Connect ilert to Hybrid Analysis

Both apps 23ilert 13Hybrid Analysis 10

• Trigger
  New or Updated Incident

  Triggers when an incident (alert) on the chosen ilert alert source is created or changes: assigned, escalated, accepted, raised, commented on, resolved, or a responder is added or removed.

• Action
  Accept Incident

  Accepts a pending ilert alert (formerly called an incident) on behalf of the connected user, stopping its escalation, and returns the updated alert.

• Action
  Add Alert

  Creates an alert in ilert on the chosen alert source, which then escalates according to the source's escalation policy (or a policy or responders you specify).

• Action
  Add maintenance window

  Creates a maintenance window in ilert that suppresses alerts for the chosen alert sources and services between a start and end time.

• Action
  Create Incident

  Creates a new incident in ilert, optionally marking affected services and adding responders. Depending on the affected services, subscribers may be notified.

• Action
  Find User on Call

  Finds the user currently on call for an on-call schedule, along with the start and end of their current shift. Returns found=false when nobody is on call.

• Action
  Get alert

  Returns a single ilert alert by its id, including its summary, status, priority, alert source, escalation policy and responders.

• Action
  Get incident

  Returns a single ilert incident by its id, including its status, severity, affected services and responders.

• Action
  Get maintenance window

  Fetches a maintenance window by ID. An error occurs if the maintenance window is not found.

• Action
  List Alert Sources

  Returns all alert sources in your ilert account, including each source's integration type, integration key, status and escalation policy.

• Action
  List incidents

  Returns the incidents in your ilert account, optionally filtered by status, affected service, severity and declaration date.

• Action
  List users

  Returns the users in your ilert account, with their name, email, role and contact settings.

• Action
  Resolve Incident

  Resolves an ilert alert (formerly called an incident), closing it and stopping further escalation.

• Action
  Find reports by hash

  Returns the SHA256 hashes and all sandbox detonation reports associated with the specified file hash (MD5, SHA1, SHA256 or SHA512).

• Action
  Get overview for hash

  Returns the Hybrid Analysis overview (verdict, threat score, file names, scanner results, related reports) for a file's SHA256 hash.

• Action
  Get quick scan result

  Retrieves the current result of a quick scan. Some scanners take time to finish; when finished is false, run this again later to get the final results.

• Action
  Get report state

  Returns the processing state of a sandbox report submission.

• Action
  Get report summary

  Returns the summary of a sandbox report (a submission's analysis), including verdict, threat score, hashes, signatures, MITRE ATT&CK mappings and extracted files.

• Action
  Get submission quota

  Returns the submission quota and current usage for the connected API key, for both sandbox detonations and quick scans.

• Action
  Scan file

  Submit a file to Hybrid Analysis for a quick scan by the selected scanners. Returns the quick scan id, the file's SHA256 and the scanner results so far; if finished is false, some scanners are still working.

• Action
  Search reports

  Search Hybrid Analysis sandbox reports by any combination of filename, file type, verdict, tag, AV family, host, domain, date range and other attributes.

• Action
  Submit file for analysis

  Submits a file to the Hybrid Analysis (Falcon Sandbox) for detonation in the chosen environment and returns the job id, submission id and SHA256.

• Action
  Submit URL for analysis

  Submits a website URL, or the URL of a file, to the Hybrid Analysis sandbox for analysis and returns the job and submission identifiers.

No trigger or action matches that. Ask your agent to add it: it reads the API documentation and builds what you describe.