Splunk SOAR

Splunk SOAR (Cloud) delivers the benefits of SOAR as a cloud-based service. With Splunk SOAR (Cloud), you gain the functionality of a security orchestration, automation, and response (SOAR) system that is delivered as a software-as-a-service (SaaS) solution hosted and managed by Splunk. By integrating OPSWAT Filescan with Splunk SOAR, security teams can automate the process of scanning files for malware and other security threats. This integration allows security teams to quickly and easily scan files for potential threats, and take immediate action to mitigate any risks that are identified.

With the integration, you can send a file or URL scan request from Splunk SOAR to Filescan, or search for previously scanned reports in Filescan or you can make a quick file, ip, domain or URL reputation.

You can find more information about Splunk SOAR here.

OPSWAT Filescan Sandbox integration in Splunkbase marketplace available here.

Installation

You can install OPSWAT Filescan from Splunkbase or from Splunk SOAR directly.

Install from Splunk SOAR

In Splunk SOAR go to Apps and select "New Apps".

Then search for OPSWAT Filescan and Install it:

Install from Splunkbase

Download OPSWAT Filescan Sandboxfrom Splunkbase: https://splunkbase.splunk.com/app/6942 and in Splunk under Apps select "Insall App":

After that drag and drop the downloaded app. And click to "Install"

Configuration

After installed, you can find OPSWAT Filescan app under the "Unconfigured Apps" list:

Under 'CONFIGURE NEW ASSET' fill the required fileds.

Under Asset Info tab, please fill the asset name and description:

After this, configure the connection under Asset Settings tab:

A Filescan API key is required to use the integration.

You can use the Activation Key that you received from your OPSWAT Sales Representative, and follow the instructions on the License Activation page or you can create an API key on the Community site under API Key tab.

You need to add your API key, and if you have on-prem version of OPSWAT Filescan, you can add your own server's URL. The default URL is Filescan Community.

After saving the settings you can use the asset.

Testing the asset

You can test the connection of your asset under the view menu:

For that, select Actions -> test connectivity at left and on the right side select your asset. After clicking on 'Test Action' button a message will appear. The following message indicates that the setup was successful:

[USERNAME] API key has been set successfully

Available actions

detonate url

Scan URL resource with Filescan POST - Scan URLAPI

Parameters

DescriptionDefault valueRequired
urlThe URL to submityes
passwordCustom password, in case uploaded archive is protected
is privateIf file should not be available for download by other users
descriptionUploaded file/url description
Example output
Copy

detonate file

Scan file resource with Filescan POST - Scan FileAPI

Parameters

DescriptionDefault valueRequired
vault idVault ID of file to detonateyes
passwordCustom password, in case uploaded archive is protected
is privateIf file should not be available for download by other users
descriptionUploaded file/url description
Example output
Copy

Search for reports. Finds reports and uploaded files by various tokens. It uses OPSWAT Filescan API Reference v1API endpoint and the 'query' field.

Parameters

DescriptionDefault valueRequired
queryThe query stringyes
limitNumber of total results. Maximum 50. (If page and page_size was also provided, then it will be ignored.)10
pagePage number, starting from 1
page_sizePage size. Can be 5, 10 or 20
Example output
Copy

file reputation

Get the reputation for one given hash (returns with the last 10 Filescan reports). It uses GET - Get ReputationAPI endpoint.

DescriptionDefault valueRequired
sha256SHA256 value of the fileyes
Example output
Copy

ioc reputation

Get the reputation for one given hash (returns with the last 10 Filescan reports). It uses GET - Get ReputationAPI endpoint.

DescriptionDefault valueRequired
typeType of the ioc. It should be ip, domain or url.yes
valueThe value
Example output
Copy
Type to search, ESC to discard
Type to search, ESC to discard
Type to search, ESC to discard