id: intezer
name: Intezer
version: 1.0.0
description: "Intezer Analyze (API v2) — genetic malware analysis: analyze files (base64), hashes and URLs, retrieve analysis verdicts, IOCs, metadata and sub-analyses. API-key authentication (exchanged for a short-lived access token); stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: analyze by file/hash/URL, analysis result, IOCs, metadata and sub-analyses."
category: enrichment

config_schema:
  properties:
    api_key:
      type: string
      description: "Intezer API key (from your Intezer account)"
      x-soar-sensitive: true
  required:
    - api_key

commands:
  - id: analyze_by_hash
    name: intezer-analyze-by-hash
    description: "Submit a file hash (SHA256, SHA1 or MD5) for analysis. Returns an analysis_id; poll with intezer-get-file-analysis."
    inputs_schema:
      properties:
        hash: { type: string, description: "File hash" }
      required: [hash]
    outputs_schema: { properties: {} }
  - id: analyze_by_file
    name: intezer-analyze-by-file
    description: "Submit a file (base64) for analysis. Returns an analysis_id."
    inputs_schema:
      properties:
        file_name: { type: string, description: "File name" }
        content_base64: { type: string, description: "File content, base64-encoded" }
      required: [file_name, content_base64]
    outputs_schema: { properties: {} }
  - id: analyze_url
    name: intezer-analyze-url
    description: "Submit a URL for analysis. Returns an analysis_id (use intezer-get-url-analysis)."
    inputs_schema:
      properties:
        url: { type: string, description: "URL to analyze" }
      required: [url]
    outputs_schema: { properties: {} }
  - id: get_file_analysis
    name: intezer-get-file-analysis
    description: "Get the result/verdict of a file analysis by ID."
    risk: read
    inputs_schema:
      properties:
        analysis_id: { type: string, description: "Analysis ID" }
      required: [analysis_id]
    outputs_schema: { properties: {} }
  - id: get_url_analysis
    name: intezer-get-url-analysis
    description: "Get the result/verdict of a URL analysis by ID."
    risk: read
    inputs_schema:
      properties:
        analysis_id: { type: string, description: "Analysis ID" }
      required: [analysis_id]
    outputs_schema: { properties: {} }
  - id: get_analysis_iocs
    name: intezer-get-analysis-iocs
    description: "Get the IOCs extracted from a file analysis."
    risk: read
    inputs_schema:
      properties:
        analysis_id: { type: string, description: "Analysis ID" }
      required: [analysis_id]
    outputs_schema: { properties: {} }
  - id: get_analysis_metadata
    name: intezer-get-analysis-metadata
    description: "Get the metadata of a file analysis."
    risk: read
    inputs_schema:
      properties:
        analysis_id: { type: string, description: "Analysis ID" }
      required: [analysis_id]
    outputs_schema: { properties: {} }
  - id: get_sub_analyses
    name: intezer-get-sub-analyses
    description: "List the sub-analyses of a file analysis (per-component genetic breakdown)."
    risk: read
    inputs_schema:
      properties:
        analysis_id: { type: string, description: "Analysis ID" }
      required: [analysis_id]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: intezer-test-connection
    description: "Verify the API key by obtaining an access token (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }