000034643 - Virustotal Hashlookup for RSA Netwitness is not able to view MD5 and SHA1

Document created by RSA Customer Support Employee on Feb 23, 2017Last modified by RSA Customer Support Employee on Apr 22, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000034643
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: SA Security Analytics Server
RSA Version/Condition: 10.4.x, 10.5.x,10.6.x
 
IssueHow to configure the context menu for virustotal to return the MD5 and SHA1 hash lookups during an event reconstruction.
CauseIf you are seeing this while attempting to access virustotal you have provided the wrong urlFormat in your context menu to lookup MD5 and SHA1 hashes. This link will only return the results for SHA256.

On Security Analytics in your Administration > System > Context Menu Actions - Virustotal menu action, you may have configured:
{ 
"displayName": "Virustotal Hash",
"cssClasses": [
"ctxmenu-hash-lookup"
],
"description": "",
"type": "UAP.common.contextmenu.actions.URLContextAction",
"version": "1",
"modules": [
"investigation"
],
"local": "false",
"urlFormat": "https://www.virustotal.com/en/file/{0}/analysis/",
"disabled": "",
"id": "Virustotal Hash",
"moduleClasses": [
"UAP.investigation.reconstruction.view.content.ReconstructedEventDataGrid"
],
"openInNewTab": "true",
"order": "2"
}

 
ResolutionUpdate your virustotal context menu action with the correct urlFormat that will lookup MD5, SHA1, and SHA256.
 
{ 
"displayName": "Virustotal Hash",
"cssClasses": [
"ctxmenu-hash-lookup"
],
"description": "",
"type": "UAP.common.contextmenu.actions.URLContextAction",
"version": "1",
"modules": [
"investigation"
],
"local": "false",
"urlFormat": "https://www.virustotal.com/en/latest-scan/{0}",
"disabled": "",
"id": "Virustotal Hash",
"moduleClasses": [
"UAP.investigation.reconstruction.view.content.ReconstructedEventDataGrid"
],
"openInNewTab": "true",
"order": "2"
}

Referenced from https://www.virustotal.com/en/faq/#shortcuts

Attachments

    Outcomes