{
  "name": "OrionMalware",
  "version": "1.0",
  "author": "Airbus Defence and Space Cyber",
  "url": "https://github.com/TheHive-Project/Cortex-Analyzers",
  "license": "AGPL-V3",
  "description": "Use OrionMalware API to analyze a File or find a hash match.",
  "dataTypeList": ["file", "hash"],
  "command": "OrionMalware/analyzer.py",
  "baseConfig": "OrionMalware",
  "config": {
      "service": "get_report"
  },
  "configurationItems": [
    {
      "name": "apikey",
      "description": "OrionMalware API key",
      "type": "string",
      "multi": false,
      "required": true
    },
    {
      "name": "url",
      "description": "OrionMalware API Base url. ex: https://my-omw-appliance.com ",
      "type": "string",
      "multi": false,
      "required": true
    },
    {
      "name": "force",
      "description": "Force re-analyze for this file even if OrionMalware found a matching existing report.",
      "type": "boolean",
      "multi": false,
      "required": true,
      "defaultValue": false
    },
    {
      "name": "safe",
      "description": "Orion Malware mapping from 'Safe' Risk to theHive severity level: default 'safe'.",
      "type": "string",
      "multi": false,
      "required": true,
      "defaultValue": "safe"
    },
    {
      "name": "low",
      "description": "Orion Malware mapping from 'Low' Risk to theHive severity level: default 'info'.",
      "type": "string",
      "multi": false,
      "required": true,
      "defaultValue": "info"
     },
     {
      "name": "medium",
      "description": "Orion Malware mapping from 'Medium' Risk to theHive severity level: default 'suspicious'.",
      "type": "string",
      "multi": false,
      "required": true,
      "defaultValue": "suspicious"
     },
     {
      "name": "high",
      "description": "Orion Malware mapping from 'High' Risk to theHive severity level: default 'malicious'.",
      "type": "string",
      "multi": false,
      "required": true,
      "defaultValue": "malicious"
     },
     {
      "name": "severe",
      "description": "Orion Malware mapping from 'Severe' Risk to theHive severity level: default 'malicious'.",
      "type": "string",
      "multi": false,
      "required": true,
      "defaultValue": "malicious"
     }
  ],
  "registration_required": true,
  "subscription_required": true,
  "free_subscription": false,
  "service_homepage": "https://cyber.airbus.com/fr/produits/orion-malware",
  "service_logo": {"path":"assets/airbus.png", "caption": "logo"},
  "screenshots": []
}