Guillaume BOURGEOIS
9be28a2ff7
Triage API v0, 7 commands: submit file (multipart _json+file) / URL, get sample, get report overview, list samples, search. Bearer-token auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
86 lines
2.8 KiB
YAML
86 lines
2.8 KiB
YAML
id: triage
|
|
name: Hatching Triage
|
|
version: 1.0.0
|
|
description: "Hatching Triage (tria.ge API v0) — dynamic malware analysis: submit files and URLs, read sample status and analysis overview, list samples, and search. Bearer-token authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: submit file/URL, get sample, get report overview, list samples, search."
|
|
category: enrichment
|
|
|
|
# Per-instance configuration. The API key is sent as 'Authorization: Bearer <api_token>'.
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: "Triage API base URL"
|
|
default: "https://tria.ge"
|
|
api_token:
|
|
type: string
|
|
description: "Triage API key"
|
|
x-soar-sensitive: true
|
|
required:
|
|
- api_token
|
|
|
|
commands:
|
|
- id: submit_file
|
|
name: triage-submit-file
|
|
description: "Submit a file (base64) for analysis."
|
|
inputs_schema:
|
|
properties:
|
|
file_name: { type: string, description: "File name" }
|
|
content_base64: { type: string, description: "File content, base64-encoded" }
|
|
required: [file_name, content_base64]
|
|
outputs_schema: { properties: {} }
|
|
- id: submit_url
|
|
name: triage-submit-url
|
|
description: "Submit a URL for analysis."
|
|
inputs_schema:
|
|
properties:
|
|
url: { type: string, description: "URL to detonate" }
|
|
required: [url]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_sample
|
|
name: triage-get-sample
|
|
description: "Get a sample's status and metadata."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
sample_id: { type: string, description: "Sample ID" }
|
|
required: [sample_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_report
|
|
name: triage-get-report
|
|
description: "Get a sample's analysis overview (verdict and behavior summary)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
sample_id: { type: string, description: "Sample ID" }
|
|
required: [sample_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: list_samples
|
|
name: triage-list-samples
|
|
description: "List recent samples."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
limit: { type: number, description: "Max samples (default 20)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: search
|
|
name: triage-search
|
|
description: "Search samples with a Triage search query."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
query: { type: string, description: "Triage search query (e.g. family:emotet)" }
|
|
limit: { type: number, description: "Max results (default 20)" }
|
|
required: [query]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: triage-test-connection
|
|
description: "Verify connectivity and the API key (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|