Hatching Triage App is an API wrapper tool as the report utility for Hatching Triage sandbox's instance public instance('tria.ge') or private instance('private.tria.ge').
Please visit their official site ("https://hatching.io/triage/") for what Hatching Triage is.
This app doesn't include report options to download the sample files, dropped files, dumped memory, raw pcap and pcapng payloads. This app downloads just report logs from triage cloud instance.
The API Key is needed to utilize this App.
1. Install this App package
2. Create the APK Key on your given Triage sandbox dashboard. If you use private instance, "private.triage.ge" is the fqdn, otherwise you can use the public instance which the fqdn is "tria.ge" at the present. Researcher role is needed to create APK Key on "tria.ge".
3. Set up the API Key on the App Setup Page. Please remember that both API Keys cannot be set at the same time thus you have to switch if you change it to the certain API Key to match the instance.
4. Restarting splunk search head instance may be possibly needed for activating these custom search commands.
5. App Install user needs "admin_all_objects" privilege and Splunk search users need "list_storage_passwords" privilege in order to utilize "Secret storage".
triageindex
| triageindex instance="public" subset="public" limit=10
triagesearch
| triagesearch instance="public" query="family:emotet" limit=30
triagereport
| triagereport instance="public" report="dynamic" sampleID="YYYYMMDD-cy7xkahgcr" taskID="behavioral1"
Command usages are also described in searchbnf.conf, thus you can see it on search window by writing the command name on.
Some errors are dumped to the output error field and the command exception will be dumped in search.log or %SPLUNK_HOME%/var/log/goahead_hatching_triage_utils_app.log if it happens.
Following this app report options are beta versions. Unfortunately they are not stable yet and may happens some error by samples.
proc_tree
ioc_extracted
magic
In addition, pcap and pcapng report options do NOT download the files and are just for showing the cURL command line with masked APIKey to download them in your safe isolated environment.
This app doesn't include report options to download the sample files, dropped files, dumped memory, raw pcap and pcapng payloads. This app downloads just report logs from triage cloud instance
Splunk 8.x, this app codes are written in Python3.
Hatching has already provided Triage App for Splunk Phantom by themselves.
Their official blog (https://hatching.io/blog/triage-splunk-xsoar/) is useful when you are in Splunk Phantom.
Copyright 2022 GoAhead Inc.
GeneratingCommands of "triageindex", "triagesearch", "triagereport" have been implemented.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.