Automatic Hybrid-Analysis submission on by default?

[Still34]

I only just now noticed that SI now has an Hybrid-Analysis integration, and I want to double check the expected Hybrid Analysis scanning/automatic sample submission behavior. Is this supposed to be on by default? Judging by the code, I assume the default is supposed to be off - yet after re-checking numerous times with fresh installation the default seems to be on?

[jxy-s]

Thanks for double-checking this - your reading of the code is correct, and here's how it fits together with what you're seeing.

The code-level default is off, and the integration is not applied until you make a choice in the first-run "File reputation analysis" dialog (screenshot below). Nothing is scanned or submitted while that prompt is pending. The dialog discloses exactly what's shared with Hybrid-Analysis and offers two paths:

• Configure - opens the integration settings, where you can disable it and apply that choice.
• Keep enabled (or dismissing the dialog) - applies the recommended configuration, which has the integration enabled.

So on a fresh install where the dialog was accepted or dismissed, seeing it enabled afterward is expected behavior. If you'd prefer it off, choose Configure from the prompt, or change it at any time in the plugin options.

[Still34]

Thanks for the swift response - though from a UX stand point I would expect clicking Configure in the Partner Prompt would leave the settings as-is (i.e., the code-level default-off) when presented with the configuration screen.

[jxy-s]

Thanks for the swift response - though from a UX stand point I would expect clicking Configure in the Partner Prompt would leave the settings as-is (i.e., the code-level default-off) when presented with the configuration screen.

That's fair feedback, but the current behavior is intentional. The Configure screen is pre-populated with the recommended configuration - that is, it shows you exactly what would be applied if you had chosen "Keep enabled." From there you can disable whichever parts you don't want and apply your changes. Nothing takes effect until you do.

If Configure instead opened with everything in the code-level off state, the two paths out of the prompt would no longer line up: the dialog offers to "Keep enabled," but the settings screen would show everything disabled, leaving you to guess what the recommendation actually consists of and reconstruct it by hand if you only wanted to trim part of it. Showing the recommended state makes the choice concrete - you're looking at precisely what you'd be accepting, and opting out of specifics is a matter of unchecking them.