Package: intezer-sdk
Intezer SDKThe SDK wraps Intezer Analyze API 2.0 (View full API documentation)Currently, the following options are available in the SDK:Analyze by fileAnalyze by SHA256Analyze UrlIndex by fileIndex by SHA256Get Latest AnalysisAccount and file related samplesCode reuse and MetadataIOCs, Dynamic TTPs and CapabilitiesStrings related samplesSearch a familyIngest an alert from any sourceIngest a raw email alert (.msg or .eml file)Installationpipinstallintezer-sdkUsing Intezer SDKSet global api keyBefore using the SDK functionality we should set the api key:api.set_global_api('<api_key>')Analyze By Fileanalysis=FileAnalysis(file_path=<file_path>,dynamic_unpacking=<force_dynamic_unpacking>,# optionalstatic_unpacking=<force_static_unpacking>)# optionalanalysis.send(wait=True)result=analysis.result()Analyze By SHA256analysis=FileAnalysis(file_hash=<file_sha256>)analysis.send(wait=True)result=analysis.result()File Analysis result example{'analysis_id':'00000000-0000-0000-0000-000000000000','analysis_time':'Sun, 04 Aug 2019 09:38:16 GMT','analysis_url':'https://analyze.intezer.com/#/analyses/00000000-0000-0000-0000-000000000000','family_name':'Ramnit','is_private':True,'sha256':'4e553bce90f0b39cd71ba633da5990259e185979c2859ec2e04dd8efcdafe356','sub_verdict':'malicious','verdict':'malicious'}Analyze Urlanalysis=UrlAnalysis(url=<url>)analysis.send(wait=True)result=analysis.result()Url Analysis result example{'analysis_id':'70d09f68-c7a3-43a3-a8de-07ec31fbf4ed','domain_info':{'creation_date':'1997-08-13 04:00:00.000000','domain_name':'foo.com','registrar':'TUCOWS, INC.'},'indicators':[{'classification':'informative','text':'URL is accessible'},{'classification':'informative','text':'Assigned IPv4 domain'},{'classification':'informative','text':'Vaild IPv4 domain'}],'ip':'34.206.39.153','redirect_chain':[{'response_status':301,'url':'https://foo.com/'},{'response_status':200,'url':'http://www.foo.com/'}],'scanned_url':'http://www.foo.com/','submitted_url':'foo.com','downloaded_file':{'analysis_id':'8db9a401-a142-41be-9a31-8e5f3642db62','analysis_summary':{'verdict_description':'This file contains code from malicious software, therefore it'sverylikelythatit's malicious.','verdict_name':'malicious','verdict_title':'Malicious','verdict_type':'malicious'},'sha256':'4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7'},'summary':{'description':'No suspicious activity was detected for this URL','title':'No Threats','verdict_name':'no_threats','verdict_type':'no_threats'}}Index By Filefromintezer_sdkimportconstsindex=Index(file_path=<file_path>,index_as=consts.IndexType.MALICIOUS,family_name=<family_name>)index.send(wait=True)index_id=index.index_idIndex By SHA256fromintezer_sdkimportconstsindex=Index(sha256=<file_sha256>,index_as=consts.IndexType.TRUSTED)index.send(wait=True)index_id=index.index_idGet Latest File Analysisanalysis=FileAnalysis.from_latest_hash_analysis(file_hash:<file_sha256>)result=analysis.result()Get Sub AnalysesRoot File Analysisroot_analysis=analysis.get_root_analysis()Sub Analysessub_analyses=analysis.get_sub_analyses()Code Reuse and Metadataroot_analysis_code_reuse=root_analysis.code_reuseroot_analysis_metadata=root_analysis.metadataforsub_analysisinsub_analyses:sub_analyses_code_reuse=sub_analysis.code_reusesub_analyses_metadata=sub_analysis.metadataRelated Files by Familyroot_analysis_code_reuse=root_analysis.code_reuseforfamilyinroot_analysis_code_reuse['families']:operation=root_analysis.find_related_files(family['family_id'],wait=True)related_files=operation.get_result()Account Related Samplesoperation=root_analysis.get_account_related_samples()related_samples=operation.get_result()Vaccineoperation=root_analysis.generate_vaccine()vaccine=operation.get_result()Strings related samplesoperation=root_analysis.get_string_related_samples('string_to_relate_to',wait=True)string_related_samples=operation.get_result()Wait with timeoutanalysis=FileAnalysis(file_hash=<file_sha256>)analysis.send(wait=True,wait_timeout=datetime.timedelta(minutes=1))Analyses HistoryFilehistory_results=query_file_analyses_history(start_date=<datetime>,end_date=<datetime>,api=<IntezerApi>aggregated_view:<bool>,sources=<source>verdicts=<verdicts>,file_hash=<file_hash>,family_names=<family_names>,file_name=<file_name>)foranalyseinhistory_results:print(analyse)URLhistory_results=query_url_analyses_history(start_date=<datetime>,end_date=<datetime>,aggregated_view=<bool>,sources=<sources>,verdicts=<verdicts>,)foranalyseinhistory_results:print(analyse)End Pointhistory_results=query_endpoint_analyses_history(start_date=<datetime>,end_date=<datetime>,aggregated_view=<bool>,sources=<sources>,verdicts=<verdicts>,sub_verdicts=<verdicts>,did_download_file=<bool>,submitted_url=<submitted_url>)foranalyseinhistory_results:print(analyse)Get alert by idalert=Alert.from_id(alert_id=alert_id,fetch_scans=False,wait=False)Code examplesYou can find more code examples underanalyze-python-sdk/examples/directory