feat(anyrun): new ANY.RUN sandbox integration

7 commands: file/URL detonation, report + verdict retrieval, analysis history, user limits, delete task. API-key auth, stdlib-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-11 22:48:50 +02:00
parent 239cc70672
commit b8afff7678
8 changed files with 465 additions and 0 deletions
@@ -0,0 +1,83 @@
+id: anyrun
+name: ANY.RUN
+version: 1.0.0
+description: "ANY.RUN (API v1) — interactive malware sandbox: detonate files and URLs on Windows/Linux, poll the analysis report and verdict, list analysis history, read user limits and delete tasks. API-key authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: file/URL detonation, report and verdict retrieval, analysis history, user limits and task deletion."
+category: enrichment
+
+# The API key is sent as 'Authorization: API-Key <key>' on every request.
+config_schema:
+  properties:
+    api_key:
+      type: string
+      description: "ANY.RUN API key"
+      x-soar-sensitive: true
+  required:
+    - api_key
+
+commands:
+  - id: detonate_file
+    name: anyrun-detonate-file
+    description: "Detonate a file (base64) in the ANY.RUN sandbox. Returns a task_id; poll with anyrun-get-report."
+    inputs_schema:
+      properties:
+        file_name: { type: string, description: "File name" }
+        content_base64: { type: string, description: "File content, base64-encoded" }
+        os: { type: string, description: "Sandbox OS: windows or linux (default windows)" }
+        env_bitness: { type: number, description: "Windows bitness: 32 or 64 (default 64)" }
+      required: [file_name, content_base64]
+    outputs_schema: { properties: {} }
+  - id: detonate_url
+    name: anyrun-detonate-url
+    description: "Detonate a URL in the ANY.RUN sandbox. Returns a task_id."
+    inputs_schema:
+      properties:
+        url: { type: string, description: "URL to detonate" }
+        os: { type: string, description: "Sandbox OS: windows or linux (default windows)" }
+        env_bitness: { type: number, description: "Windows bitness: 32 or 64 (default 64)" }
+      required: [url]
+    outputs_schema: { properties: {} }
+  - id: get_report
+    name: anyrun-get-report
+    description: "Get the full analysis report for a task (includes the verdict once the analysis completes)."
+    risk: read
+    inputs_schema:
+      properties:
+        task_id: { type: string, description: "Task ID (from a detonate command)" }
+      required: [task_id]
+    outputs_schema: { properties: {} }
+  - id: get_history
+    name: anyrun-get-history
+    description: "List the analysis history for the account."
+    risk: read
+    inputs_schema:
+      properties:
+        limit: { type: number, description: "Maximum records (default 25)" }
+        skip: { type: number, description: "Records to skip (pagination)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_user_limits
+    name: anyrun-get-user-limits
+    description: "Read the account's API usage limits."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+  - id: delete_task
+    name: anyrun-delete-task
+    description: "Delete an analysis task by ID."
+    inputs_schema:
+      properties:
+        task_id: { type: string, description: "Task ID" }
+      required: [task_id]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: anyrun-test-connection
+    description: "Verify the API key (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }