs_schema:
+      properties:
+        analysis_id: { type: string, description: "Analysis ID" }
+      required: [analysis_id]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: intezer-test-connection
+    description: "Verify the API key by obtaining an access token (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }