All in One Pipeline

All-in-One Pipeline

/analyze/all/<target> is the operator's "run everything" page — Static analysis plus every reachable EDR profile, dispatched in parallel from one click. The page itself is a progress shell; the orchestration lives entirely in JS, hitting the same backend endpoints the standalone analysis pages use. No new analyzer runs server-side.

---

What it does

┌──────────────────────────────────────────────────────────────────────┐
│ /analyze/all/<hash>                                                  │
│                                                                      │
│  Phase 0 — preflight                                                 │
│   GET /api/edr/agents/status   → which profiles are reachable        │
│                                                                      │
│  Phase 1 — fan out                                                   │
│   POST /analyze/static/<hash>           ─┐                           │
│   POST /analyze/edr/elastic/<hash>      ─┼─ all in parallel          │
│   POST /analyze/edr/fibratus/<hash>     ─┘                           │
│                                                                      │
│  Phase 2 — drain                                                     │
│   ↓ static returns sync — Phase 1 done                               │
│   ↓ each EDR returns Phase-1 dict → JS polls                         │
│       GET /api/results/edr/<profile>/<hash>                          │
│       until status != polling_alerts                                 │
│                                                                      │
│  Phase 3 — settle                                                    │
│   When everything is terminal: render summary +                      │
│   per-tool drill-down + open buttons to each saved-view page.        │
└──────────────────────────────────────────────────────────────────────┘

Dynamic analysis is intentionally not part of the all-in-one fan-out — it executes the payload locally on the LitterBox host, which conflicts with a parallel EDR dispatch (would taint the EDR run with local-LitterBox process noise). Run dynamic separately when needed.

---

Preflight

Before fanning out, the page calls /api/edr/agents/status and only includes profiles whose:

• Whiskers agent is reachable, AND
• backend is reachable (elastic_reachable: true for kind: elastic; fibratus_present: true for kind: fibratus)

A profile that fails preflight is rendered with a grayed-out "agent down" badge and skipped. This keeps a half-broken EDR fleet from blocking the static results.

---

Phase shell

The page renders one card per task:

Task	Endpoint	Initial state	Terminal state
Static analysis	POST /analyze/static/<hash>	running	completed / error
EDR profile A	POST /analyze/edr/A/<hash>	polling_alerts	completed / blocked_by_av / partial / agent_unreachable / busy / error
EDR profile B	POST /analyze/edr/B/<hash>	polling_alerts	(same set)
...	...	...	...

Each card has its own poll loop. EDR poll cadence is the same adaptive scheme used on the standalone EDR results page — 2s base, ×1.5 backoff up to 15s when no movement, snap back to 2s on alert-count change. Polling pauses on document.visibilityState === 'hidden' and resumes on visible.

---

Result aggregation

When every card hits a terminal state, the page emits a top-level summary band:

• Detection score — pulled fresh from /api/results/risk/<hash> (recomputed by the server now that all results are saved on disk).
• Total alerts across all EDR profiles — sum.
• Profiles with any detection — count.
• Profiles with high/critical alerts — count.

Below that, one "Open results" button per task, linking to:

• Static → /results/static/<hash>
• Each EDR profile → /results/edr/<profile>/<hash>

The detail rendering on those pages is exactly the same as if you'd run them standalone.

---

When to use it

The all-in-one pipeline is the default first move when you receive a payload. It maximizes signal-per-click — one fan-out gives you static yara/checkplz/stringnalyzer matches AND every reachable EDR's detection alerts in parallel.

Back-to-back dispatches don't queue: each EDR profile holds the Whiskers lock only for its own Phase-1 (typically 1–7 s); Phase-2 (alert correlation) runs unlocked, so two operators hitting the page on different samples can fan out at the same time.

---

What the all-in-one page is NOT

• It is not a separate analyzer — there's no new server code that runs only when you hit it. Same endpoints, same saved-JSON files. You can reach the same end state by hitting the standalone Static page and each EDR page in separate tabs.
• It is not automatic: each EDR profile must be set up first (see Elastic Defend Setup / Fibratus Setup). Profiles not in Config/edr_profiles/ simply don't appear on the page.
• It does not include dynamic analysis. Run /analyze/dynamic/<hash> separately if you need it — kicking it off in parallel with EDR dispatch produces tainted memory-scanner output.

---

See also

• EDR Integration — how Phase 1 / Phase 2 work
• Dashboard — /api/edr/agents/status is the same data the preflight uses
• HTTP API Reference — every endpoint the page hits
• Detection Score Explained — what bumps the score after the fan-out settles