Intezer

August 26, 2025 · View on GitHub

Overview

This integration provides tools to interact with the Intezer platform for analyzing files, URLs, and hashes, managing alerts, and indexing files.

Available Tools

Detonate File

Tool Name: intezer_detonate_file

Description: Analyze a file from Splunk vault with Intezer.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
file_path (string, required): Path to file for analyzing. Multiple values can be provided as a comma-separated string.
related_alert_id (string, optional): The alert id related to the file. Defaults to None.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Defaults to empty list.
scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

dict: A dictionary containing the result of the action execution, likely including an analysis ID.

Get URL Report

Tool Name: intezer_get_url_report

Description: Get a URL analysis report based on a URL analysis ID.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
analysis_id (string, required): Specify a comma-separated list of URL Analysis IDs to run the action on. Analysis ID is case sensitive. The analysis ID is returned when submitting a URL for analysis. Multiple values can be provided as a comma-separated string.
wait_for_completion (boolean, optional): Whether to wait for the analysis to finish. Defaults to None.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Defaults to empty list.
scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

dict: A dictionary containing the result of the action execution, including the URL analysis report.

Get File Report

Tool Name: intezer_get_file_report

Description: Get a file analysis report based on an analysis ID or a file hash.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
analysis_id (string, optional): Specify a comma-separated list of File Analysis IDs to run the action on. Analysis ID is case sensitive. Note: if both "Analysis ID" and "File Hash" are provided, then "File Hash" value will have priority. Multiple values can be provided as a comma-separated string. Defaults to None.
file_hash (string, optional): Specify a comma-separated list of file hashes to run the action on. File Hash is case sensitive. Note: if both "Analysis ID" and "File Hash" are provided, then "File Hash" value will have priority. Multiple values can be provided as a comma-separated string. Defaults to None.
private_only (boolean, optional): Whether to show only private reports (relevant only for hashes). Defaults to None.
wait_for_completion (boolean, optional): Whether to wait for the analysis to complete before returning the report. Defaults to None.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Defaults to empty list.
scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

dict: A dictionary containing the result of the action execution, including the file analysis report.

Get Alert

Tool Name: intezer_get_alert

Description: Get an ingested alert triage and response information using alert ID.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
alert_id (string, required): The alert id to query.
wait_for_completion (boolean, optional): Whether to wait for the analysis to finish. Defaults to None.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Defaults to empty list.
scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

dict: A dictionary containing the result of the action execution, including alert details.

Unset Index File

Tool Name: intezer_unset_index_file

Description: Unset file's indexing.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
sha256 (string, optional): SHA256 file to unset the indexing. Multiple values can be provided as a comma-separated string. Defaults to None.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Typically runs on Filehash entities. Defaults to empty list.
scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

dict: A dictionary containing the result of the action execution.

Detonate URL

Tool Name: intezer_detonate_url

Description: Analyze a suspicious URL with Intezer.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
url (string, optional): URL to analyze. Multiple values can be provided as a comma-separated string. Defaults to None.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Typically runs on URL entities. Defaults to empty list.
scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

dict: A dictionary containing the result of the action execution, likely including an analysis ID.

Ping

Tool Name: intezer_ping

Description: Test connectivity to the Intezer with parameters provided at the integration configuration page on the Marketplace tab.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Defaults to empty list.
scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

dict: A dictionary containing the result of the action execution.

Detonate Hash

Tool Name: intezer_detonate_hash

Description: Analyze a file hash (SHA1, SHA256, or MD5) on Intezer Analyze.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
file_hash (string, optional): Hash of the desired report. Multiple values can be provided as a comma-separated string. Defaults to None.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Typically runs on Filehash entities. Defaults to empty list.
scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

dict: A dictionary containing the result of the action execution, likely including an analysis ID or report link.

Index File

Tool Name: intezer_index_file

Description: Index the file's genes into the organizational database.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
index_as (List[str], required): Index as trusted or malicious.
sha256 (string, optional): Sha256 to index. Multiple values can be provided as a comma-separated string. Defaults to None.
family_name (string, optional): Family name to index as. Defaults to None.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Typically runs on Filehash entities. Defaults to empty list.
scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

dict: A dictionary containing the result of the action execution.

Submit Alert

Tool Name: intezer_submit_alert

Description: Submit a new alert including the raw alert information to Intezer for processing.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
source (string, required): The source of the alert.
raw_alert (string, required): Alert raw data in JSON format.
alert_mapping (string, required): Mapping to use for the alert in JSON format.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Defaults to empty list.
scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

dict: A dictionary containing the result of the action execution, likely including an alert ID assigned by Intezer.

Submit Suspicious Email

Tool Name: intezer_submit_suspicious_email

Description: Submit a suspicious phishing email in a raw format (.MSG or .EML) to Intezer for processing.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
email_file_path (string, required): Path to the email file.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Defaults to empty list.
scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

dict: A dictionary containing the result of the action execution, likely including an analysis ID.

Submit File

Tool Name: intezer_submit_file

Description: Submit a file for analysis.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
file_paths (string, required): The paths of the file to analyze.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Defaults to empty list.
scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

dict: A dictionary containing the result of the action execution, likely including an analysis ID.

Submit Hash

Tool Name: intezer_submit_hash

Description: Submit a hash for analysis.

Arguments:

case_id (string, required): The ID of the case.
alert_group_identifiers (List[string], required): Identifiers for the alert groups.
target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Typically runs on Filehash entities. Defaults to empty list.
scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

dict: A dictionary containing the result of the action execution, likely including an analysis ID or report link.