ANY.RUN

The ANY.RUN connector facilitates the integration of ANY.RUN's interactive malware analysis service with other platforms, enabling automated threat detection and response workflows.

ANY.RUN is an interactive malware hunting service that enables the in-depth analysis of cyber threats in a safe and controlled environment. The ANY.RUN connector for Swimlane Turbine allows users to automate the retrieval of execution histories, comprehensive task reports, available analysis environments, and user account limits. It also facilitates the initiation of new analyses for dynamic examination of files or URLs. This integration empowers security teams to streamline their malware investigation and analysis processes, enhancing their ability to respond to threats quickly and efficiently within the Swimlane Turbine platform.

Prerequisites

To effectively utilize the ANY.RUN connector within the Swimlane Turbine platform, ensure you have the following prerequisites:

HTTP Basic Authentication with these parameters:

URL: Endpoint for the ANY.RUN API.

Username: Your ANY.RUN account username.

Password: Your ANY.RUN account password.

API Key Authentication with these parameters:

URL: Endpoint for the ANY.RUN API.

API Key: A unique identifier to authenticate requests to the ANY.RUN API.

Capabilities

This connector provides the following capabilities:

Get History

Get Report

Request Available Environment

Request User Limits

Run New Analysis

Notes

ANY.RUN API Documentation Link

Additional Documentation

ANY.RUN Connector Documentation

ANY.RUN API Documentation

ANY.RUN Authentication Guide

Configurations

AnyRun Interactive Analysis API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
APIKey	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

AnyRun HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get History

Fetches the execution history from ANY.RUN, providing a detailed log of previous activities.

Endpoint

URL: v1/analysis

Method: GET

Input

Argument Name	Type	Required	Description
parameters.team	boolean	Optional	Parameters for the Get History action
parameters.skip	number	Optional	Parameters for the Get History action
parameters.limit	number	Optional	Parameters for the Get History action

Input Example

{"parameters":{"team":false,"skip":0,"limit":25}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	boolean	Error message if any
data	object	Response data
data.tasks	array	Response data

Output Example

{"error":true,"data":{"tasks":["string"]}}

Get Report

Retrieves a comprehensive report for a specified task in ANY.RUN using the task identifier provided in path parameters.

Endpoint

URL: v1/analysis/{{task}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.task	string	Required	Parameters for the Get Report action

Input Example

{"path_parameters":{"task":"0cf223f2-530e-4a50-b68f-563045268648"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	boolean	Error message if any
data	object	Response data
data.mitre	array	Response data
data.mitre.name	string	Response data
data.mitre.phases	array	Response data
data.mitre.id	string	Response data
data.debugStrings	array	Response data
data.debugStrings.file_name	string	Response data
data.debugStrings.file	string	Response data
data.incidents	array	Response data
data.incidents.process	string	Response data
data.incidents.events	array	Response data
data.incidents.events.cmdParent	string	Response data
data.incidents.events.cmdChild	string	Response data
data.incidents.events.image	string	Response data
data.incidents.events.time	number	Response data
data.incidents.mitre	array	Response data
data.incidents.count	number	Response data
data.incidents.firstSeen	number	Response data
data.incidents.source	string	Response data
data.incidents.desc	string	Response data
data.incidents.title	string	Response data
data.incidents.threatLevel	number	Response data

Output Example

{"error":true,"data":{"mitre":[{}],"debugStrings":[{}],"incidents":[{}],"modified":{"registry":[],"files":[]},"network":{"threats":[],"connections":[],"httpRequests":[],"dnsRequests":[]},"malconf":[{}],"processes":[{}],"counters":{"synchronization":{},"registry":{},"files":{},"network":{},"processes":{}},"environments":{"hotfixes":[],"software":[],"internetExplorer":{},"os":{}},"analysis":{"content":{},"scores":{},"options":{},"tags":[],"creationText":"string","creation":123,"duration":123,"sand...

Request Available Environment

Retrieve a list of available environments from ANY.RUN for initiating analysis sessions.

Endpoint

URL: v1/environment

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	boolean	Error message if any
data	object	Response data
data.environments	array	Response data
data.environments.build	number	Response data
data.environments.variant	string	Response data
data.environments.version	string	Response data
data.environments.type	string	Response data
data.environments.os	string	Response data
data.environments.software	object	Response data
data.environments.software.ie	object	Response data
data.environments.software.ie.version	string	Response data
data.environments.software.upps	array	Response data
data.environments.software.apps	array	Response data
data.environments.software.apps.name	string	Response data
data.environments.software.apps.version	string	Response data
data.environments.bitness	number	Response data

Output Example

{"error":true,"data":{"environments":[{}]}}

Request User's Limit

Retrieve usage statistics and account limits for a user, including submission counts and API request numbers on ANY.RUN.

Endpoint

URL: v1/user

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	boolean	Error message if any
data	object	Response data
data.limits	object	Response data
data.limits.web	object	Response data
data.limits.web.minute	number	Response data
data.limits.web.hour	number	Response data
data.limits.web.day	number	Response data
data.limits.web.month	number	Response data
data.limits.api	object	Response data
data.limits.api.minute	number	Response data
data.limits.api.hour	number	Response data
data.limits.api.day	number	Response data
data.limits.api.month	number	Response data
data.limits.parallels	object	Response data
data.limits.parallels.total	number	Response data
data.limits.parallels.available	number	Response data

Output Example

{"error":true,"data":{"limits":{"web":{},"api":{},"parallels":{}}}}

Run New Analysis

Initiates a new analysis in ANY.RUN for dynamic examination of files or URLs.

Endpoint

URL: v1/analysis

Method: POST

Input

Argument Name	Type	Required	Description
attachments	object	Optional	File to be analysed
attachments.file	string	Optional	Parameter for Run New Analysis
attachments.file_name	string	Optional	Name of the resource
data_body	object	Optional	Response data
data_body.env_os	string	Optional	Response data
data_body.env_bitness	number	Optional	Response data
data_body.env_version	string	Optional	Response data
data_body.env_type	string	Optional	Response data
data_body.opt_network_connect	boolean	Optional	Response data
data_body.opt_network_fakenet	boolean	Optional	Response data
data_body.opt_network_tor	boolean	Optional	Response data
data_body.opt_network_mitm	boolean	Optional	Response data
data_body.opt_network_geo	string	Optional	Response data
data_body.opt_kernel_heavyevasion	boolean	Optional	Response data
data_body.opt_privacy_type	string	Optional	Response data
data_body.opt_timeout	number	Optional	Response data
data_body.opt_ext_startfolder	string	Optional	Response data
data_body.obj_type	string	Optional	Response data
data_body.obj_url	string	Optional	Response data
data_body.obj_ext_cmd	string	Optional	Response data
data_body.obj_ext_browser	string	Optional	Response data
data_body.obj_ext_useragent	string	Optional	Response data
data_body.obj_ext_elevateprompt	boolean	Optional	Response data
data_body.obj_ext_extension	boolean	Optional	Response data
data_body.obj_privacy_hidesource	boolean	Optional	Response data

Input Example

{"data_body":{"env_os":"windows","env_bitness":32,"env_version":"7","env_type":"complete","opt_network_connect":true,"opt_network_fakenet":false,"opt_network_tor":false,"opt_network_mitm":false,"opt_network_geo":"US","opt_kernel_heavyevasion":false,"opt_privacy_type":"bylink","opt_timeout":60,"opt_ext_startfolder":"temp","obj_type":"url","obj_url":"https://swimlane.com","obj_ext_cmd":"2..256","obj_ext_browser":"Google Chrome","obj_ext_useragent":"2..256","obj_ext_elevateprompt":true,"obj_ext_extension":true,"obj_privacy_hidesource":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	boolean	Error message if any
data	object	Response data
data.taskid	string	Response data

Output Example

{"error":true,"data":{"taskid":"string"}}

Response Headers

Header	Description	Example
Access-Control-Allow-Headers	HTTP response header: Access-Control-Allow-Headers
Access-Control-Allow-Origin	HTTP response header: Access-Control-Allow-Origin
CF-Cache-Status	HTTP response header: CF-Cache-Status
CF-RAY	HTTP response header: CF-RAY
Connection	HTTP response header: Connection
Content-Encoding	HTTP response header: Content-Encoding
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT
ETag	An identifier for a specific version of a resource
Server	Information about the software used by the origin server
Strict-Transport-Security	HTTP response header: Strict-Transport-Security
Transfer-Encoding	HTTP response header: Transfer-Encoding
Vary	HTTP response header: Vary