Sophos Labs Intelix
SophosLabs Intelix is a threat intelligence and analysis platform. This Connector integrates SophosLabs Intelix's REST API with Swimlane Turbine to analyze URLs, IPs, and files for threats.
Prerequisites
To use this API, you must have an AWS account and be subscribed to SophosLabs Intelix. You will need the Client ID and Client Secret generated from this to set up your asset.
Capabilities
This Connector currently supports the following capabilities:
- Dynamic File Analysis
- Submit File
- Get a Report by File Hash
- Get Report by Job ID
- Static File Analysis
- Submit file
- Get Report by File Hash
- Get Report by job ID
- Static URL Analysis
- Submit URL
- Get URL Report by File Hash
- Get URL Report By Job ID
- File Hash Lookup
- GET File Hash Lookup
- URL Category Lookup ... and so on
Limitations
This Connector currently does not support Intelix's Android APK lookup API.
Notes
- For more information on Cisco Identity Services Engine(ISE):
Configurations
SophosLabs Intelix Oauth 2.0 Client Credentials
Authenticates using oauth 2.0 client credentials
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
token_url | ο»Ώ | string | Optional |
client_id | The client ID | string | Required |
client_secret | The client secret. | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Dynamic Analysis Get a Report by File Hash
Get a report by file hash
Endpoint
- URL: /analysis/file/dynamic/v1/reports
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.sha256 | string | Required | The SHA256 hash of the file. |
parameters.report_format | string | Optional | The requested report format. |
headers | object | Optional | HTTP headers for the request |
headers.X-Correlation-ID | string | Optional | HTTP headers for the request |
Input Example
{"parameters":{"sha256":"6db36450e8fe2934106be5e653a160bec044c1ac552cdd04a300d7a9e2ddbf88","report_format":"json"},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
correlationId | string | Unique identifier |
requestId | string | Unique identifier |
jobStatus | string | Status value |
report | object | Output field: report |
report.submission | string | Output field: report.submission |
report.analysis_type | string | Type of the resource |
report.object_type | string | Type of the resource |
report.score | number | Score value |
report.analysis_subject | object | Output field: report.analysis_subject |
report.analysis_subject.sha1 | string | Output field: report.analysis_subject.sha1 |
report.analysis_subject.sha256 | string | Output field: report.analysis_subject.sha256 |
report.analysis_subject.mimeType | string | Type of the resource |
report.malicious_activity | object | Output field: report.malicious_activity |
report.malicious_activity.Suspicious | array | Output field: report.malicious_activity.Suspicious |
report.malicious_activity.Network | array | Output field: report.malicious_activity.Network |
report.malicious_activity.Signature | array | Output field: report.malicious_activity.Signature |
report.files | object | Output field: report.files |
report.files.written | array | Output field: report.files.written |
report.files.written.path | string | Output field: report.files.written.path |
report.files.written.process | string | Output field: report.files.written.process |
report.files.written.pid | number | Unique identifier |
report.files.deleted | array | Output field: report.files.deleted |
report.files.deleted.path | string | Output field: report.files.deleted.path |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"malicious_activity":{},"files":{},"processes":[],"registry":{},"network":{},"screenshots":[],"activity_tree":{},"mitre_overlay":{}},"jobId":"949607c0b63a4a6fa2daad228380eca4"}}
Dynamic Analysis Get Report by Job ID
Get a file report by job id
Endpoint
- URL: /analysis/file/dynamic/v1/reports/{{job_id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.job_id | string | Required | The job id obtained in the submit call. |
parameters.report_format | string | Optional | The requested report format. |
headers | object | Optional | HTTP headers for the request |
headers.X-Correlation-ID | string | Optional | An optional caller-provided identifier which will be included in the response object. |
Input Example
{"parameters":{"report_format":"json"},"path_parameters":{"job_id":"949607c0b63a4a6fa2daad228380eca4"},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
correlationId | string | Unique identifier |
requestId | string | Unique identifier |
jobStatus | string | Status value |
report | object | Output field: report |
report.submission | string | Output field: report.submission |
report.analysis_type | string | Type of the resource |
report.object_type | string | Type of the resource |
report.score | number | Score value |
report.analysis_subject | object | Output field: report.analysis_subject |
report.analysis_subject.sha1 | string | Output field: report.analysis_subject.sha1 |
report.analysis_subject.sha256 | string | Output field: report.analysis_subject.sha256 |
report.analysis_subject.mimeType | string | Type of the resource |
report.malicious_activity | object | Output field: report.malicious_activity |
report.malicious_activity.Suspicious | array | Output field: report.malicious_activity.Suspicious |
report.malicious_activity.Network | array | Output field: report.malicious_activity.Network |
report.malicious_activity.Signature | array | Output field: report.malicious_activity.Signature |
report.malicious_classifications | array | Output field: report.malicious_classifications |
report.malicious_classifications.classification | string | Output field: report.malicious_classifications.classification |
report.malicious_classifications.classification_type | string | Type of the resource |
report.malicious_classifications.artifact | string | Output field: report.malicious_classifications.artifact |
report.malicious_classifications.artifact_type | string | Type of the resource |
report.malicious_classifications.threat_name | string | Name of the resource |
report.malicious_classifications.pid | number | Unique identifier |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"malicious_activity":{},"malicious_classifications":[],"detonation_info":{},"files":{},"registry":{},"network":{},"screenshots":[],"activity_tree":{},"mitre_overlay":{}},"jobId":"9...
Dynamic Analysis Submit File
Submit a file for dynamic analysis
Endpoint
- URL: /analysis/file/dynamic/v1
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
form_data | object | Required | Response data |
form_data.file | array | Required | File to be uploaded. |
form_data.file.file_name | string | Required | Response data |
form_data.file.file | string | Required | Response data |
form_data.report_format | string | Optional | The requested report format. |
form_data.passwords | array | Optional | passwords can be provided in case of a password protected file submission as a list of strings. |
headers | object | Optional | HTTP headers for the request |
headers.X-Correlation-ID | string | Optional | HTTP headers for the request |
Input Example
{"form_data":{"file":[{"file_name":"TEST_IMPORT.ssp","file":"TEST_IMPORT.ssp"}],"report_format":"json","passwords":["abc123"]},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
correlationId | string | Unique identifier |
requestId | string | Unique identifier |
jobStatus | string | Status value |
report | object | Output field: report |
report.submission | string | Output field: report.submission |
report.analysis_type | string | Type of the resource |
report.object_type | string | Type of the resource |
report.score | number | Score value |
report.analysis_subject | object | Output field: report.analysis_subject |
report.analysis_subject.sha1 | string | Output field: report.analysis_subject.sha1 |
report.analysis_subject.sha256 | string | Output field: report.analysis_subject.sha256 |
report.analysis_subject.mimeType | string | Type of the resource |
report.malicious_activity | object | Output field: report.malicious_activity |
report.malicious_activity.Suspicious | array | Output field: report.malicious_activity.Suspicious |
report.malicious_activity.Network | array | Output field: report.malicious_activity.Network |
report.malicious_activity.Signature | array | Output field: report.malicious_activity.Signature |
report.malicious_classifications | array | Output field: report.malicious_classifications |
report.malicious_classifications.classification | string | Output field: report.malicious_classifications.classification |
report.malicious_classifications.classification_type | string | Type of the resource |
report.malicious_classifications.artifact | string | Output field: report.malicious_classifications.artifact |
report.malicious_classifications.artifact_type | string | Type of the resource |
report.malicious_classifications.threat_name | string | Name of the resource |
report.malicious_classifications.pid | number | Unique identifier |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"malicious_activity":{},"malicious_classifications":[],"detonation_info":{},"files":{},"processes":[],"registry":{},"network":{},"screenshots":[],"activity_tree":{}},"jobId":"94960...
GET File Hash Lookup
Get information on known malicious files, by file hash, from SophosLabs.
Endpoint
- URL: /lookup/files/v1/{{sha256}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.sha256 | string | Required | The SHA256 hash of the requested file. |
headers | object | Optional | HTTP headers for the request |
headers.X-Correlation-ID | string | Optional | An optional caller-provided identifier which will be included in the response object. |
Input Example
{"path_parameters":{"sha256":"6db36450e8fe2934106be5e653a160bec044c1ac552cdd04a300d7a9e2ddbf88"},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
correlationId | string | Unique identifier |
requestId | string | Unique identifier |
reputationScore | number | Score value |
detectionName | string | Name of the resource |
ttl | number | Output field: ttl |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","reputationScore":18,"detectionName":"Mal/Generic-S","ttl":3600}}
Get IP Category Lookup
Get IP information from SophosLabs.
Endpoint
- URL: /lookup/ips/v1/{{ip}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.ip | string | Required | The queried IP address. Currently only IP v4 is supported. |
headers | object | Optional | HTTP headers for the request |
headers.X-Correlation-ID | string | Optional | An optional caller-provided identifier which will be included in the response object. |
Input Example
{"path_parameters":{"ip":"192.168.2.2"},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
correlationId | string | Unique identifier |
requestId | string | Unique identifier |
category | array | Output field: category |
ttl | number | Output field: ttl |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","category":["spammers"],"ttl":300}}
GET Lookup URL Categorization
Get URL information from SophosLabs.
Endpoint
- URL: /lookup/urls/v1/{{url}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.url | string | Required | The URL encoded URL to look up. |
headers | object | Optional | HTTP headers for the request |
headers.X-Correlation-ID | string | Optional | An optional caller-provided identifier which will be included in the response object. |
Input Example
{"path_parameters":{"url":"https//www.sophos.com/Fen-us/Flp/free-security-scan.aspx"},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
correlationId | string | Unique identifier |
requestId | string | Unique identifier |
productivityCategory | string | Output field: productivityCategory |
productivityScore | number | Score value |
securityCategory | string | Output field: securityCategory |
securityScore | number | Score value |
riskLevel | string | Output field: riskLevel |
ttl | number | Output field: ttl |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","productivityCategory":"PROD_SPYWARE_AND_MALWARE","productivityScore":0,"securityCategory":"SEC_MALWARE_REPOSITORY","securityScore":0,"riskLevel":"HIGH","ttl":300}}
Static Analysis Get Report by File Hash
Get a report by file hash.
Endpoint
- URL: /analysis/file/static/v1/reports
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.sha256 | string | Required | The SHA256 hash of the file. |
parameters.report_format | string | Optional | The requested report format. |
headers | object | Optional | HTTP headers for the request |
headers.X-Correlation-ID | string | Optional | An optional caller-provided identifier which will be included in the response object. |
Input Example
{"parameters":{"sha256":"6db36450e8fe2934106be5e653a160bec044c1ac552cdd04a300d7a9e2ddbf88","report_format":"json"},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
correlationId | string | Unique identifier |
requestId | string | Unique identifier |
jobStatus | string | Status value |
report | object | Output field: report |
report.submission | string | Output field: report.submission |
report.analysis_type | string | Type of the resource |
report.object_type | string | Type of the resource |
report.score | number | Score value |
report.analysis_subject | object | Output field: report.analysis_subject |
report.analysis_subject.sha1 | string | Output field: report.analysis_subject.sha1 |
report.analysis_subject.sha256 | string | Output field: report.analysis_subject.sha256 |
report.analysis_subject.mimeType | string | Type of the resource |
report.target | object | Output field: report.target |
report.target.sha1 | string | Output field: report.target.sha1 |
report.target.sha256 | string | Output field: report.target.sha256 |
report.target.mimeType | string | Type of the resource |
report.analysis_summary | array | Output field: report.analysis_summary |
report.analysis_summary.name | string | Name of the resource |
report.analysis_summary.description | string | Output field: report.analysis_summary.description |
report.analysis_summary.severity | number | Output field: report.analysis_summary.severity |
report.container_analysis | object | Output field: report.container_analysis |
report.container_analysis.children_count | number | Count value |
report.detection | object | Output field: report.detection |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"target":{},"analysis_summary":[],"container_analysis":{},"detection":{},"ml_aggregate_results":{},"ml_file":{},"ml_filepath":{},"ml_inputs":{},"pe_analysis":{},"jobId":"949607c0b6...
Static Analysis Get Report by Job ID
Get a report by job ID.
Endpoint
- URL: /analysis/file/static/v1/reports/{{job_id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.job_id | string | Required | The job id obtained in the submit call. |
parameters.report_format | string | Optional | The requested report format. |
headers | object | Optional | HTTP headers for the request |
headers.X-Correlation-ID | string | Optional | HTTP headers for the request |
Input Example
{"parameters":{"report_format":"application/json"},"path_parameters":{"job_id":"949607c0b63a4a6fa2daad228380eca4"},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
jobId | string | Unique identifier |
correlationId | string | Unique identifier |
requestId | string | Unique identifier |
jobStatus | string | Status value |
report | object | Output field: report |
report.submission | string | Output field: report.submission |
report.analysis_type | string | Type of the resource |
report.object_type | string | Type of the resource |
report.score | number | Score value |
report.analysis_subject | object | Output field: report.analysis_subject |
report.analysis_subject.sha1 | string | Output field: report.analysis_subject.sha1 |
report.analysis_subject.sha256 | string | Output field: report.analysis_subject.sha256 |
report.analysis_subject.mimeType | string | Type of the resource |
report.analysis_summary | array | Output field: report.analysis_summary |
report.analysis_summary.name | string | Name of the resource |
report.analysis_summary.description | string | Output field: report.analysis_summary.description |
report.analysis_summary.severity | number | Output field: report.analysis_summary.severity |
report.container_analysis | object | Output field: report.container_analysis |
report.container_analysis.children_count | number | Count value |
report.detection | object | Output field: report.detection |
report.detection.sophos | string | Output field: report.detection.sophos |
report.detection.sophos_ml | string | Output field: report.detection.sophos_ml |
report.detection.positives | number | Output field: report.detection.positives |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"analysis_summary":[],"container_analysis":{},"detection":{},"document_analysis":{},"ml_aggregate_results":{},"ml_file":{},"analyzed_counts":{},"overall_score":0.0789779,"overall_s...
Static Analysis Get URL Report by File Hash
Get a report by URL sha256 hash.
Endpoint
- URL: /analysis/url/static/v1/reports
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.sha256 | string | Required | The SHA256 hash of the normalized URL. |
parameters.report_format | string | Optional | The requested report format. |
headers | object | Optional | HTTP headers for the request |
headers.X-Correlation-ID | string | Optional | An optional caller-provided identifier which will be included in the response object. |
Input Example
{"parameters":{"sha256":"d70a85f3ef7494f85a6bf35e60c666c8e2335563c7ad7e6d8ae69f058173ce2b","report_format":"json"},"headers":{"X-Correlation-ID":"Yxzxz124l"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
correlationId | string | Unique identifier |
requestId | string | Unique identifier |
jobStatus | string | Status value |
report | object | Output field: report |
report.submission | string | Output field: report.submission |
report.analysis_type | string | Type of the resource |
report.object_type | string | Type of the resource |
report.score | number | Score value |
report.analysis_subject | object | Output field: report.analysis_subject |
report.analysis_subject.sha1 | string | Output field: report.analysis_subject.sha1 |
report.analysis_subject.sha256 | string | Output field: report.analysis_subject.sha256 |
report.analysis_subject.mimeType | string | Type of the resource |
report.analysis_subject.url | string | URL endpoint for the request |
report.productivity_category | string | Output field: report.productivity_category |
report.risk_level | string | Output field: report.risk_level |
report.ml_url | object | URL endpoint for the request |
report.ml_url.calibrated_score | number | URL endpoint for the request |
report.ml_url.raw_score | number | URL endpoint for the request |
report.ml_url.model_version | string | URL endpoint for the request |
report.url_analysis | object | URL endpoint for the request |
report.url_analysis.dns_info | object | URL endpoint for the request |
report.url_analysis.dns_info.a_records | array | URL endpoint for the request |
report.url_analysis.dns_info.aaaa_records | array | URL endpoint for the request |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"productivity_category":"PROD_SPYWARE_AND_MALWARE","risk_level":"HIGH","ml_url":{},"url_analysis":{}},"jobId":"949607c0b63a4a6fa2daad228380eca4"}}
Static Analysis Get URL Report by Job ID
Get a URL report by job ID.
Endpoint
- URL: /analysis/url/static/v1/reports/{{job_id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.job_id | string | Required | The job id obtained in the submit call. |
parameters.report_format | string | Optional | The requested report format. |
headers | object | Optional | HTTP headers for the request |
headers.X-Correlation-ID | string | Optional | An optional caller-provided identifier which will be included in the response object. |
Input Example
{"parameters":{"report_format":"json"},"path_parameters":{"job_id":"949607c0b63a4a6fa2daad228380eca4"},"headers":{"X-Correlation-ID":"Yabc123ijl"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
correlationId | string | Unique identifier |
requestId | string | Unique identifier |
jobStatus | string | Status value |
report | object | Output field: report |
report.submission | string | Output field: report.submission |
report.analysis_type | string | Type of the resource |
report.object_type | string | Type of the resource |
report.score | number | Score value |
report.analysis_subject | object | Output field: report.analysis_subject |
report.analysis_subject.sha1 | string | Output field: report.analysis_subject.sha1 |
report.analysis_subject.sha256 | string | Output field: report.analysis_subject.sha256 |
report.analysis_subject.mimeType | string | Type of the resource |
report.analysis_subject.url | string | URL endpoint for the request |
report.productivity_category | string | Output field: report.productivity_category |
report.risk_level | string | Output field: report.risk_level |
report.ml_url | object | URL endpoint for the request |
report.ml_url.calibrated_score | number | URL endpoint for the request |
report.ml_url.raw_score | number | URL endpoint for the request |
report.ml_url.model_version | string | URL endpoint for the request |
report.url_analysis | object | URL endpoint for the request |
report.url_analysis.dns_info | object | URL endpoint for the request |
report.url_analysis.dns_info.a_records | array | URL endpoint for the request |
report.url_analysis.dns_info.aaaa_records | array | URL endpoint for the request |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"productivity_category":"PROD_SPYWARE_AND_MALWARE","risk_level":"HIGH","ml_url":{},"url_analysis":{}},"jobId":"949607c0b63a4a6fa2daad228380eca4"}}
Static Analysis Submit File
Submit a file for static analysis.
Endpoint
- URL: /analysis/file/static/v1
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
form_data | object | Required | Response data |
form_data.file | array | Required | File to be uploaded. |
form_data.file.file_name | string | Required | Response data |
form_data.file.file | string | Required | Response data |
form_data.report_format | string | Optional | The requested report format. |
form_data.passwords | array | Optional | passwords can be provided in case of a password protected file submission as a list of strings. |
form_data.url | string | Optional | The source URL for the HTML file (required for HTML file analysis). |
headers | object | Optional | HTTP headers for the request |
headers.X-Correlation-ID | string | Optional | HTTP headers for the request |
Input Example
{"form_data":{"file":[{"file_name":"TEST_IMPORT.ssp","file":"TEST_IMPORT.ssp"}]},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
correlationId | string | Unique identifier |
requestId | string | Unique identifier |
jobStatus | string | Status value |
report | object | Output field: report |
report.submission | string | Output field: report.submission |
report.analysis_type | string | Type of the resource |
report.object_type | string | Type of the resource |
report.score | number | Score value |
report.analysis_subject | object | Output field: report.analysis_subject |
report.analysis_subject.sha1 | string | Output field: report.analysis_subject.sha1 |
report.analysis_subject.sha256 | string | Output field: report.analysis_subject.sha256 |
report.analysis_subject.mimeType | string | Type of the resource |
report.target | object | Output field: report.target |
report.target.sha1 | string | Output field: report.target.sha1 |
report.target.sha256 | string | Output field: report.target.sha256 |
report.target.mimeType | string | Type of the resource |
report.analysis_summary | array | Output field: report.analysis_summary |
report.analysis_summary.name | string | Name of the resource |
report.analysis_summary.description | string | Output field: report.analysis_summary.description |
report.analysis_summary.severity | number | Output field: report.analysis_summary.severity |
report.container_analysis | object | Output field: report.container_analysis |
report.container_analysis.children_count | number | Count value |
report.detection | object | Output field: report.detection |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"target":{},"analysis_summary":[],"container_analysis":{},"detection":{},"document_analysis":{},"ml_aggregate_results":{},"ml_file":{},"ml_filepath":{},"ml_inputs":{},"pe_analysis"...
Static Analysis Submit URL
Submit a URL for static analysis
Endpoint
- URL: /analysis/url/static/v1
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
headers | object | Optional | HTTP headers for the request |
headers.X-Correlation-ID | string | Optional | HTTP headers for the request |
url | string | Optional | URL to be submitted. |
report_format | string | Optional | An optional caller-provided identifier which will be included in the response object. |
Input Example
{"json_body":{"url":"https://www.sophoslabs.com/malware","report_format":"html"},"headers":{"X-Correlation-ID":"Yabcxy123il"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
correlationId | string | Unique identifier |
requestId | string | Unique identifier |
jobStatus | string | Status value |
report | object | Output field: report |
report.submission | string | Output field: report.submission |
report.analysis_type | string | Type of the resource |
report.object_type | string | Type of the resource |
report.score | number | Score value |
report.analysis_subject | object | Output field: report.analysis_subject |
report.analysis_subject.sha1 | string | Output field: report.analysis_subject.sha1 |
report.analysis_subject.sha256 | string | Output field: report.analysis_subject.sha256 |
report.analysis_subject.mimeType | string | Type of the resource |
report.analysis_subject.url | string | URL endpoint for the request |
report.productivity_category | string | Output field: report.productivity_category |
report.risk_level | string | Output field: report.risk_level |
report.ml_url | object | URL endpoint for the request |
report.ml_url.calibrated_score | number | URL endpoint for the request |
report.ml_url.raw_score | number | URL endpoint for the request |
report.ml_url.model_version | string | URL endpoint for the request |
report.url_analysis | object | URL endpoint for the request |
report.url_analysis.dns_info | object | URL endpoint for the request |
report.url_analysis.dns_info.a_records | array | URL endpoint for the request |
report.url_analysis.dns_info.aaaa_records | array | URL endpoint for the request |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"productivity_category":"PROD_SPYWARE_AND_MALWARE","risk_level":"HIGH","ml_url":{},"url_analysis":{}},"jobId":"949607c0b63a4a6fa2daad228380eca4"}}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |