feat(anyrun): new ANY.RUN sandbox integration

7 commands: file/URL detonation, report + verdict retrieval, analysis
history, user limits, delete task. API-key auth, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

integrations/anyrun/manifest.yaml

@@ -0,0 +1,83 @@
+id: anyrun
+name: ANY.RUN
+version: 1.0.0
+description: "ANY.RUN (API v1) — interactive malware sandbox: detonate files and URLs on Windows/Linux, poll the analysis report and verdict, list analysis history, read user limits and delete tasks. API-key authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: file/URL detonation, report and verdict retrieval, analysis history, user limits and task deletion."
+category: enrichment
+
+# The API key is sent as 'Authorization: API-Key <key>' on every request.
+config_schema:
+  properties:
+    api_key:
+      type: string
+      description: "ANY.RUN API key"
+      x-soar-sensitive: true
+  required:
+    - api_key
+
+commands:
+  - id: detonate_file
+    name: anyrun-detonate-file
+    description: "Detonate a file (base64) in the ANY.RUN sandbox. Returns a task_id; poll with anyrun-get-report."
+    inputs_schema:
+      properties:
+        file_name: { type: string, description: "File name" }
+        content_base64: { type: string, description: "File content, base64-encoded" }
+        os: { type: string, description: "Sandbox OS: windows or linux (default windows)" }
+        env_bitness: { type: number, description: "Windows bitness: 32 or 64 (default 64)" }
+      required: [file_name, content_base64]
+    outputs_schema: { properties: {} }
+  - id: detonate_url
+    name: anyrun-detonate-url
+    description: "Detonate a URL in the ANY.RUN sandbox. Returns a task_id."
+    inputs_schema:
+      properties:
+        url: { type: string, description: "URL to detonate" }
+        os: { type: string, description: "Sandbox OS: windows or linux (default windows)" }
+        env_bitness: { type: number, description: "Windows bitness: 32 or 64 (default 64)" }
+      required: [url]
+    outputs_schema: { properties: {} }
+  - id: get_report
+    name: anyrun-get-report
+    description: "Get the full analysis report for a task (includes the verdict once the analysis completes)."
+    risk: read
+    inputs_schema:
+      properties:
+        task_id: { type: string, description: "Task ID (from a detonate command)" }
+      required: [task_id]
+    outputs_schema: { properties: {} }
+  - id: get_history
+    name: anyrun-get-history
+    description: "List the analysis history for the account."
+    risk: read
+    inputs_schema:
+      properties:
+        limit: { type: number, description: "Maximum records (default 25)" }
+        skip: { type: number, description: "Records to skip (pagination)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_user_limits
+    name: anyrun-get-user-limits
+    description: "Read the account's API usage limits."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+  - id: delete_task
+    name: anyrun-delete-task
+    description: "Delete an analysis task by ID."
+    inputs_schema:
+      properties:
+        task_id: { type: string, description: "Task ID" }
+      required: [task_id]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: anyrun-test-connection
+    description: "Verify the API key (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }

integrations/anyrun/scripts/delete_task.py

@@ -0,0 +1,55 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://api.any.run/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _headers(extra=None):
+    h = {"Accept": "application/json", "Authorization": "API-Key " + str(_cfg().get("api_key") or "")}
+    if extra:
+        h.update(extra)
+    return h
+
+
+def request(method, path, params=None, form=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = None
+    headers = _headers()
+    if form is not None:
+        data = urllib.parse.urlencode({k: str(v) for k, v in form.items() if v not in (None, "")}).encode("utf-8")
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    task_id = inputs.get("task_id")
+    if not task_id:
+        raise Exception("task_id is required")
+
+    result = request("DELETE", "/analysis/" + q(task_id))
+    if not result:
+        result = {"ok": True, "task_id": task_id}
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/anyrun/scripts/detonate_file.py

@@ -0,0 +1,81 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+import uuid
+
+API = "https://api.any.run/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _headers(extra=None):
+    h = {"Accept": "application/json", "Authorization": "API-Key " + str(_cfg().get("api_key") or "")}
+    if extra:
+        h.update(extra)
+    return h
+
+
+def request(method, path, params=None, form=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = None
+    headers = _headers()
+    if form is not None:
+        data = urllib.parse.urlencode({k: str(v) for k, v in form.items() if v not in (None, "")}).encode("utf-8")
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def multipart(fields, file_field, file_name, file_bytes):
+    boundary = "----riposte" + uuid.uuid4().hex
+    parts = []
+    for name, value in fields.items():
+        parts.append(("--" + boundary + "\r\n"
+                      + 'Content-Disposition: form-data; name="' + name + '"\r\n\r\n'
+                      + str(value) + "\r\n").encode("utf-8"))
+    parts.append(("--" + boundary + "\r\n"
+                  + 'Content-Disposition: form-data; name="' + file_field + '"; filename="' + file_name + '"\r\n'
+                  + "Content-Type: application/octet-stream\r\n\r\n").encode("utf-8"))
+    parts.append(file_bytes)
+    parts.append(("\r\n--" + boundary + "--\r\n").encode("utf-8"))
+    return boundary, b"".join(parts)
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    file_name = inputs.get("file_name")
+    if not file_name:
+        raise Exception("file_name is required")
+    content_base64 = inputs.get("content_base64")
+    if not content_base64:
+        raise Exception("content_base64 is required")
+    env_os = inputs.get("os") or "windows"
+    env_bitness = inputs.get("env_bitness") or 64
+
+    fields = {"obj_type": "file", "env_os": env_os, "env_bitness": str(env_bitness)}
+    boundary, body = multipart(fields, "file", file_name, base64.b64decode(content_base64))
+    req = urllib.request.Request(
+        API + "/analysis",
+        data=body,
+        headers=_headers({"Content-Type": "multipart/form-data; boundary=" + boundary}),
+        method="POST",
+    )
+    with urllib.request.urlopen(req, timeout=120) as r:
+        raw = r.read()
+        result = json.loads(raw) if raw else {}
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/anyrun/scripts/detonate_url.py

@@ -0,0 +1,52 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://api.any.run/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _headers(extra=None):
+    h = {"Accept": "application/json", "Authorization": "API-Key " + str(_cfg().get("api_key") or "")}
+    if extra:
+        h.update(extra)
+    return h
+
+
+def request(method, path, params=None, form=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = None
+    headers = _headers()
+    if form is not None:
+        data = urllib.parse.urlencode({k: str(v) for k, v in form.items() if v not in (None, "")}).encode("utf-8")
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    url = inputs.get("url")
+    if not url:
+        raise Exception("url is required")
+    env_os = inputs.get("os") or "windows"
+    env_bitness = inputs.get("env_bitness") or 64
+
+    result = request("POST", "/analysis", form={"obj_type": "url", "obj_url": url, "env_os": env_os, "env_bitness": env_bitness})
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/anyrun/scripts/get_history.py

@@ -0,0 +1,49 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://api.any.run/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _headers(extra=None):
+    h = {"Accept": "application/json", "Authorization": "API-Key " + str(_cfg().get("api_key") or "")}
+    if extra:
+        h.update(extra)
+    return h
+
+
+def request(method, path, params=None, form=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = None
+    headers = _headers()
+    if form is not None:
+        data = urllib.parse.urlencode({k: str(v) for k, v in form.items() if v not in (None, "")}).encode("utf-8")
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    limit = inputs.get("limit") or 25
+    skip = inputs.get("skip")
+
+    result = request("GET", "/analysis", params={"limit": limit, "skip": skip})
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/anyrun/scripts/get_report.py

@@ -0,0 +1,53 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://api.any.run/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _headers(extra=None):
+    h = {"Accept": "application/json", "Authorization": "API-Key " + str(_cfg().get("api_key") or "")}
+    if extra:
+        h.update(extra)
+    return h
+
+
+def request(method, path, params=None, form=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = None
+    headers = _headers()
+    if form is not None:
+        data = urllib.parse.urlencode({k: str(v) for k, v in form.items() if v not in (None, "")}).encode("utf-8")
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    task_id = inputs.get("task_id")
+    if not task_id:
+        raise Exception("task_id is required")
+
+    result = request("GET", "/analysis/" + q(task_id))
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/anyrun/scripts/get_user_limits.py

@@ -0,0 +1,45 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://api.any.run/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _headers(extra=None):
+    h = {"Accept": "application/json", "Authorization": "API-Key " + str(_cfg().get("api_key") or "")}
+    if extra:
+        h.update(extra)
+    return h
+
+
+def request(method, path, params=None, form=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = None
+    headers = _headers()
+    if form is not None:
+        data = urllib.parse.urlencode({k: str(v) for k, v in form.items() if v not in (None, "")}).encode("utf-8")
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    result = request("GET", "/user/limits")
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/anyrun/scripts/test_connection.py

@@ -0,0 +1,47 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://api.any.run/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _headers(extra=None):
+    h = {"Accept": "application/json", "Authorization": "API-Key " + str(_cfg().get("api_key") or "")}
+    if extra:
+        h.update(extra)
+    return h
+
+
+def request(method, path, params=None, form=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = None
+    headers = _headers()
+    if form is not None:
+        data = urllib.parse.urlencode({k: str(v) for k, v in form.items() if v not in (None, "")}).encode("utf-8")
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    result = request("GET", "/user/limits")
+    if not isinstance(result, dict):
+        raise Exception("unexpected response")
+    print(json.dumps({"ok": True}))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/hybrid-analysis/manifest.yaml

@@ -0,0 +1,82 @@
+id: hybrid_analysis
+name: Hybrid Analysis
+version: 1.0.0
+description: "Hybrid Analysis / CrowdStrike Falcon Sandbox (API v2) — detonate files and URLs, poll analysis state, retrieve report summaries, search by hash, and list sandbox environments. API-key authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: file/URL submission, report summary and state, hash search and environment listing."
+category: enrichment
+
+# The API key is sent in the 'api-key' header; Hybrid Analysis also requires a
+# 'User-Agent: Falcon Sandbox' header (the scripts set it).
+config_schema:
+  properties:
+    api_key:
+      type: string
+      description: "Hybrid Analysis API key"
+      x-soar-sensitive: true
+  required:
+    - api_key
+
+commands:
+  - id: submit_file
+    name: hybrid-analysis-submit-file
+    description: "Submit a file (base64) for analysis in a sandbox environment. Returns a job/sha256; poll with hybrid-analysis-get-state."
+    inputs_schema:
+      properties:
+        file_name: { type: string, description: "File name" }
+        content_base64: { type: string, description: "File content, base64-encoded" }
+        environment_id: { type: number, description: "Sandbox environment ID (see hybrid-analysis-get-environments)" }
+      required: [file_name, content_base64, environment_id]
+    outputs_schema: { properties: {} }
+  - id: submit_url
+    name: hybrid-analysis-submit-url
+    description: "Submit a URL for analysis in a sandbox environment."
+    inputs_schema:
+      properties:
+        url: { type: string, description: "URL to detonate" }
+        environment_id: { type: number, description: "Sandbox environment ID" }
+      required: [url, environment_id]
+    outputs_schema: { properties: {} }
+  - id: get_result
+    name: hybrid-analysis-get-result
+    description: "Get the analysis report summary (verdict, threat score, signatures) by job/sha256 ID."
+    risk: read
+    inputs_schema:
+      properties:
+        job_id: { type: string, description: "Job ID or sha256:environment_id identifier" }
+      required: [job_id]
+    outputs_schema: { properties: {} }
+  - id: get_state
+    name: hybrid-analysis-get-state
+    description: "Get the current state of an analysis (IN_QUEUE, IN_PROGRESS, SUCCESS, ERROR)."
+    risk: read
+    inputs_schema:
+      properties:
+        job_id: { type: string, description: "Job ID or sha256:environment_id identifier" }
+      required: [job_id]
+    outputs_schema: { properties: {} }
+  - id: search_hash
+    name: hybrid-analysis-search-hash
+    description: "Look up existing analyses for a file hash (MD5, SHA1 or SHA256)."
+    risk: read
+    inputs_schema:
+      properties:
+        hash: { type: string, description: "File hash" }
+      required: [hash]
+    outputs_schema: { properties: {} }
+  - id: get_environments
+    name: hybrid-analysis-get-environments
+    description: "List the available sandbox environments and their IDs."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: hybrid-analysis-test-connection
+    description: "Verify the API key (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }

integrations/hybrid-analysis/scripts/get_environments.py

@@ -0,0 +1,46 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://www.hybrid-analysis.com/api/v2"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _headers(extra=None):
+    h = {"Accept": "application/json", "User-Agent": "Falcon Sandbox",
+         "api-key": str(_cfg().get("api_key") or "")}
+    if extra:
+        h.update(extra)
+    return h
+
+
+def request(method, path, params=None, form=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = None
+    headers = _headers()
+    if form is not None:
+        data = urllib.parse.urlencode({k: str(v) for k, v in form.items() if v not in (None, "")}).encode("utf-8")
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    result = request("GET", "/system/environments")
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/hybrid-analysis/scripts/get_result.py

@@ -0,0 +1,54 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://www.hybrid-analysis.com/api/v2"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _headers(extra=None):
+    h = {"Accept": "application/json", "User-Agent": "Falcon Sandbox",
+         "api-key": str(_cfg().get("api_key") or "")}
+    if extra:
+        h.update(extra)
+    return h
+
+
+def request(method, path, params=None, form=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = None
+    headers = _headers()
+    if form is not None:
+        data = urllib.parse.urlencode({k: str(v) for k, v in form.items() if v not in (None, "")}).encode("utf-8")
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    job_id = inputs.get("job_id")
+    if not job_id:
+        raise Exception("job_id is required")
+
+    result = request("GET", "/report/" + q(job_id) + "/summary")
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/hybrid-analysis/scripts/get_state.py

@@ -0,0 +1,54 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://www.hybrid-analysis.com/api/v2"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _headers(extra=None):
+    h = {"Accept": "application/json", "User-Agent": "Falcon Sandbox",
+         "api-key": str(_cfg().get("api_key") or "")}
+    if extra:
+        h.update(extra)
+    return h
+
+
+def request(method, path, params=None, form=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = None
+    headers = _headers()
+    if form is not None:
+        data = urllib.parse.urlencode({k: str(v) for k, v in form.items() if v not in (None, "")}).encode("utf-8")
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    job_id = inputs.get("job_id")
+    if not job_id:
+        raise Exception("job_id is required")
+
+    result = request("GET", "/report/" + q(job_id) + "/state")
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/hybrid-analysis/scripts/search_hash.py

@@ -0,0 +1,51 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://www.hybrid-analysis.com/api/v2"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _headers(extra=None):
+    h = {"Accept": "application/json", "User-Agent": "Falcon Sandbox",
+         "api-key": str(_cfg().get("api_key") or "")}
+    if extra:
+        h.update(extra)
+    return h
+
+
+def request(method, path, params=None, form=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = None
+    headers = _headers()
+    if form is not None:
+        data = urllib.parse.urlencode({k: str(v) for k, v in form.items() if v not in (None, "")}).encode("utf-8")
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    hash_ = inputs.get("hash")
+    if not hash_:
+        raise Exception("hash is required")
+
+    result = request("POST", "/search/hash", form={"hash": hash_})
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/hybrid-analysis/scripts/submit_file.py

@@ -0,0 +1,83 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+import uuid
+
+API = "https://www.hybrid-analysis.com/api/v2"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _headers(extra=None):
+    h = {"Accept": "application/json", "User-Agent": "Falcon Sandbox",
+         "api-key": str(_cfg().get("api_key") or "")}
+    if extra:
+        h.update(extra)
+    return h
+
+
+def request(method, path, params=None, form=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = None
+    headers = _headers()
+    if form is not None:
+        data = urllib.parse.urlencode({k: str(v) for k, v in form.items() if v not in (None, "")}).encode("utf-8")
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def multipart(fields, file_field, file_name, file_bytes):
+    boundary = "----riposte" + uuid.uuid4().hex
+    parts = []
+    for name, value in fields.items():
+        parts.append(("--" + boundary + "\r\n"
+                      + 'Content-Disposition: form-data; name="' + name + '"\r\n\r\n'
+                      + str(value) + "\r\n").encode("utf-8"))
+    parts.append(("--" + boundary + "\r\n"
+                  + 'Content-Disposition: form-data; name="' + file_field + '"; filename="' + file_name + '"\r\n'
+                  + "Content-Type: application/octet-stream\r\n\r\n").encode("utf-8"))
+    parts.append(file_bytes)
+    parts.append(("\r\n--" + boundary + "--\r\n").encode("utf-8"))
+    return boundary, b"".join(parts)
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    file_name = inputs.get("file_name")
+    if not file_name:
+        raise Exception("file_name is required")
+    content_base64 = inputs.get("content_base64")
+    if not content_base64:
+        raise Exception("content_base64 is required")
+    environment_id = inputs.get("environment_id")
+    if not environment_id:
+        raise Exception("environment_id is required")
+
+    fields = {"environment_id": str(environment_id)}
+    boundary, body = multipart(fields, "file", file_name, base64.b64decode(content_base64))
+    req = urllib.request.Request(
+        API + "/submit/file",
+        data=body,
+        headers=_headers({"Content-Type": "multipart/form-data; boundary=" + boundary}),
+        method="POST",
+    )
+    with urllib.request.urlopen(req, timeout=120) as r:
+        raw = r.read()
+        result = json.loads(raw) if raw else {}
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/hybrid-analysis/scripts/submit_url.py

@@ -0,0 +1,54 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://www.hybrid-analysis.com/api/v2"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _headers(extra=None):
+    h = {"Accept": "application/json", "User-Agent": "Falcon Sandbox",
+         "api-key": str(_cfg().get("api_key") or "")}
+    if extra:
+        h.update(extra)
+    return h
+
+
+def request(method, path, params=None, form=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = None
+    headers = _headers()
+    if form is not None:
+        data = urllib.parse.urlencode({k: str(v) for k, v in form.items() if v not in (None, "")}).encode("utf-8")
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    url = inputs.get("url")
+    if not url:
+        raise Exception("url is required")
+    environment_id = inputs.get("environment_id")
+    if not environment_id:
+        raise Exception("environment_id is required")
+
+    result = request("POST", "/submit/url-for-analysis", form={"url": url, "environment_id": environment_id})
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/hybrid-analysis/scripts/test_connection.py

@@ -0,0 +1,48 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://www.hybrid-analysis.com/api/v2"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _headers(extra=None):
+    h = {"Accept": "application/json", "User-Agent": "Falcon Sandbox",
+         "api-key": str(_cfg().get("api_key") or "")}
+    if extra:
+        h.update(extra)
+    return h
+
+
+def request(method, path, params=None, form=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = None
+    headers = _headers()
+    if form is not None:
+        data = urllib.parse.urlencode({k: str(v) for k, v in form.items() if v not in (None, "")}).encode("utf-8")
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    result = request("GET", "/key/current")
+    if not isinstance(result, dict):
+        raise Exception("unexpected response")
+    print(json.dumps({"ok": True}))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/joe-sandbox/manifest.yaml

@@ -0,0 +1,99 @@
+id: joe_sandbox
+name: Joe Sandbox
+version: 1.0.0
+description: "Joe Sandbox Cloud (Web API v2) — detonate files and URLs, poll submission/analysis status, search analyses, download reports and read the account quota. API-key authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: file/URL submission, submission and analysis info, search, report download and account quota."
+category: enrichment
+
+# Per-instance configuration. The default server is Joe Sandbox Cloud Pro; set
+# server_url for an on-prem Joe Sandbox appliance. The API key is sent as a form
+# field on every request.
+config_schema:
+  properties:
+    api_key:
+      type: string
+      description: "Joe Sandbox API key"
+      x-soar-sensitive: true
+    server_url:
+      type: string
+      description: "Joe Sandbox base URL (default https://jbxcloud.joesecurity.org)"
+      default: https://jbxcloud.joesecurity.org
+  required:
+    - api_key
+
+commands:
+  - id: submit_sample
+    name: joe-sandbox-submit-sample
+    description: "Submit a file (base64) for analysis. Returns a submission_id; poll it with joe-sandbox-submission-info."
+    inputs_schema:
+      properties:
+        file_name: { type: string, description: "File name" }
+        content_base64: { type: string, description: "File content, base64-encoded" }
+        systems: { type: string, description: "Comma-separated analysis systems (e.g. w10x64). Omit for the account default." }
+        internet_access: { type: boolean, description: "Allow internet access during analysis (default true)" }
+      required: [file_name, content_base64]
+    outputs_schema: { properties: {} }
+  - id: submit_url
+    name: joe-sandbox-submit-url
+    description: "Submit a URL for analysis. Returns a submission_id."
+    inputs_schema:
+      properties:
+        url: { type: string, description: "URL to detonate" }
+        systems: { type: string, description: "Comma-separated analysis systems. Omit for the account default." }
+        internet_access: { type: boolean, description: "Allow internet access during analysis (default true)" }
+      required: [url]
+    outputs_schema: { properties: {} }
+  - id: submission_info
+    name: joe-sandbox-submission-info
+    description: "Get the status and details of a submission by submission_id."
+    risk: read
+    inputs_schema:
+      properties:
+        submission_id: { type: string, description: "Submission ID (from submit)" }
+      required: [submission_id]
+    outputs_schema: { properties: {} }
+  - id: analysis_info
+    name: joe-sandbox-analysis-info
+    description: "Get the details and verdict of an analysis by its web ID."
+    risk: read
+    inputs_schema:
+      properties:
+        web_id: { type: string, description: "Analysis web ID" }
+      required: [web_id]
+    outputs_schema: { properties: {} }
+  - id: search
+    name: joe-sandbox-search
+    description: "Search analyses by term (hash, URL, filename, …)."
+    risk: read
+    inputs_schema:
+      properties:
+        query: { type: string, description: "Search term" }
+      required: [query]
+    outputs_schema: { properties: {} }
+  - id: download_report
+    name: joe-sandbox-download-report
+    description: "Download an analysis report in a given format (returned as base64)."
+    risk: read
+    inputs_schema:
+      properties:
+        web_id: { type: string, description: "Analysis web ID" }
+        report_type: { type: string, description: "Report type: json, html, pdf, xml or misp (default json)" }
+      required: [web_id]
+    outputs_schema: { properties: {} }
+  - id: account_quota
+    name: joe-sandbox-account-quota
+    description: "Read the account's analysis quota."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: joe-sandbox-test-connection
+    description: "Verify the API key and server availability (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }

integrations/joe-sandbox/scripts/account_quota.py

@@ -0,0 +1,37 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _base():
+    return str(_cfg().get("server_url") or "https://jbxcloud.joesecurity.org").rstrip("/") + "/api/v2"
+
+
+def post_form(path, fields):
+    body = dict(fields)
+    body["apikey"] = str(_cfg().get("api_key") or "")
+    body["accept-tac"] = "1"
+    data = urllib.parse.urlencode({k: str(v) for k, v in body.items() if v not in (None, "")}).encode("utf-8")
+    req = urllib.request.Request(_base() + path, data=data,
+                                 headers={"Accept": "application/json", "Content-Type": "application/x-www-form-urlencoded"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    res = post_form("/account/info", {})
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/joe-sandbox/scripts/analysis_info.py

@@ -0,0 +1,41 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _base():
+    return str(_cfg().get("server_url") or "https://jbxcloud.joesecurity.org").rstrip("/") + "/api/v2"
+
+
+def post_form(path, fields):
+    body = dict(fields)
+    body["apikey"] = str(_cfg().get("api_key") or "")
+    body["accept-tac"] = "1"
+    data = urllib.parse.urlencode({k: str(v) for k, v in body.items() if v not in (None, "")}).encode("utf-8")
+    req = urllib.request.Request(_base() + path, data=data,
+                                 headers={"Accept": "application/json", "Content-Type": "application/x-www-form-urlencoded"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    web_id = inputs.get("web_id")
+    if not web_id:
+        raise Exception("web_id is required")
+    res = post_form("/analysis/info", {"webid": web_id})
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/joe-sandbox/scripts/download_report.py

@@ -0,0 +1,59 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _base():
+    return str(_cfg().get("server_url") or "https://jbxcloud.joesecurity.org").rstrip("/") + "/api/v2"
+
+
+def post_form(path, fields):
+    body = dict(fields)
+    body["apikey"] = str(_cfg().get("api_key") or "")
+    body["accept-tac"] = "1"
+    data = urllib.parse.urlencode({k: str(v) for k, v in body.items() if v not in (None, "")}).encode("utf-8")
+    req = urllib.request.Request(_base() + path, data=data,
+                                 headers={"Accept": "application/json", "Content-Type": "application/x-www-form-urlencoded"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    web_id = inputs.get("web_id")
+    if not web_id:
+        raise Exception("web_id is required")
+    report_type = inputs.get("report_type") or "json"
+
+    fields = {
+        "apikey": str(_cfg().get("api_key") or ""),
+        "accept-tac": "1",
+        "webid": web_id,
+        "type": report_type,
+    }
+    data = urllib.parse.urlencode({k: str(v) for k, v in fields.items() if v not in (None, "")}).encode("utf-8")
+    req = urllib.request.Request(_base() + "/analysis/download", data=data,
+                                 headers={"Accept": "application/json", "Content-Type": "application/x-www-form-urlencoded"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        content = r.read()
+
+    print(json.dumps({
+        "web_id": web_id,
+        "report_type": report_type,
+        "content_base64": base64.b64encode(content).decode("ascii"),
+    }))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/joe-sandbox/scripts/search.py

@@ -0,0 +1,41 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _base():
+    return str(_cfg().get("server_url") or "https://jbxcloud.joesecurity.org").rstrip("/") + "/api/v2"
+
+
+def post_form(path, fields):
+    body = dict(fields)
+    body["apikey"] = str(_cfg().get("api_key") or "")
+    body["accept-tac"] = "1"
+    data = urllib.parse.urlencode({k: str(v) for k, v in body.items() if v not in (None, "")}).encode("utf-8")
+    req = urllib.request.Request(_base() + path, data=data,
+                                 headers={"Accept": "application/json", "Content-Type": "application/x-www-form-urlencoded"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    query = inputs.get("query")
+    if not query:
+        raise Exception("query is required")
+    res = post_form("/analysis/search", {"q": query})
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/joe-sandbox/scripts/submission_info.py

@@ -0,0 +1,41 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _base():
+    return str(_cfg().get("server_url") or "https://jbxcloud.joesecurity.org").rstrip("/") + "/api/v2"
+
+
+def post_form(path, fields):
+    body = dict(fields)
+    body["apikey"] = str(_cfg().get("api_key") or "")
+    body["accept-tac"] = "1"
+    data = urllib.parse.urlencode({k: str(v) for k, v in body.items() if v not in (None, "")}).encode("utf-8")
+    req = urllib.request.Request(_base() + path, data=data,
+                                 headers={"Accept": "application/json", "Content-Type": "application/x-www-form-urlencoded"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    submission_id = inputs.get("submission_id")
+    if not submission_id:
+        raise Exception("submission_id is required")
+    res = post_form("/submission/info", {"submission_id": submission_id})
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/joe-sandbox/scripts/submit_sample.py

@@ -0,0 +1,78 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error, uuid
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _base():
+    return str(_cfg().get("server_url") or "https://jbxcloud.joesecurity.org").rstrip("/") + "/api/v2"
+
+
+def post_form(path, fields):
+    body = dict(fields)
+    body["apikey"] = str(_cfg().get("api_key") or "")
+    body["accept-tac"] = "1"
+    data = urllib.parse.urlencode({k: str(v) for k, v in body.items() if v not in (None, "")}).encode("utf-8")
+    req = urllib.request.Request(_base() + path, data=data,
+                                 headers={"Accept": "application/json", "Content-Type": "application/x-www-form-urlencoded"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    file_name = inputs.get("file_name")
+    content_base64 = inputs.get("content_base64")
+    if not file_name:
+        raise Exception("file_name is required")
+    if not content_base64:
+        raise Exception("content_base64 is required")
+    systems = inputs.get("systems")
+    internet_access = inputs.get("internet_access", True)
+
+    fields = {
+        "apikey": str(_cfg().get("api_key") or ""),
+        "accept-tac": "1",
+        "internet-access": "1" if internet_access else "0",
+    }
+    if systems:
+        fields["systems"] = systems
+
+    boundary = "----riposte" + uuid.uuid4().hex
+    parts = []
+    for name, value in fields.items():
+        parts.append((
+            "--" + boundary + "\r\n"
+            'Content-Disposition: form-data; name="' + str(name) + '"\r\n\r\n' +
+            str(value) + "\r\n"
+        ).encode("utf-8"))
+    parts.append((
+        "--" + boundary + "\r\n"
+        'Content-Disposition: form-data; name="sample"; filename="' + str(file_name) + '"\r\n'
+        "Content-Type: application/octet-stream\r\n\r\n"
+    ).encode("utf-8"))
+    parts.append(base64.b64decode(content_base64))
+    parts.append(("\r\n--" + boundary + "--\r\n").encode("utf-8"))
+    data = b"".join(parts)
+
+    req = urllib.request.Request(_base() + "/submission/new", data=data,
+                                 headers={"Accept": "application/json",
+                                          "Content-Type": "multipart/form-data; boundary=" + boundary},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=120) as r:
+        raw = r.read()
+        res = json.loads(raw) if raw else {}
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/joe-sandbox/scripts/submit_url.py

@@ -0,0 +1,47 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _base():
+    return str(_cfg().get("server_url") or "https://jbxcloud.joesecurity.org").rstrip("/") + "/api/v2"
+
+
+def post_form(path, fields):
+    body = dict(fields)
+    body["apikey"] = str(_cfg().get("api_key") or "")
+    body["accept-tac"] = "1"
+    data = urllib.parse.urlencode({k: str(v) for k, v in body.items() if v not in (None, "")}).encode("utf-8")
+    req = urllib.request.Request(_base() + path, data=data,
+                                 headers={"Accept": "application/json", "Content-Type": "application/x-www-form-urlencoded"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    url = inputs.get("url")
+    if not url:
+        raise Exception("url is required")
+    systems = inputs.get("systems")
+    internet_access = inputs.get("internet_access", True)
+    res = post_form("/submission/new", {
+        "url": url,
+        "internet-access": "1" if internet_access else "0",
+        "systems": systems or None,
+    })
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/joe-sandbox/scripts/test_connection.py

@@ -0,0 +1,39 @@
+import base64, json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _base():
+    return str(_cfg().get("server_url") or "https://jbxcloud.joesecurity.org").rstrip("/") + "/api/v2"
+
+
+def post_form(path, fields):
+    body = dict(fields)
+    body["apikey"] = str(_cfg().get("api_key") or "")
+    body["accept-tac"] = "1"
+    data = urllib.parse.urlencode({k: str(v) for k, v in body.items() if v not in (None, "")}).encode("utf-8")
+    req = urllib.request.Request(_base() + path, data=data,
+                                 headers={"Accept": "application/json", "Content-Type": "application/x-www-form-urlencoded"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    res = post_form("/server/online", {})
+    if not isinstance(res, dict):
+        raise Exception("unexpected response")
+    print(json.dumps({"ok": True, "online": res.get("data", {}).get("online")}))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/securitytrails/manifest.yaml

@@ -0,0 +1,93 @@
+id: securitytrails
+name: SecurityTrails
+version: 1.0.0
+description: "SecurityTrails (API v1) — DNS and domain intelligence: current domain details, subdomains, WHOIS, historical DNS, associated domains, IP neighbors and a domain filter search. API-key authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: domain details, subdomains, WHOIS, DNS history, associated domains, IP neighbors and domain search."
+category: enrichment
+
+config_schema:
+  properties:
+    api_key:
+      type: string
+      description: "SecurityTrails API key"
+      x-soar-sensitive: true
+  required:
+    - api_key
+
+commands:
+  - id: domain_details
+    name: securitytrails-domain-details
+    description: "Current DNS and metadata for a domain (A/MX/NS/SOA/TXT records, host provider, Alexa rank)."
+    risk: read
+    inputs_schema:
+      properties:
+        domain: { type: string, description: "Domain name" }
+      required: [domain]
+    outputs_schema: { properties: {} }
+  - id: subdomains
+    name: securitytrails-subdomains
+    description: "List the known subdomains of a domain."
+    risk: read
+    inputs_schema:
+      properties:
+        domain: { type: string, description: "Domain name" }
+      required: [domain]
+    outputs_schema: { properties: {} }
+  - id: domain_whois
+    name: securitytrails-domain-whois
+    description: "Current WHOIS record for a domain."
+    risk: read
+    inputs_schema:
+      properties:
+        domain: { type: string, description: "Domain name" }
+      required: [domain]
+    outputs_schema: { properties: {} }
+  - id: dns_history
+    name: securitytrails-dns-history
+    description: "Historical DNS records of a domain for a given record type."
+    risk: read
+    inputs_schema:
+      properties:
+        domain: { type: string, description: "Domain name" }
+        record_type: { type: string, description: "Record type: a, aaaa, mx, ns, soa or txt (default a)" }
+      required: [domain]
+    outputs_schema: { properties: {} }
+  - id: associated_domains
+    name: securitytrails-associated-domains
+    description: "Domains associated with the given domain (shared registrant/infrastructure)."
+    risk: read
+    inputs_schema:
+      properties:
+        domain: { type: string, description: "Domain name" }
+      required: [domain]
+    outputs_schema: { properties: {} }
+  - id: ip_neighbors
+    name: securitytrails-ip-neighbors
+    description: "Neighboring IPs in the same range as the given IP, with hostname counts."
+    risk: read
+    inputs_schema:
+      properties:
+        ip: { type: string, description: "IP address" }
+      required: [ip]
+    outputs_schema: { properties: {} }
+  - id: search_domain
+    name: securitytrails-search-domain
+    description: "Search domains with a filter (e.g. by keyword, mail provider, whois email)."
+    risk: read
+    inputs_schema:
+      properties:
+        keyword: { type: string, description: "Substring the domain must contain" }
+        mail_provider: { type: string, description: "Mail provider filter" }
+        whois_email: { type: string, description: "WHOIS registrant email filter" }
+        limit: { type: number, description: "Maximum records (default 100)" }
+      required: []
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: securitytrails-test-connection
+    description: "Verify the API key (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }

integrations/securitytrails/scripts/associated_domains.py

@@ -0,0 +1,44 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://api.securitytrails.com/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def request(method, path, params=None, body=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "APIKEY": str(_cfg().get("api_key") or "")}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    domain = inputs.get("domain")
+    if not domain:
+        raise Exception("domain is required")
+    res = request("GET", "/domain/" + q(domain) + "/associated")
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/securitytrails/scripts/dns_history.py

@@ -0,0 +1,45 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://api.securitytrails.com/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def request(method, path, params=None, body=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "APIKEY": str(_cfg().get("api_key") or "")}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    domain = inputs.get("domain")
+    if not domain:
+        raise Exception("domain is required")
+    record_type = inputs.get("record_type") or "a"
+    res = request("GET", "/history/" + q(domain) + "/dns/" + q(record_type))
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/securitytrails/scripts/domain_details.py

@@ -0,0 +1,44 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://api.securitytrails.com/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def request(method, path, params=None, body=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "APIKEY": str(_cfg().get("api_key") or "")}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    domain = inputs.get("domain")
+    if not domain:
+        raise Exception("domain is required")
+    res = request("GET", "/domain/" + q(domain))
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/securitytrails/scripts/domain_whois.py

@@ -0,0 +1,44 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://api.securitytrails.com/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def request(method, path, params=None, body=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "APIKEY": str(_cfg().get("api_key") or "")}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    domain = inputs.get("domain")
+    if not domain:
+        raise Exception("domain is required")
+    res = request("GET", "/domain/" + q(domain) + "/whois")
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/securitytrails/scripts/ip_neighbors.py

@@ -0,0 +1,44 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://api.securitytrails.com/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def request(method, path, params=None, body=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "APIKEY": str(_cfg().get("api_key") or "")}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    ip = inputs.get("ip")
+    if not ip:
+        raise Exception("ip is required")
+    res = request("GET", "/ips/nearby/" + q(ip))
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/securitytrails/scripts/search_domain.py

@@ -0,0 +1,56 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://api.securitytrails.com/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def request(method, path, params=None, body=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "APIKEY": str(_cfg().get("api_key") or "")}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    keyword = inputs.get("keyword")
+    mail_provider = inputs.get("mail_provider")
+    whois_email = inputs.get("whois_email")
+    limit = inputs.get("limit")
+
+    filt = {}
+    if keyword:
+        filt["keyword"] = keyword
+    if mail_provider:
+        filt["mail_provider"] = mail_provider
+    if whois_email:
+        filt["whois_email"] = whois_email
+    if not filt:
+        raise Exception("provide at least one filter (keyword, mail_provider or whois_email)")
+
+    res = request("POST", "/domains/list", params={"limit": limit or 100}, body={"filter": filt})
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/securitytrails/scripts/subdomains.py

@@ -0,0 +1,44 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://api.securitytrails.com/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def request(method, path, params=None, body=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "APIKEY": str(_cfg().get("api_key") or "")}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    domain = inputs.get("domain")
+    if not domain:
+        raise Exception("domain is required")
+    res = request("GET", "/domain/" + q(domain) + "/subdomains")
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/securitytrails/scripts/test_connection.py

@@ -0,0 +1,42 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://api.securitytrails.com/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def request(method, path, params=None, body=None):
+    url = API + path
+    p = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if p:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(p)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "APIKEY": str(_cfg().get("api_key") or "")}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    res = request("GET", "/ping")
+    if not (isinstance(res, dict) and res.get("success")):
+        raise Exception("unexpected response")
+    print(json.dumps({"ok": True}))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)