Note: Magic Links are only available for Private Cloud customers. All samples submitted to the public Triage instance (https://tria.ge) are accessible without an account.
Introduction
It’s often useful to be able to share analysis reports with people outside of your organisation, without having to grant complete access to your Triage instance. Whether it is to share in blogposts, use in shared ticketing systems, or just for internal reports, we want to make it as easy as possible for you to get information where it needs to be.
To facilitate this, we have added a feature to Triage called Magic Links. When enabled for an Organisation users can access shareable links which allow the final analysis report to be viewed without any requirement to be signed in to an account.
In this short blogpost, we’ll quickly show how to enable and make use of this new feature.
What do they do?
Magic Links allow anyone with the link to view the analysis report. However they have limited access compared to a registered user and are only able to view the report itself, with the information returned by signatures and configuration extractors. The restrictions include:
- Cannot access file downloads such as the original sample, dropped files, PCAPs etc.
- Cannot view the Live Replay
- Cannot use the Analysis Log views to search/view detailed event information
These restrictions are intended to enable the sharing of reports while limiting the risk of exposing sensitive information.
You can view the example shown above using this Magic Link.
How to Enable Magic Links
If you are a Private Cloud user, those with Administrator access within the Organization can enable Magic Links through the “Organization” menu tab. Select “Organization” then “Settings” and you will see a view as shown below.
Enabling the toggle highlighting above will make Magic Links available for each analysis related to the Organization. They can be found in the sidebar menu on the left of each analysis report (when signed in).
And that’s it! You’re now ready to use Magic Links in your Triage instance
If you have any questions or issues with this system, feel free to get in touch. You can reach us directly through the website, on Twitter, or using the Feedback option on an analysis report page.