{"id":5050,"date":"2019-12-04T17:26:01","date_gmt":"2019-12-04T16:26:01","guid":{"rendered":"http:\/\/nextron.bsk-consulting.de\/?p=5050"},"modified":"2022-03-25T14:14:59","modified_gmt":"2022-03-25T13:14:59","slug":"asgard-analysis-cockpit-v2-8-with-sandbox-integration","status":"publish","type":"post","link":"https:\/\/www.nextron-systems.com\/2019\/12\/04\/asgard-analysis-cockpit-v2-8-with-sandbox-integration\/","title":{"rendered":"ASGARD Analysis Cockpit v2.8 with Sandbox Integration"},"content":{"rendered":"

[et_pb_section fb_built=”1″ _builder_version=”4.0.6″][et_pb_row column_structure=”2_5,3_5″ _builder_version=”4.0.6″][et_pb_column type=”2_5″ _builder_version=”4.0.6″][et_pb_text _builder_version=”4.0.6″]<\/p>\n

ASGARD Analysis Cockpit\u2019s new version 2.8.2 features an open API to interface with all major sandbox vendors.<\/p>\n

It ships with presets for Cuckoo Sandbox and even allows to connect multiple different sandboxes at the same time. \u00a0<\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”3_5″ _builder_version=”4.0.6″][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-04-at-15.55.42.png” _builder_version=”4.4.2″ hover_enabled=”0″][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”2_5,3_5″ _builder_version=”4.0.6″][et_pb_column type=”2_5″ _builder_version=”4.0.6″][et_pb_text _builder_version=”4.0.6″]<\/p>\n

Today users can configure THOR scans in the ASGARD Management Center that collect suspicious files with a given minimum score.<\/p>\n

(side note: a clever mechanism in Bifrost protocol v2 collects only files that have not been collected before)<\/p>\n

The new version of Analysis Cockpit will automatically receive these samples once it gets connected to an ASGARD Management Center.<\/span><\/p>\n

 <\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”3_5″ _builder_version=”4.0.6″][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-04-at-16.39.52.png” _builder_version=”4.4.2″ hover_enabled=”0″][\/et_pb_image][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-04-at-16.40.00.png” _builder_version=”4.4.2″ hover_enabled=”0″][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”2_5,3_5″ _builder_version=”4.0.6″][et_pb_column type=”2_5″ _builder_version=”4.0.6″][et_pb_text _builder_version=”4.0.6″]<\/p>\n

With a connected Sandbox, you can decide to send <all> incoming samples to Sandbox or drop only selected samples manually.\u00a0\u00a0<\/p>\n

Analysis Cockpit’s “Sandbox” section shows all collected samples, the affected hosts, hashes, filenames and other data in the “Files” tab.\u00a0<\/p>\n

 <\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”3_5″ _builder_version=”4.0.6″][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/11\/Screenshot-2019-11-29-at-17.05.52.png” _builder_version=”4.4.2″ hover_enabled=”0″][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”2_5,3_5″ _builder_version=”4.0.6″][et_pb_column type=”2_5″ _builder_version=”4.0.6″][et_pb_text _builder_version=”4.0.6″]<\/p>\n

The “Reports” tab contains results from each sandbox run.\u00a0<\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”3_5″ _builder_version=”4.0.6″][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/11\/Screenshot-2019-11-29-at-17.03.17.png” _builder_version=”4.4.2″ hover_enabled=”0″][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”2_5,3_5″ _builder_version=”4.0.6″][et_pb_column type=”2_5″ _builder_version=”4.0.6″][et_pb_text _builder_version=”4.0.6″]<\/p>\n

Each event in “Baselining” section shows an available sandbox report if a hash in the event matches with one of a sample that has been analyzed by the sandbox.\u00a0<\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”3_5″ _builder_version=”4.0.6″][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/12\/Screenshot-2019-12-04-at-17.18.43.png” _builder_version=”4.4.2″ hover_enabled=”0″][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”2_5,3_5″ _builder_version=”4.0.6″][et_pb_column type=”2_5″ _builder_version=”4.0.6″][et_pb_text _builder_version=”4.0.6″]<\/p>\n

The Analysis Cockpit API allows the retrieval of collected sample files and the upload of any type of report.\u00a0<\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”3_5″ _builder_version=”4.0.6″][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2019\/11\/Screenshot-2019-11-29-at-17.02.51.png” _builder_version=”4.4.2″ hover_enabled=”0″][\/et_pb_image][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"

ASGARD Analysis Cockpit\u2019s new version 2.8.2 features an open API to interface with all major sandbox vendors. It ships with presets for Cuckoo Sandbox and even allows to connect multiple different sandboxes at the same time. \u00a0Today users can configure THOR scans in the ASGARD Management Center that collect suspicious files with a given minimum score. (side note: a clever mechanism in Bifrost protocol v2 collects only files that have not been collected before) The new version of Analysis Cockpit will automatically receive these samples once it gets connected to an ASGARD Management Center.  With a connected Sandbox, you can decide to send <all> incoming samples to Sandbox or drop only selected samples manually.\u00a0\u00a0 Analysis Cockpit’s “Sandbox” section shows all collected samples, the affected hosts, hashes, filenames and other data in the “Files” tab.\u00a0  The “Reports” tab contains results from each sandbox run.\u00a0Each event in “Baselining” section shows an available sandbox report if a hash in the event matches with one of a sample that has been analyzed by the sandbox.\u00a0The Analysis Cockpit API allows the retrieval of collected sample files and the upload of any type of report.\u00a0<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[36,46],"tags":[90,76,165,124,218,217],"class_list":["post-5050","post","type-post","status-publish","format-standard","hentry","category-asgard-analysis-cockpit","category-newsletter","tag-analysis","tag-asgard","tag-collection","tag-malware","tag-sample","tag-sandbox"],"yoast_head":"\nASGARD Analysis Cockpit v2.8 with Sandbox Integration - Nextron Systems<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.nextron-systems.com\/2019\/12\/04\/asgard-analysis-cockpit-v2-8-with-sandbox-integration\/\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.nextron-systems.com\/2019\/12\/04\/asgard-analysis-cockpit-v2-8-with-sandbox-integration\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2019\/12\/04\/asgard-analysis-cockpit-v2-8-with-sandbox-integration\/\"},\"author\":{\"name\":\"Florian Roth\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\"},\"headline\":\"ASGARD Analysis Cockpit v2.8 with Sandbox Integration\",\"datePublished\":\"2019-12-04T16:26:01+00:00\",\"dateModified\":\"2022-03-25T13:14:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2019\/12\/04\/asgard-analysis-cockpit-v2-8-with-sandbox-integration\/\"},\"wordCount\":583,\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"keywords\":[\"analysis\",\"asgard\",\"collection\",\"malware\",\"sample\",\"sandbox\"],\"articleSection\":[\"ASGARD Analysis Cockpit\",\"Newsletter\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.nextron-systems.com\/2019\/12\/04\/asgard-analysis-cockpit-v2-8-with-sandbox-integration\/\",\"url\":\"https:\/\/www.nextron-systems.com\/2019\/12\/04\/asgard-analysis-cockpit-v2-8-with-sandbox-integration\/\",\"name\":\"ASGARD Analysis Cockpit v2.8 with Sandbox Integration - Nextron Systems\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#website\"},\"datePublished\":\"2019-12-04T16:26:01+00:00\",\"dateModified\":\"2022-03-25T13:14:59+00:00\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.nextron-systems.com\/2019\/12\/04\/asgard-analysis-cockpit-v2-8-with-sandbox-integration\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.nextron-systems.com\/#website\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"name\":\"Nextron Systems\",\"description\":\"We Detect Hackers\",\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.nextron-systems.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\",\"name\":\"Nextron Systems GmbH\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"contentUrl\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"width\":260,\"height\":260,\"caption\":\"Nextron Systems GmbH\"},\"image\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\",\"name\":\"Florian Roth\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"caption\":\"Florian Roth\"},\"description\":\"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.\",\"url\":\"https:\/\/www.nextron-systems.com\/author\/florian\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ASGARD Analysis Cockpit v2.8 with Sandbox Integration - Nextron Systems","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.nextron-systems.com\/2019\/12\/04\/asgard-analysis-cockpit-v2-8-with-sandbox-integration\/","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.nextron-systems.com\/2019\/12\/04\/asgard-analysis-cockpit-v2-8-with-sandbox-integration\/#article","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/2019\/12\/04\/asgard-analysis-cockpit-v2-8-with-sandbox-integration\/"},"author":{"name":"Florian Roth","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919"},"headline":"ASGARD Analysis Cockpit v2.8 with Sandbox Integration","datePublished":"2019-12-04T16:26:01+00:00","dateModified":"2022-03-25T13:14:59+00:00","mainEntityOfPage":{"@id":"https:\/\/www.nextron-systems.com\/2019\/12\/04\/asgard-analysis-cockpit-v2-8-with-sandbox-integration\/"},"wordCount":583,"publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"keywords":["analysis","asgard","collection","malware","sample","sandbox"],"articleSection":["ASGARD Analysis Cockpit","Newsletter"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.nextron-systems.com\/2019\/12\/04\/asgard-analysis-cockpit-v2-8-with-sandbox-integration\/","url":"https:\/\/www.nextron-systems.com\/2019\/12\/04\/asgard-analysis-cockpit-v2-8-with-sandbox-integration\/","name":"ASGARD Analysis Cockpit v2.8 with Sandbox Integration - Nextron Systems","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/#website"},"datePublished":"2019-12-04T16:26:01+00:00","dateModified":"2022-03-25T13:14:59+00:00","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.nextron-systems.com\/2019\/12\/04\/asgard-analysis-cockpit-v2-8-with-sandbox-integration\/"]}]},{"@type":"WebSite","@id":"https:\/\/www.nextron-systems.com\/#website","url":"https:\/\/www.nextron-systems.com\/","name":"Nextron Systems","description":"We Detect Hackers","publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.nextron-systems.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.nextron-systems.com\/#organization","name":"Nextron Systems GmbH","url":"https:\/\/www.nextron-systems.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","contentUrl":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","width":260,"height":260,"caption":"Nextron Systems GmbH"},"image":{"@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919","name":"Florian Roth","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","caption":"Florian Roth"},"description":"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.","url":"https:\/\/www.nextron-systems.com\/author\/florian\/"}]}},"_links":{"self":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/5050","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/comments?post=5050"}],"version-history":[{"count":10,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/5050\/revisions"}],"predecessor-version":[{"id":7208,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/5050\/revisions\/7208"}],"wp:attachment":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/media?parent=5050"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/categories?post=5050"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/tags?post=5050"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}