Hybrid Analysis Sandbox
Automatic deploy
Supported by Filigran
Detection & Response Enablement
Overview
Submits files, URLs, and domains to Hybrid Analysis for sandbox detonation, enriching OpenCTI observables with MITRE ATT&CK techniques, dropped files, network indicators, and maliciousness scores.
The OpenCTI Hybrid Analysis enrichment connector allows automatic enrichment of StixFile, Artifact, URL, Domain, and Hostname observables by submitting them for sandbox analysis. It enriches observables with associated MITRE ATT&CK techniques, extracts contacted domain names and IP addresses, identifies dropped files during detonation, and assigns maliciousness scores. The connector automatically creates relationships between observables and discovered indicators, enhancing threat intelligence with behavioral analysis results and attack patterns mapped to the MITRE framework.
Basic information
Connectors
6.8.13
6.8.13
1