Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion CHANGES
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@

1.10.1
-----
- Add command for sending phishing emails from a directory to Intezer Analyze
- Add command for sending phishing emails from a directory to Intezer Platform
- Upgrade intezer-SDK to 1.19.9

1.9.3
Expand Down
54 changes: 27 additions & 27 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# intezer-analyze
# intezer-cli

A cross-platform CLI tool which enables analyzing files with Intezer Analyze.
A cross-platform CLI tool which enables analyzing files with Intezer AI-SOC Platform.

# Prerequisites
Python 3.10 and above
Expand All @@ -18,54 +18,54 @@ The CLI supports proxies. To use a proxy, set the environment variable `HTTP_PRO
## Login
To begin using the cli, first you should login with your API key:

`intezer-analyze login <api_key>`
`intezer-cli login <api_key>`

If you are running the CLI against an on premise deployment, enter the url:

`intezer-analyze login <api_key> http://<address>/api`
`intezer-cli login <api_key> http://<address>/api`


## Analyze
Send a file or a directory for analysis in Intezer Analyze.
Send a file or a directory for analysis in Intezer Platform.

### Usage
`intezer-analyze analyze PATH`
`intezer-cli analyze PATH`

### Parameters
PATH: Path to file or directory to send the files inside for analysis.

### Examples:
Send a single file for analysis:

$ intezer-analyze analyze C:\threat.exe
$ intezer-cli analyze C:\threat.exe

Send all files in directory for analysis:

$ intezer-analyze analyze C:\files-to-analyze
$ intezer-cli analyze C:\files-to-analyze

For complete documentation please run `intezer-analyze analyze --help`
For complete documentation please run `intezer-cli analyze --help`

## Analyze hashes file
Send a text file with list of hashes

### Usage
`intezer-analyze analyze-by-list PATH`
`intezer-cli analyze-by-list PATH`

### Parameters
PATH: Path to txt file.

### Example
Send txt file with hashes for analysis:

$ intezer-analyze analyze-by-list ~/files/hashes.txt
$ intezer-cli analyze-by-list ~/files/hashes.txt

For complete documentation please run `intezer-analyze analyze-by-list --help`
For complete documentation please run `intezer-cli analyze-by-list --help`

## Index
Send a file or a directory for indexing

### Usage
`intezer-analyze index PATH INDEX_AS [FAMILY_NAME]`
`intezer-cli index PATH INDEX_AS [FAMILY_NAME]`

### Parameters
PATH: Path to file or directory to index
Expand All @@ -77,19 +77,19 @@ FAMILY_NAME: The family name (optional)
### Example
index a single file:

$ intezer-analyze index ~/files/threat.exe.sample malicious family_name
$ intezer-cli index ~/files/threat.exe.sample malicious family_name

index all files in directory:

$ intezer-analyze index ~/files/files-to-index trusted
$ intezer-cli index ~/files/files-to-index trusted

For complete documentation please run `intezer-analyze index --help`
For complete documentation please run `intezer-cli index --help`

## Index hashes file
Send a text file with list of hashes to index

### Usage
`intezer-analyze index-by-list PATH --index-as=INDEX [FAMILY_NAME]`
`intezer-cli index-by-list PATH --index-as=INDEX [FAMILY_NAME]`

### Parameters
PATH: Path to txt file
Expand All @@ -101,41 +101,41 @@ FAMILY_NAME: The family name (optional)
### Example
Send a file with hashes and verdict for indexing:

$ intezer-analyze index-by-list ~/files/hashes.txt --index-as=malicious family_name
$ intezer-cli index-by-list ~/files/hashes.txt --index-as=malicious family_name

For complete documentation please run `intezer-analyze index-by-list --help`
For complete documentation please run `intezer-cli index-by-list --help`

## Upload offline endpoint scan
Upload an offline scan created by running the Intezer Endpoint Scanner with '-o' flag

### Usage
`intezer-analyze upload-endpoint-scan OFFLINE_SCAN_DIRECTORY`
`intezer-cli upload-endpoint-scan OFFLINE_SCAN_DIRECTORY`

### Parameters
OFFLINE_SCAN_DIRECTORY: Path to directory with offline endpoint scan results

### Examples:
Upload a directory with offline endpoint scan results:

$ intezer-analyze upload-endpoint-scan /home/user/offline_scans/scan_MYPC_2019-01-01_00-00-00
$ intezer-cli upload-endpoint-scan /home/user/offline_scans/scan_MYPC_2019-01-01_00-00-00

For complete documentation please run `intezer-analyze upload-endpoint-scan --help`
For complete documentation please run `intezer-cli upload-endpoint-scan --help`

## Upload multiple offline endpoint scans
Upload multiple offline scans created by running the Intezer Endpoint Scanner with '-o' flag

### Usage
`intezer-analyze upload-endpoint-scans-in-directory OFFLINE_SCANS_ROOT_DIRECTORY`
`intezer-cli upload-endpoint-scans-in-directory OFFLINE_SCANS_ROOT_DIRECTORY`

### Parameters
OFFLINE_SCANS_ROOT_DIRECTORY: Path to root directory containing offline endpoint scan results

### Examples:
Upload a directory with offline endpoint scan results:

$ intezer-analyze upload-endpoint-scans-in-directory /home/user/offline_scans
$ intezer-cli upload-endpoint-scans-in-directory /home/user/offline_scans

For complete documentation please run `intezer-analyze upload-endpoint-scans-in-directory --help`
For complete documentation please run `intezer-cli upload-endpoint-scans-in-directory --help`

## Upload all subdirectories with .eml files to analyze
Upload a directory with .eml files
Expand All @@ -144,8 +144,8 @@ Upload a directory with .eml files
UPLOAD_EMAILS_IN_DIRECTORY: Path to root directory containing the .eml files

### Examples:
$ intezer-analyze upload-emails-in-directory /path/to/emails_root_directory
$ intezer-cli upload-emails-in-directory /path/to/emails_root_directory

# Troubleshooting
The cli produce a log file named `intezer-analyze-cli.log` in the current working directory.
The cli produce a log file named `intezer-cli-cli.log` in the current working directory.
To enable console output, set the environment variable `INTEZER_DEBUG=1`.
Loading