Connect PassEngine to Hybrid Analysis

Both apps 25PassEngine 15Hybrid Analysis 10

• Trigger
  New Client

  Triggers when a new client is created.

• Trigger
  New Pass

  Triggers when a new pass is created in PassEngine.

• Trigger
  Pass Scanned

  Triggers each time a pass is successfully scanned, with the pass code, scan result, location and the operator who scanned it.

• Trigger
  Pass Status Changed

  Triggers when a pass status changes (active, used, expired, revoked).

• Action
  Activate Pass

  Reactivates a pass, setting its status back to active and notifying wallet apps.

• Action
  Create Client

  Creates a client (customer) in PassEngine with a name and optional email, phone and internal notes.

• Action
  Create Pass

  Creates a new single-use or multi-use pass, optionally attached to a client and emailed to a recipient. Returns the new pass with its code and public link.

• Action
  Get client

  Returns a single client (customer) by ID, including their name, email, phone and notes.

• Action
  Get pass

  Returns a pass by its ID, including its custom fields, attached client, recent email deliveries and public URL.

• Action
  List clients

  Returns the clients in your PassEngine account, optionally filtered by name, email or phone.

• Action
  List passes

  Returns the passes in your PassEngine account, optionally filtered by name/code text or status.

• Action
  Revoke Pass

  Revokes a pass so it can no longer be scanned, and notifies wallet apps of the change.

• Action
  Scan Pass

  Scans (redeems) a pass by its code, validating its status, validity dates and usage limits, and records the scan. Returns whether the scan succeeded and, if not, why.

• Action
  Send pass email

  Emails an existing pass to a recipient. Returns the queued email delivery with its status.

• Action
  Update Pass

  Updates an existing pass's label, note, status, scan limit, validity dates or custom fields. Changing the status notifies subscribers that the pass status changed.

• Action
  Find reports by hash

  Returns the SHA256 hashes and all sandbox detonation reports associated with the specified file hash (MD5, SHA1, SHA256 or SHA512).

• Action
  Get overview for hash

  Returns the Hybrid Analysis overview (verdict, threat score, file names, scanner results, related reports) for a file's SHA256 hash.

• Action
  Get quick scan result

  Retrieves the current result of a quick scan. Some scanners take time to finish; when finished is false, run this again later to get the final results.

• Action
  Get report state

  Returns the processing state of a sandbox report submission.

• Action
  Get report summary

  Returns the summary of a sandbox report (a submission's analysis), including verdict, threat score, hashes, signatures, MITRE ATT&CK mappings and extracted files.

• Action
  Get submission quota

  Returns the submission quota and current usage for the connected API key, for both sandbox detonations and quick scans.

• Action
  Scan file

  Submit a file to Hybrid Analysis for a quick scan by the selected scanners. Returns the quick scan id, the file's SHA256 and the scanner results so far; if finished is false, some scanners are still working.

• Action
  Search reports

  Search Hybrid Analysis sandbox reports by any combination of filename, file type, verdict, tag, AV family, host, domain, date range and other attributes.

• Action
  Submit file for analysis

  Submits a file to the Hybrid Analysis (Falcon Sandbox) for detonation in the chosen environment and returns the job id, submission id and SHA256.

• Action
  Submit URL for analysis

  Submits a website URL, or the URL of a file, to the Hybrid Analysis sandbox for analysis and returns the job and submission identifiers.

No trigger or action matches that. Ask your agent to add it: it reads the API documentation and builds what you describe.