Need help for Hybrid Analysis Automatisation

[r_buchwalder]

Hello

We do use Hybrid Analysis to check URLs.

Is anyone here, who can tell me how to read the results?

For scanned URLs we get on Hybrid Analysis Website a "no specific result", "suspicious" or "malicious" as result.

But I do not see those results in any Output of the automation. Only from third-Party scanners - but the result of Hybrid Analysis I can't see.

I expect something like HybridAnalysis.URL.Verdict = suspicious

Does anyone get any clue, how I get a proper result?

thanks

roger

[r_buchwalder]

I do have here an example:

There is no "no specific threat" written, even no inidcator what Hybrid Analysis found - only 2nd party verdicts...

Task Results tab:

Task outputs tab:

DBotScore
{
	"Indicator": "http://daniele.alfano.mytripmyroom.com/",
	"Score": 1,
	"Type": "URL",
	"Vendor": "Hybrid Analysis"
}
HybridAnalysis.URL
{
	"Finished": true,
	"SHA256": "a60cde1373f99eb9e794f59922ab11d0f00dc4ec957041c65f6f1fa24ea45879",
	"ScanID": "6130c90541b51d7bb72f9be1",
	"Scanner": [
		{
			"Name": "VirusTotal",
			"Positives": null,
			"Status": "no-result"
		},
		{
			"Name": "urlscan.io",
			"Positives": null,
			"Status": "no-classification"
		}
	]
}
URL
{
	"Data": "http://daniele.alfano.mytripmyroom.com/"
}

If you visit Hybrid Analysis Website, you'll see:

where is Hybrid Analysis' Verdict in that Task?

thanks

roger