You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Gather detonation data for files and URL using `ANY.RUN`.
13
13
@@ -23,8 +23,8 @@ Sign in to ANY.RUN. Click on your profile on the left menu. In the API and Limit
23
23
24
24
## ANY.RUN in Automation Service and Cloud SOAR
25
25
26
-
1. Access integrations in the [Automation Service](/docs/platform-services/automation-service/automation-service-integrations/#view-integrations) or [Cloud SOAR](/docs/cloud-soar/automation).
27
-
1. After the list of the integrations appears, search for the integration and click on the row.
26
+
1. Access integrations in the [Automation Service](/docs/platform-services/automation-service/automation-service-integrations/#view-integrations) or [Cloud SOAR](/docs/cloud-soar/automation).
27
+
1. After the list of the integrations appears, search for the integration and click on the row.
28
28
1. The integration details will appear. Click on the **"+"** button to add new Resource.<br/><img src={useBaseUrl('/img/platform-services/automation-service/app-central/integrations/any.run/any.run-3.png')} style={{border:'1px solid gray'}} alt="any.run-3" width="400"/>
29
29
1. Populate all the required fields (\*):
30
30
***URL**. 'https://api.any.run'
@@ -39,3 +39,4 @@ Sign in to ANY.RUN. Click on your profile on the left menu. In the API and Limit
39
39
* February 21, 2020 - First upload
40
40
* February 13, 2023 - Integration refactored
41
41
* June 15, 2023 (v1.3) - Updated the integration with Environmental Variables
42
+
* February 04, 2025 (v1.4) - Updated the action Get Report with Environmental Variables
Using the integration with EC2, you can enrich incidents with specific EC2 data, create and delete snapshots, work with elastic addresses and instances, and manipulate security groups.
13
13
14
14
## Actions
15
15
16
-
***Describe Regions** (*Enrichment*) - Describes the Regions that are enabled for an account, or all Regions.
17
-
***Describe Instances** (*Enrichment*) - Describes the specified instances or all of AWS account's instances.
16
+
***Authorize Security Group Ingress Rule** (*Containment*) - Adds the specified ingress rules to a security group.
17
+
***Create Snapshot** (*Containment*) - Creates a new snapshot.
18
+
***Delete Security Group** (*Containment*) - Delete a security group.
19
+
***Delete Snapshot** (*Containment*) - Deletes an existing snapshot.
18
20
***Describe Addresses** (*Enrichment*) - Describes the specified Elastic IP addresses or all Elastic IP addresses.
19
-
***Describe Volumes** (*Enrichment*) - Describes the specified EBS volumes or all EBS volumes.
21
+
***Describe Instances** (*Enrichment*) - Describes the specified instances or all of AWS account's instances.
22
+
***Describe Instances V2** (*Enrichment*) - Describes the specified instances or all of AWS account's instances with pagination.
20
23
***Describe Key Pairs** (*Enrichment*) - Describes the specified key pairs or all key pairs.
21
-
***Describe VPCs** (*Enrichment*) - Describes one or more VPCs.
24
+
***Describe Regions** (*Enrichment*) - Describes the Regions that are enabled for an account, or all Regions.
22
25
***Describe Subnets** (*Enrichment*) - Describes one or more subnets.
23
26
***Describe Security Groups** (*Enrichment*) - Describes the specified security groups or all security groups.
24
27
***Describe Snapshots** (*Enrichment*) - Describes a specified EBS snapshots or all of the EBS snapshots available.
25
-
***Get Password Data** (*Enrichment*) - Retrieves the encrypted administrator password for a running Windows instance.
26
-
***Create Snapshot** (*Containment*) - Creates a new snapshot.
27
-
***Delete Snapshot** (*Containment*) - Deletes an existing snapshot.
28
+
***Describe Volumes** (*Enrichment*) - Describes the specified EBS volumes or all EBS volumes.
29
+
***Describe VPCs** (*Enrichment*) - Describes one or more VPCs.
28
30
***Disassociate Address** (*Containment*) - Disassociates an Elastic IP address from an instance or network interface it's associated with.
31
+
***Get Password Data** (*Enrichment*) - Retrieves the encrypted administrator password for a running Windows instance.
32
+
***Monitor Instance** (*Containment*) - Monitor a specific instance.
29
33
***Release Address** (*Containment*) - Releases the specified Elastic IP address.
Copy file name to clipboardExpand all lines: docs/platform-services/automation-service/automation-service-playbooks.md
+22-1Lines changed: 22 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -210,10 +210,31 @@ A filter node filters results from the preceding action based on the condition y
210
210
211
211
## Playbook versioning
212
212
213
-
Every time you edit a playbook, a new version of the playbook is saved. In the screen image below, notice how all the versions of the playbook are listed (#4 being the published version as indicated by the publish icon). Click on a version to edit it, and if you want, publish it. In this way, you maintain version control of your playbooks, and ensure that all versions are retained.
213
+
### Autosave
214
+
215
+
Every time you edit a playbook draft, the draft is automatically saved, and the following notification briefly appears in the lower right corner of the playbook screen:<br/><img src={useBaseUrl('img/platform-services/automation-service/autosave-playbook-1.png')} alt="Playbook autosave" style={{border:'1px solid gray'}} width="200"/>
216
+
217
+
When the automatic save is complete, the following notification lets you know.<br/><img src={useBaseUrl('img/platform-services/automation-service/autosave-playbook-2.png')} alt="Playbook autosave complete" style={{border:'1px solid gray'}} width="200"/>
218
+
219
+
To enable or disable autosave, use [playbook preferences](#playbook-preferences).
220
+
221
+
### Versions
222
+
223
+
To publish a playbook so that others may use it, click the publish button at the bottom of the playbook screen.<br/><img src={useBaseUrl('img/platform-services/automation-service/playbook-publish-button.png')} alt="Playbook publish button" style={{border:'1px solid gray'}} width="300"/>
224
+
225
+
Every time you publish a playbook, a new version of the playbook is retained. In the screen image below, notice how all the versions of the playbook are listed (#4 being the published version as indicated by the publish icon). Click on a version to edit it, and if you want, publish it. In this way, you maintain version control of your playbooks, and ensure that all versions are retained.
1. Click the preferences button in the upper-right corner of the screen.<br/><img src={useBaseUrl('img/platform-services/automation-service/playbook-preferences.png')} alt="Playbook preferences button" style={{border:'1px solid gray'}} width="200"/>
232
+
2. Configure preferences in the **Playbooks Preferences** screen.<br/><img src={useBaseUrl('img/platform-services/automation-service/playbook-preferences-screen.png')} alt="Playbook preferences screen" style={{border:'1px solid gray'}} width="400"/>
233
+
234
+
### Autosave preference
235
+
236
+
Select **Enable Autosave for all playbooks** to ensure that while editing a playbook, all changes will be automatically saved to the draft. For more information, see [Autosave](#autosave).
237
+
217
238
## Import and export playbooks
218
239
219
240
With the mechanism to import and export playbooks, you can move a playbook, along with all its configurations, from one instance to another. The file should be in tar.gz format and adhere to naming conventions.
0 commit comments