What can you do with the Hybrid Analysis integration?

LiveContext exposes 15 operations on Hybrid Analysis, covering overview, quick scan, report and sample. Common uses include finding every sample that contacted a suspicious domain, screening links at speed before deciding which to detonate and detonating a link from a reported phishing email in a sandbox.

LiveContext

All integrations

Hybrid Analysis integration

Hybrid Analysis malware analysis API built on Falcon Sandbox: look a file hash up to see whether it has already been detonated, search the corpus by filename, family, tag, verdict, network indicator or MITRE technique, read the aggregated overview of a sample across every analysis and scanner, submit a file or a URL for full detonation in a chosen sandbox environment, poll the state of a running analysis and read its report, run a fast lookup only scan, and check the quota left on the key.

15 toolsAPI keyAPI docs

Connect Hybrid Analysis How integrations work

Common Hybrid Analysis use cases

finding every sample that contacted a suspicious domain
screening links at speed before deciding which to detonate
detonating a link from a reported phishing email in a sandbox
waiting for a detonation to finish before reading its verdict
waiting for every scanner to answer before recording a verdict
checking there is quota left before submitting a batch of samples
checking why an expected scanner is missing from a quick scan result
refreshing the scanner verdicts of a sample analysed a long time ago
detonating an unknown attachment pulled from a reported phishing email
enriching a list of hashes with a verdict without pulling full reports

What you can do with Hybrid Analysis

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Overview, 3 operations

GETget_overview
Returns the aggregated Hybrid Analysis overview of one sample.
GETget_overview_summary
Returns a compact Hybrid Analysis overview of one sample.
GETrefresh_overview
Triggers a refresh of the external scanner data held for a sample.

Quick scan, 3 operations

GETget_quick_scan
Polls a Hybrid Analysis quick scan until every scanner has answered.
POSTquick_scan_file
Runs a fast Hybrid Analysis scan of a file instead of a full detonation.
POSTquick_scan_url
Runs a fast Hybrid Analysis scan of a URL instead of a full detonation.

Report, 2 operations

GETget_report_state
Polls a Hybrid Analysis job and reports whether the analysis has finished.
GETget_report_summary
Returns the verdict and behaviour summary of a finished Hybrid Analysis job.

Sample, 2 operations

GETsearch_hash
Checks whether Hybrid Analysis has already detonated a file hash.
POSTsearch_terms
Searches Hybrid Analysis samples by metadata, indicator or MITRE technique.

Submission, 2 operations

POSTsubmit_file
Submits a file to Hybrid Analysis for detonation and returns the job to poll.
POSTsubmit_url
Submits a URL to Hybrid Analysis for detonation and returns the job to poll.

Key, 1 operation

GETget_key_details
Returns the permission level and limits of the Hybrid Analysis API key.

Quota, 1 operation

GETget_submission_quota
Returns the remaining Hybrid Analysis submission quota of the key.

Scanner, 1 operation

GETlist_quick_scan_scanners
Lists which Hybrid Analysis quick scan engines are currently available.

Use Hybrid Analysis from Claude Code, Cursor or Codex

Connect Hybrid Analysis in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Hybrid Analysis operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Hybrid Analysis

Create your workspace
Sign up free. Nothing to install.
Connect Hybrid Analysis once
Add your Hybrid Analysis connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

Hybrid Analysis integration FAQ

What can you do with the Hybrid Analysis integration?: LiveContext exposes 15 operations on Hybrid Analysis, covering overview, quick scan, report and sample. Common uses include finding every sample that contacted a suspicious domain, screening links at speed before deciding which to detonate and detonating a link from a reported phishing email in a sandbox.