Configuring the SMAP Sandbox Connector

The SMAP Sandbox connector integrates Seqrite XDR with the Seqrite Malware Analysis Platform (SMAP). It enables users to submit suspicious files for analysis and review the verdict returned by SMAP.

This action is available to users with the SOC, Super Admin, and Analyst roles.

Prerequisites

Before configuring the SMAP Sandbox connector, ensure that the following requirements are met:

• Ensure that you have a valid SMAP license that authorizes access to the Seqrite Malware Analysis Platform and its API.
• Ensure that you have the required permissions to configure connectors in the XDR console.
• Obtain the SMAP API endpoint URL.
• Generate or retrieve the API key from your SMAP account.

Obtaining the SMAP API Key

To obtain the API key, perform the following steps:

1. Log on to the SMAP portal.
2. Open your user profile.
3. Select API Key.
4. Copy the API key for use in the XDR console.

Configuring the SMAP Sandbox Connector

1. Log on to the XDR web console.
2. Go to XDR > Connectors > Enrichment > SMAP Sandbox.
3. Open the connector configuration options.
4. Enter the SMAP API URL and API key in the respective fields.
5. Click Validate & Save to validate the connection and save the configuration.

Submitting Files to SMAP for Analysis

You can submit suspicious files associated with an alert to SMAP for analysis.

1. Go to Alerts and open the required alert.
2. Open Alert Details.
3. Under Remediation, select Send to SMAP.
4. Review the analysis verdict returned by SMAP.

Limitations and Restrictions

Observe the following restrictions when submitting files to SMAP:

• Maximum file size: 128 MB.
• Minimum sensor version: 3.4 or later.
• Signed processes: Files associated with binary-signed processes cannot be submitted.
• Analysis verdicts: SMAP can return verdicts such as Ransomware, Malware, Suspicious, Unknown, and Clean Files.