--- title: Reversinglabs A1000 slug: connectors/reversinglabs-a1000 docTags: createdAt: 2026-06-09T16:30:10.116Z --- This connector intgrates ReversingLabs A1000 module API and Python SDK with Swimlane Turbine. ## Prerequisites This connector requires either an API Key or Username and Password for authentication. ## Capabilities This connector suppports the following tasks: - Advanced Search V2 - Get Classification V3 - Get Detailed Report V2 - Get Submitted URL Report - Get Summary Report V2 - Get Titanium Core Report V2 - Network Domain Report - Network Files from IP - Network IP Address Report - Network IP to Domain - Network URL Report - Network URLs from IP - Upload Sample from File - Upload Sample from URL # Configurations ## API Token Authentication Authenticates using an API Token ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | api-token | API Token | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | ## Oauth 2.0 Password Grant Authenticates using oauth 2.0 password credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ---------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token\_url | | string | Optional | | oauth2\_username | The username for authentication | string | Required | | oauth2\_password | The password for authentication | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Advanced Search V2 Sends a query string to the A1000 Advanced Search API v2. ### Endpoint - **URL:** `/api/samples/v2/search/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | -------------------------------- | | `query` | string | Optional | Parameter for Advanced Search V2 | | `ticloud` | boolean | Optional | Parameter for Advanced Search V2 | | `page` | number | Optional | Parameter for Advanced Search V2 | | `records_per_page` | number | Optional | Parameter for Advanced Search V2 | | `sort` | string | Optional | Parameter for Advanced Search V2 | ### Input Example `{"json_body":{"query":"firstseen:2018-01-01T00:00:00Z (av-detection:trojan AND type:binary NOT positives:[* TO 3])","ticloud":false,"page":1,"records_per_page":10,"sort":"firstseen desc"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `rl` | object | Output field: rl | | `rl.web_search_api` | object | Output field: rl.web\_search\_api | | `rl.web_search_api.total_count` | number | Count value | | `rl.web_search_api.next_page` | number | Output field: rl.web\_search\_api.next\_page | | `rl.web_search_api.more_pages` | boolean | Output field: rl.web\_search\_api.more\_pages | | `rl.web_search_api.sample_count` | number | Count value | | `rl.web_search_api.entries` | array | Output field: rl.web\_search\_api.entries | ### Output Example `{"status_code":200,"response_headers":{"Connection":"keep-alive","Content-Length":"1272","cache-control":"max-age=0, no-cache, no-store, must-revalidate, private","content-security-policy":"default-src wss://*.hotjar.com https: data: blob: 'unsafe-inline' 'unsafe-eval'","server":"nginx","content-encoding":"gzip","x-xss-protection":"1; mode=block","expect-ct":"enforce, max-age=7776000","accept-ranges":"bytes","expires":"Mon, 09 Oct 2023 06:52:36 GMT","x-content-type-options":"nosniff, nosniff","v...` ## Get Classification V3 Get classification for one sample ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------- | | `sample_hash` | string | Required | Parameter for Get Classification V3 | | `local_only` | boolean | Optional | Parameter for Get Classification V3 | | `av_scanners` | boolean | Optional | Parameter for Get Classification V3 | ### Input Example `{"sample_hash":"de6a74c6f259bd6e2eb5e725d9b37359ed129565","local_only":false,"av_scanners":false}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ----------------------------------------- | | `json` | object | Output field: json | | `json.classification` | string | Output field: json.classification | | `json.riskscore` | number | Score value | | `json.first_seen` | string | Output field: json.first\_seen | | `json.last_seen` | string | Output field: json.last\_seen | | `json.classification_result` | string | Result of the operation | | `json.classification_reason` | string | Response reason phrase | | `json.classification_origin` | object | Output field: json.classification\_origin | | `json.cloud_last_lookup` | string | Output field: json.cloud\_last\_lookup | | `json.data_source` | string | Response data | | `json.sha1` | string | Output field: json.sha1 | | `json.sha256` | string | Output field: json.sha256 | | `json.md5` | string | Output field: json.md5 | ### Output Example `{"json":{"classification":"malicious","riskscore":10,"first_seen":"2020-01-22T19:20:00Z","last_seen":"2022-07-13T05:08:32Z","classification_result":"Win32.Worm.Mira","classification_reason":"Antivirus","classification_origin":null,"cloud_last_lookup":"2023-10-08T10:50:18Z","data_source":"LOCAL","sha1":"2efae02ecb7cfc279b704ac102763e6d184e26b0","sha256":"de7b7d7084069ac1a093ae67044765dc2b02d36e9e3101dc9dc75f29ca00d26a","md5":"76d5338503dcb59cb4449be24654ebca"}}` ## Get Detailed Report V2 Accepts a single hash or a list of hashes and returns a detailed analysis report for the selected samples. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------------------------- | | `sample_hashes` | array | Required | Parameter for Get Detailed Report V2 | | `retry` | boolean | Optional | Parameter for Get Detailed Report V2 | | `fields` | string | Optional | Comma-separated list of report fields to include in the response. | | `skip_reanalysis` | boolean | Optional | Parameter for Get Detailed Report V2 | ### Input Example `{"sample_hashes":["2efae02ecb7cfc279b704ac102763e6d184e26b0"],"retry":true,"fields":"id,sha1,sha256,sha512","skip_reanalysis":false}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | --------------------------- | | `json` | object | Output field: json | | `json.count` | number | Count value | | `json.next` | object | Output field: json.next | | `json.previous` | object | Output field: json.previous | | `json.results` | array | Result of the operation | | `json.results.aliases` | array | Result of the operation | | `json.results.category` | string | Result of the operation | | `json.results.classification` | string | Result of the operation | | `json.results.classification_origin` | object | Result of the operation | | `json.results.classification_reason` | string | Response reason phrase | | `json.results.classification_result` | string | Result of the operation | | `json.results.classification_source` | number | Result of the operation | | `json.results.extracted_file_count` | number | Result of the operation | | `json.results.file_size` | number | Result of the operation | | `json.results.file_subtype` | string | Type of the resource | | `json.results.file_type` | string | Type of the resource | | `json.results.id` | number | Unique identifier | | `json.results.identification_name` | string | Unique identifier | | `json.results.identification_version` | string | Unique identifier | | `json.results.local_first_seen` | string | Result of the operation | | `json.results.local_last_seen` | string | Result of the operation | | `json.results.md5` | string | Result of the operation | | `json.results.riskscore` | number | Result of the operation | | `json.results.sha1` | string | Result of the operation | | `json.results.sha256` | string | Result of the operation | ### Output Example `{"json":{"count":1,"next":null,"previous":null,"results":[{}]}}` ## Get Submitted URL Report Accepts a task id returned by `Upload Sample from URL` and returns a response containing processing status and report if the report is ready. ### Endpoint - **URL:** `/api/uploads/v2/url-samples/{{task_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | -------------------------------------------------- | | `path_parameters.task_id` | string | Required | Parameters for the Get Submitted URL Report action | ### Input Example `{"path_parameters":{"task_id":"1234"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Connection":"keep-alive","Content-Length":"1272","cache-control":"max-age=0, no-cache, no-store, must-revalidate, private","content-security-policy":"default-src wss://*.hotjar.com https: data: blob: 'unsafe-inline' 'unsafe-eval'","server":"nginx","content-encoding":"gzip","x-xss-protection":"1; mode=block","expect-ct":"enforce, max-age=7776000","accept-ranges":"bytes","expires":"Mon, 09 Oct 2023 06:52:36 GMT","x-content-type-options":"nosniff, nosniff","v...` ## Get Summary Report V2 Accepts a single hash or a list of hashes and returns JSON containing a summary report for each of them. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | ----------------------------------------------------------------- | | `sample_hashes` | array | Required | Parameter for Get Summary Report V2 | | `retry` | boolean | Optional | Parameter for Get Summary Report V2 | | `skip_reanalysis` | boolean | Optional | Parameter for Get Summary Report V2 | | `fields` | string | Optional | Comma-separated list of report fields to include in the response. | | `include_networkthreatintelligence` | boolean | Optional | Parameter for Get Summary Report V2 | ### Input Example `{"sample_hashes":["2efae02ecb7cfc279b704ac102763e6d184e26b0"],"retry":true,"skip_reanalysis":false,"fields":"id, sha1, sha256","include_networkthreatintelligence":true}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | --------------------------- | | `json` | object | Output field: json | | `json.count` | number | Count value | | `json.next` | object | Output field: json.next | | `json.previous` | object | Output field: json.previous | | `json.results` | array | Result of the operation | | `json.results.aliases` | array | Result of the operation | | `json.results.category` | string | Result of the operation | | `json.results.classification` | string | Result of the operation | | `json.results.classification_origin` | object | Result of the operation | | `json.results.classification_reason` | string | Response reason phrase | | `json.results.classification_result` | string | Result of the operation | | `json.results.classification_source` | number | Result of the operation | | `json.results.extracted_file_count` | number | Result of the operation | | `json.results.file_size` | number | Result of the operation | | `json.results.file_subtype` | string | Type of the resource | | `json.results.file_type` | string | Type of the resource | | `json.results.id` | number | Unique identifier | | `json.results.identification_name` | string | Unique identifier | | `json.results.identification_version` | string | Unique identifier | | `json.results.local_first_seen` | string | Result of the operation | | `json.results.local_last_seen` | string | Result of the operation | | `json.results.md5` | string | Result of the operation | | `json.results.riskscore` | number | Result of the operation | | `json.results.sha1` | string | Result of the operation | | `json.results.sha256` | string | Result of the operation | ### Output Example `{"json":{"count":1,"next":null,"previous":null,"results":[{}]}}` ## Get Titanium Core Report V2 Accepts a single hash string and gets the full TitaniumCore static analysis report for the requested sample. The requested sample must be present on the appliance. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------------------- | | `sample_hash` | string | Required | Parameter for Get Titanium Core Report V2 | | `fields` | string | Optional | A string of comma separated TitaniumCore 'fields' to query. | ### Input Example `{"sample_hash":"2efae02ecb7cfc279b704ac102763e6d184e26b0","fields":"id, sha1, sha256"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------- | -------- | ------------------------------------------------ | | `json` | object | Output field: json | | `json.application` | object | Output field: json.application | | `json.attack` | array | Output field: json.attack | | `json.attack.file_name` | string | Name of the resource | | `json.attack.file` | string | Output field: json.attack.file | | `json.behaviour` | object | Output field: json.behaviour | | `json.certificate` | object | Output field: json.certificate | | `json.classification` | object | Output field: json.classification | | `json.classification.propagated` | boolean | Output field: json.classification.propagated | | `json.classification.classification` | number | Output field: json.classification.classification | | `json.classification.factor` | number | Output field: json.classification.factor | | `json.classification.result` | string | Result of the operation | | `json.classification.scan_results` | array | Result of the operation | | `json.classification.scan_results.ignored` | boolean | Result of the operation | | `json.classification.scan_results.type` | number | Type of the resource | | `json.classification.scan_results.classification` | number | Result of the operation | | `json.classification.scan_results.factor` | number | Result of the operation | | `json.classification.scan_results.name` | string | Name of the resource | | `json.classification.scan_results.version` | string | Result of the operation | | `json.classification.scan_results.result` | string | Result of the operation | | `json.document` | object | Output field: json.document | | `json.email` | object | Output field: json.email | | `json.imphash` | string | Output field: json.imphash | | `json.indicators` | array | Output field: json.indicators | | `json.indicators.file_name` | string | Name of the resource | ### Output Example `{"json":{"application":{},"attack":[],"behaviour":{},"certificate":{},"classification":{"propagated":false,"classification":3,"factor":10,"result":"Win32.Worm.Mira","scan_results":[]},"document":{},"email":{},"imphash":"","indicators":[],"info":{"statistics":{},"file":{},"identification":{},"unpacking":{},"properties":[]},"interesting_strings":[],"md5":"76d5338503dcb59cb4449be24654ebca","media":{},"mobile":{},"protection":{}}}` ## Network Domain Report Accepts a domain string and returns a report about the requested domain. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------- | | `domain` | string | Required | Parameter for Network Domain Report | ### Input Example `{"domain":"www.swimlane.com"}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------------- | -------- | ------------------------------------------------------------------ | | `json` | object | Output field: json | | `json.last_dns_records` | array | Output field: json.last\_dns\_records | | `json.last_dns_records.type` | string | Type of the resource | | `json.last_dns_records.value` | string | Value for the parameter | | `json.last_dns_records.provider` | string | Unique identifier | | `json.last_dns_records_time` | string | Time value | | `json.third_party_reputations` | object | Output field: json.third\_party\_reputations | | `json.third_party_reputations.sources` | array | Output field: json.third\_party\_reputations.sources | | `json.third_party_reputations.sources.detection` | string | Output field: json.third\_party\_reputations.sources.detection | | `json.third_party_reputations.sources.source` | string | Output field: json.third\_party\_reputations.sources.source | | `json.third_party_reputations.sources.update_time` | string | Time value | | `json.third_party_reputations.sources.detect_time` | string | Time value | | `json.third_party_reputations.statistics` | object | Output field: json.third\_party\_reputations.statistics | | `json.third_party_reputations.statistics.total` | number | Output field: json.third\_party\_reputations.statistics.total | | `json.third_party_reputations.statistics.malicious` | number | Output field: json.third\_party\_reputations.statistics.malicious | | `json.third_party_reputations.statistics.undetected` | number | Output field: json.third\_party\_reputations.statistics.undetected | | `json.third_party_reputations.statistics.clean` | number | Output field: json.third\_party\_reputations.statistics.clean | | `json.top_threats` | array | Output field: json.top\_threats | | `json.top_threats.threat_name` | string | Name of the resource | | `json.top_threats.files_count` | number | Count value | | `json.top_threats.risk_score` | number | Score value | | `json.modified_time` | string | Time value | | `json.downloaded_files_statistics` | object | Output field: json.downloaded\_files\_statistics | | `json.downloaded_files_statistics.unknown` | number | Output field: json.downloaded\_files\_statistics.unknown | | `json.downloaded_files_statistics.suspicious` | number | Output field: json.downloaded\_files\_statistics.suspicious | ### Output Example `{"json":{"last_dns_records":[{}],"last_dns_records_time":"2023-10-09T08:51:25","third_party_reputations":{"sources":[],"statistics":{}},"top_threats":[{"threat_name":"Document-HTML.Trojan.FakeComments","files_count":1,"risk_score":10},{"threat_name":"Document-PDF.Phishing.Generic","files_count":1,"risk_score":10},{"threat_name":"Document-HTML.Phishing.Generic","files_count":1,"risk_score":10}],"modified_time":"2023-10-09T08:51:38","downloaded_files_statistics":{"unknown":108,"suspicious":0,"tota...` ## Network Files from IP Accepts an IP address string and returns a list of hashes and classifications for files found on the requested IP address. ### Endpoint - **URL:** `/api/network-threat-intel/ip/{{ip}}/downloaded_files/` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ----------------------------------------------- | | `path_parameters.ip` | string | Required | Parameters for the Network Files from IP action | | `parameters.page` | string | Optional | SHA for next page to be displayed. | | `parameters.page_size` | number | Optional | Parameters for the Network Files from IP action | | `parameters.extended` | boolean | Optional | Parameters for the Network Files from IP action | | `parameters.classification` | string | Optional | Parameters for the Network Files from IP action | ### Input Example `{"parameters":{"page":"0083a1c9ddb79e9d7d4cd331050d62531c06d702","page_size":10,"extended":false,"classification":"MALICIOUS"},"path_parameters":{"ip":"192.168.3.10"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | ------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `next_page` | string | Output field: next\_page | | `downloaded_files` | array | Output field: downloaded\_files | | `downloaded_files.sha1` | string | Output field: downloaded\_files.sha1 | | `downloaded_files.last_download_url` | string | URL endpoint for the request | | `downloaded_files.classification` | string | Output field: downloaded\_files.classification | | `downloaded_files.first_download` | string | Output field: downloaded\_files.first\_download | | `downloaded_files.last_seen` | string | Output field: downloaded\_files.last\_seen | | `downloaded_files.sample_size` | number | Output field: downloaded\_files.sample\_size | | `downloaded_files.sample_available` | boolean | Output field: downloaded\_files.sample\_available | | `downloaded_files.last_download` | string | Output field: downloaded\_files.last\_download | | `downloaded_files.first_seen` | string | Output field: downloaded\_files.first\_seen | | `downloaded_files.sha256` | string | Output field: downloaded\_files.sha256 | | `downloaded_files.md5` | string | Output field: downloaded\_files.md5 | | `downloaded_files.risk_score` | number | Score value | | `downloaded_files.sample_type` | string | Type of the resource | | `downloaded_files.threat_name` | object | Name of the resource | | `downloaded_files.malware_family` | object | Output field: downloaded\_files.malware\_family | | `downloaded_files.malware_type` | object | Type of the resource | | `downloaded_files.platform` | object | Output field: downloaded\_files.platform | | `downloaded_files.subplatform` | object | Output field: downloaded\_files.subplatform | | `requested_ip` | string | Output field: requested\_ip | ### Output Example `{"status_code":200,"response_headers":{"Connection":"keep-alive","Content-Length":"576","cache-control":"max-age=0, no-cache, no-store, must-revalidate, private","content-security-policy":"default-src wss://*.hotjar.com https: data: blob: 'unsafe-inline' 'unsafe-eval'","server":"nginx","content-encoding":"gzip","x-xss-protection":"1; mode=block","expect-ct":"enforce, max-age=7776000","accept-ranges":"bytes","expires":"Mon, 09 Oct 2023 10:23:38 GMT","x-content-type-options":"nosniff, nosniff","vi...` ## Network IP Address Report Accepts an IP address string and returns a report about the requested IP address. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------------- | | `ip_addr` | string | Required | Parameter for Network IP Address Report | ### Input Example `{"ip_addr":"8.8.8.8"}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------------- | -------- | ------------------------------------------------------------------ | | `json` | object | Output field: json | | `json.third_party_reputations` | object | Output field: json.third\_party\_reputations | | `json.third_party_reputations.statistics` | object | Output field: json.third\_party\_reputations.statistics | | `json.third_party_reputations.statistics.total` | number | Output field: json.third\_party\_reputations.statistics.total | | `json.third_party_reputations.statistics.malicious` | number | Output field: json.third\_party\_reputations.statistics.malicious | | `json.third_party_reputations.statistics.undetected` | number | Output field: json.third\_party\_reputations.statistics.undetected | | `json.third_party_reputations.statistics.clean` | number | Output field: json.third\_party\_reputations.statistics.clean | | `json.third_party_reputations.sources` | array | Output field: json.third\_party\_reputations.sources | | `json.third_party_reputations.sources.detection` | string | Output field: json.third\_party\_reputations.sources.detection | | `json.third_party_reputations.sources.update_time` | string | Time value | | `json.third_party_reputations.sources.detect_time` | object | Time value | | `json.third_party_reputations.sources.category` | object | Output field: json.third\_party\_reputations.sources.category | | `json.third_party_reputations.sources.source` | string | Output field: json.third\_party\_reputations.sources.source | | `json.downloaded_files_statistics` | object | Output field: json.downloaded\_files\_statistics | | `json.downloaded_files_statistics.total` | number | Output field: json.downloaded\_files\_statistics.total | | `json.downloaded_files_statistics.unknown` | number | Output field: json.downloaded\_files\_statistics.unknown | | `json.downloaded_files_statistics.suspicious` | number | Output field: json.downloaded\_files\_statistics.suspicious | | `json.downloaded_files_statistics.malicious` | number | Output field: json.downloaded\_files\_statistics.malicious | | `json.downloaded_files_statistics.goodware` | number | Output field: json.downloaded\_files\_statistics.goodware | | `json.top_threats` | array | Output field: json.top\_threats | | `json.top_threats.file_name` | string | Name of the resource | | `json.top_threats.file` | string | Output field: json.top\_threats.file | | `json.requested_ip` | string | Output field: json.requested\_ip | | `json.modified_time` | string | Time value | ### Output Example `{"json":{"third_party_reputations":{"statistics":{},"sources":[]},"downloaded_files_statistics":{"total":1776,"unknown":1,"suspicious":0,"malicious":0,"goodware":1775},"top_threats":[],"requested_ip":"8.8.8.8","modified_time":"2023-10-09T08:30:46"}}` ## Network IP to Domain Accepts an IP address string and returns a list of IP-to-domain mappings. ### Endpoint - **URL:** `/api/network-threat-intel/ip/{{ip}}/resolutions/` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ---------------------------------------------- | | `path_parameters.ip` | string | Required | Parameters for the Network IP to Domain action | | `parameters.page` | string | Optional | SHA for next page to be displayed. | | `parameters.page_size` | number | Optional | Parameters for the Network IP to Domain action | ### Input Example `{"parameters":{"page":"0083a1c9ddb79e9d7d4cd331050d62531c06d702","page_size":10},"path_parameters":{"ip":"192.168.3.10"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `next_page` | object | Output field: next\_page | | `resolutions` | array | Output field: resolutions | | `resolutions.provider` | string | Unique identifier | | `resolutions.last_resolution_time` | string | Time value | | `resolutions.host_name` | string | Name of the resource | | `requested_ip` | string | Output field: requested\_ip | ### Output Example `{"status_code":200,"response_headers":{"Connection":"keep-alive","Content-Length":"813","cache-control":"max-age=0, no-cache, no-store, must-revalidate, private","content-security-policy":"default-src wss://*.hotjar.com https: data: blob: 'unsafe-inline' 'unsafe-eval'","server":"nginx","content-encoding":"gzip","x-xss-protection":"1; mode=block","expect-ct":"enforce, max-age=7776000","accept-ranges":"bytes","expires":"Mon, 09 Oct 2023 10:34:49 GMT","x-content-type-options":"nosniff, nosniff","vi...` ## Network URL Report Accepts a URL string and returns a report about the requested URL. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ---------------------------- | | `requested_url` | string | Optional | URL endpoint for the request | ### Input Example `{"requested_url":"www.google.com"}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------------- | -------- | ------------------------------------------------------------------ | | `json` | object | Output field: json | | `json.third_party_reputations` | object | Output field: json.third\_party\_reputations | | `json.third_party_reputations.sources` | array | Output field: json.third\_party\_reputations.sources | | `json.third_party_reputations.sources.detection` | string | Output field: json.third\_party\_reputations.sources.detection | | `json.third_party_reputations.sources.source` | string | Output field: json.third\_party\_reputations.sources.source | | `json.third_party_reputations.sources.update_time` | string | Time value | | `json.third_party_reputations.statistics` | object | Output field: json.third\_party\_reputations.statistics | | `json.third_party_reputations.statistics.total` | number | Output field: json.third\_party\_reputations.statistics.total | | `json.third_party_reputations.statistics.malicious` | number | Output field: json.third\_party\_reputations.statistics.malicious | | `json.third_party_reputations.statistics.clean` | number | Output field: json.third\_party\_reputations.statistics.clean | | `json.third_party_reputations.statistics.undetected` | number | Output field: json.third\_party\_reputations.statistics.undetected | | `json.reason` | string | Response reason phrase | | `json.classification` | string | Output field: json.classification | | `json.analysis` | object | Output field: json.analysis | | `json.analysis.analysis_history` | array | Output field: json.analysis.analysis\_history | | `json.analysis.analysis_history.domain` | string | Output field: json.analysis.analysis\_history.domain | | `json.analysis.analysis_history.final_url` | string | URL endpoint for the request | | `json.analysis.analysis_history.http_response_code` | number | Output field: json.analysis.analysis\_history.http\_response\_code | | `json.analysis.analysis_history.analysis_id` | string | Unique identifier | | `json.analysis.analysis_history.availability_status` | string | Status value | | `json.analysis.analysis_history.serving_ip_address` | string | Output field: json.analysis.analysis\_history.serving\_ip\_address | | `json.analysis.analysis_history.analysis_time` | string | Time value | | `json.analysis.last_analysis` | object | Output field: json.analysis.last\_analysis | | `json.analysis.last_analysis.domain` | string | Output field: json.analysis.last\_analysis.domain | | `json.analysis.last_analysis.final_url` | string | URL endpoint for the request | ### Output Example `{"json":{"third_party_reputations":{"sources":[],"statistics":{}},"reason":"whitelist","classification":"goodware","analysis":{"analysis_history":[],"last_analysis":{},"first_analysis":"2023-10-02T12:31:04","analysis_count":6280,"statistics":{}},"requested_url":"www.google.com"}}` ## Network URLs from IP Accepts an IP address string and returns a list of URLs hosted on the requested IP address. ### Endpoint - **URL:** `/api/network-threat-intel/ip/{{ip}}/urls/` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ---------------------------------------------- | | `path_parameters.ip` | string | Required | Parameters for the Network URLs from IP action | | `parameters.page` | string | Optional | SHA for next page to be displayed. | | `parameters.page_size` | number | Optional | Parameters for the Network URLs from IP action | ### Input Example `{"parameters":{"page":"0083a1c9ddb79e9d7d4cd331050d62531c06d702","page_size":10},"path_parameters":{"ip":"192.168.3.10"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `next_page` | object | Output field: next\_page | | `urls` | array | URL endpoint for the request | | `urls.url` | string | URL endpoint for the request | | `requested_ip` | string | Output field: requested\_ip | ### Output Example `{"status_code":200,"response_headers":{"Connection":"keep-alive","Content-Length":"4376","cache-control":"max-age=0, no-cache, no-store, must-revalidate, private","content-security-policy":"default-src wss://*.hotjar.com https: data: blob: 'unsafe-inline' 'unsafe-eval'","server":"nginx","content-encoding":"gzip","x-xss-protection":"1; mode=block","expect-ct":"enforce, max-age=7776000","accept-ranges":"bytes","expires":"Mon, 09 Oct 2023 10:41:15 GMT","x-content-type-options":"nosniff, nosniff","v...` ## Upload Sample from File Accepts a file and returns a response containing the analysis task ID. ### Endpoint - **URL:** `/api/uploads/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ------------------------------------ | | `form_data` | object | Required | Response data | | `form_data.file` | object | Required | Binary file that you want to submit. | | `form_data.file.file` | string | Required | Response data | | `form_data.file.file_name` | string | Required | Response data | | `form_data.archive_password` | string | Optional | Response data | | `form_data.rl_cloud_sandbox_platform` | string | Optional | Response data | | `form_data.comment` | string | Optional | Response data | | `form_data.tags` | string | Optional | Response data | | `form_data.analysis` | string | Optional | Response data | ### Input Example `{"form_data":{"file":{"file":"string","file_name":"Example Name"},"archive_password":"string","rl_cloud_sandbox_platform":"string","comment":"string","tags":"string","analysis":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `detail` | object | Output field: detail | | `detail.id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Connection":"keep-alive","Content-Length":"1272","cache-control":"max-age=0, no-cache, no-store, must-revalidate, private","content-security-policy":"default-src wss://*.hotjar.com https: data: blob: 'unsafe-inline' 'unsafe-eval'","server":"nginx","content-encoding":"gzip","x-xss-protection":"1; mode=block","expect-ct":"enforce, max-age=7776000","accept-ranges":"bytes","expires":"Mon, 09 Oct 2023 06:52:36 GMT","x-content-type-options":"nosniff, nosniff","v...` ## Upload Sample from URL Accepts a url and returns a response containing the analysis task ID. ### Endpoint - **URL:** `/api/uploads/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | --------------- | | `data_body` | object | Required | Response data | | `data_body.url` | string | Required | Response data | | `data_body.archive_password` | string | Optional | Response data | | `data_body.rl_cloud_sandbox_platform` | string | Optional | Response data | | `data_body.crawler` | string | Optional | Response data | ### Input Example `{"data_body":{"url":"www.example.com","archive_password":"somerandompassword","rl_cloud_sandbox_platform":"windows10","crawler":"local"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `detail` | object | Output field: detail | | `detail.id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Connection":"keep-alive","Content-Length":"1272","cache-control":"max-age=0, no-cache, no-store, must-revalidate, private","content-security-policy":"default-src wss://*.hotjar.com https: data: blob: 'unsafe-inline' 'unsafe-eval'","server":"nginx","content-encoding":"gzip","x-xss-protection":"1; mode=block","expect-ct":"enforce, max-age=7776000","accept-ranges":"bytes","expires":"Mon, 09 Oct 2023 06:52:36 GMT","x-content-type-options":"nosniff, nosniff","v...` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ---------------------------------------------------------- | --------------------------------------------------------------------------------- | | accept-ranges | HTTP response header: accept-ranges | bytes | | allow | HTTP response header: allow | GET, HEAD, OPTIONS | | cache-control | Directives for caching mechanisms | max-age=0, no-cache, no-store, must-revalidate, private | | Connection | HTTP response header: Connection | keep-alive | | content-encoding | HTTP response header: content-encoding | gzip | | Content-Length | The length of the response body in bytes | 813 | | content-security-policy | HTTP response header: content-security-policy | default-src wss\://\*.hotjar.com https: data: blob: 'unsafe-inline' 'unsafe-eval' | | content-type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Mon, 09 Oct 2023 10:41:16 GMT | | expect-ct | HTTP response header: expect-ct | enforce, max-age=7776000 | | expires | The date/time after which the response is considered stale | Mon, 09 Oct 2023 10:41:15 GMT | | referrer-policy | HTTP response header: referrer-policy | same-origin | | server | Information about the software used by the origin server | nginx | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=300 | | Vary | HTTP response header: Vary | Cookie, Accept-Encoding | | via | HTTP response header: via | 1.1 varnish, 1.1 varnish | | X-Cache | HTTP response header: X-Cache | MISS, MISS | | X-Cache-Hits | HTTP response header: X-Cache-Hits | 0, 0 | | x-content-type-options | HTTP response header: x-content-type-options | nosniff, nosniff | | x-frame-options | HTTP response header: x-frame-options | DENY | | X-Served-By | HTTP response header: X-Served-By | cache-bom4751-BOM, cache-bom4751-BOM | | X-Timer | HTTP response header: X-Timer | S1696834355.599659,VS0,VE1797 | | x-xss-protection | HTTP response header: x-xss-protection | 1; mode=block |