...

Anomali Match is a Threat Detection Engine purpose-built to automate and speed time to detection in your environment. Anomali Match correlates twelve months of metadata against active threat intelligence to expose previously unknown threats to your organization.

Connect Anomali Match with Devo SOAR

1. Navigate to Automations > Integrations.

2. Search for Anomali Match.

3. Click Details, then the + icon. Enter the required information in the following fields.

4. Label: Enter a connection name.

5. Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.

6. Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).

7. Remote Agent: Run this integration using the Devo SOAR Remote Agent.

8. IP or Hostname: IP address or Hostname of your Anomali Match instance.

9. Port: Port on which your Anomali Match instance listens for web connections.

10. Username: Username for Anomali.

11. Password: Password for Anomali Match.

12. After you've entered all the details, click Connect.

Actions for Anomali Match

Run Search

Performs a search for events or intelligence in Anomali Match.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

...

For example: 2019-05-01T13:45:30.000000-04:00, Now/w, now/M, -30d/d, -1y/M, now, now-3h, 1601545500000. | Optional |

Output

Correlated results with each item in a separate row.

Retrospective/Forensic Search

Performs a retrospective/forensic search on event data in Anomali Match.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

...

For example: 2019-05-01T13:45:30.000000-04:00, Now/w, now/M, -30d/d, -1y/M, now, now-3h, 1601545500000. | Optional | | Search Timeout | Enter search timeout in seconds for each search/row. The action will poll for 10 times in this duration equally spaced for each row of input. (Default is 60 seconds). | Optional |

Output

Correlated JSON results containing lhub_file_id that contains the results of running the above action per input row.

...

## Identify DGA Domains

Retrieve the DGA Probability and Malware Family for sets of domains processed by the Anomali Match DGA detection algorithm.

### Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

| Input Name | Description                                         | Required |
| :--------- | :-------------------------------------------------- | :------- |
| Domain     | Select column from parent table containing domains. | Required |

### Output

A JSON object containing multiple rows of correlated results:


``` {json}{
  "registered_domain": false,
  "malware_family": "Conficker,Dircrypt,Gameover_P2P,Hesperbot,MadMax,Necurs,Nymaim,Oderoor,Proslikefan,Pushdo,Pykspa,Pykspa2,QakBot,Ramnit,Recurs,Tempedreve,Urlzone,Vidro",
  "probability": 1,
  "has_error": false,
  "error": null
}

Whitelist DGA Domains

Adds DGA Domains to the DGA Whitelist.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of correlated results:

...

## Un-Whitelist DGA Domains

Removes DGA Domains from the DGA Whitelist.

### Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

| Input Name | Description                                         | Required |
| :--------- | :-------------------------------------------------- | :------- |
| Domain     | Select column from parent table containing domains. | Required |

### Output

A JSON object containing multiple rows of correlated results:


``` {json}{
  "status_code": 200,
  "message": "",
  "has_error": false,
  "error": true
}

Release Notes

• v2.0.0 - Updated architecture to support IO via filesystem

...