--- title: Sophos Labs Intelix slug: connectors/sophos-labs-intelix docTags: createdAt: 2026-06-09T16:29:32.708Z --- SophosLabs Intelix is a threat intelligence and analysis platform. This Connector integrates SophosLabs Intelix's REST API with Swimlane Turbine to analyze URLs, IPs, and files for threats. ## Prerequisites To use this API, you must have an AWS account and be subscribed to SophosLabs Intelix. You will need the **Client ID** and **Client Secret** generated from this to set up your asset. ## Capabilities This Connector currently supports the following capabilities: - Dynamic File Analysis - Submit File - Get a Report by File Hash - Get Report by Job ID - Static File Analysis - Submit file - Get Report by File Hash - Get Report by job ID - Static URL Analysis - Submit URL - Get URL Report by File Hash - Get URL Report By Job ID - File Hash Lookup - GET File Hash Lookup - URL Category Lookup *... and so on* ### Limitations This Connector currently does not support Intelix's Android APK lookup API. ## Notes - For more information on Cisco Identity Services Engine(ISE): - [Registration information from SophosLabs can be found here](https://api.labs.sophos.com/doc/index.html#registration-howto) - [SophosLabs API Authentication](https://api.labs.sophos.com/doc/authentication) - [SophosLabs API Documentation for list of services](https://api.labs.sophos.com/doc/) # Configurations ## SophosLabs Intelix Oauth 2.0 Client Credentials Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token\_url | | string | Optional | | client\_id | The client ID | string | Required | | client\_secret | The client secret. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Dynamic Analysis Get a Report by File Hash Get a report by file hash ### Endpoint - **URL:** `/analysis/file/dynamic/v1/reports` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ---------------------------- | | `parameters.sha256` | string | Required | The SHA256 hash of the file. | | `parameters.report_format` | string | Optional | The requested report format. | | `headers` | object | Optional | HTTP headers for the request | | `headers.X-Correlation-ID` | string | Optional | HTTP headers for the request | ### Input Example `{"parameters":{"sha256":"6db36450e8fe2934106be5e653a160bec044c1ac552cdd04a300d7a9e2ddbf88","report_format":"json"},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | --------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `correlationId` | string | Unique identifier | | `requestId` | string | Unique identifier | | `jobStatus` | string | Status value | | `report` | object | Output field: report | | `report.submission` | string | Output field: report.submission | | `report.analysis_type` | string | Type of the resource | | `report.object_type` | string | Type of the resource | | `report.score` | number | Score value | | `report.analysis_subject` | object | Output field: report.analysis\_subject | | `report.analysis_subject.sha1` | string | Output field: report.analysis\_subject.sha1 | | `report.analysis_subject.sha256` | string | Output field: report.analysis\_subject.sha256 | | `report.analysis_subject.mimeType` | string | Type of the resource | | `report.malicious_activity` | object | Output field: report.malicious\_activity | | `report.malicious_activity.Suspicious` | array | Output field: report.malicious\_activity.Suspicious | | `report.malicious_activity.Network` | array | Output field: report.malicious\_activity.Network | | `report.malicious_activity.Signature` | array | Output field: report.malicious\_activity.Signature | | `report.files` | object | Output field: report.files | | `report.files.written` | array | Output field: report.files.written | | `report.files.written.path` | string | Output field: report.files.written.path | | `report.files.written.process` | string | Output field: report.files.written.process | | `report.files.written.pid` | number | Unique identifier | | `report.files.deleted` | array | Output field: report.files.deleted | | `report.files.deleted.path` | string | Output field: report.files.deleted.path | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"malicious_activity":{},"files":{},"processes":[],"registry":{},"network":{},"screenshots":[],"activity_tree":{},"mitre_overlay":{}},"jobId":"949607c0b63a4a6fa2daad228380eca4"}}` ## Dynamic Analysis Get Report by Job ID Get a file report by job id ### Endpoint - **URL:** `/analysis/file/dynamic/v1/reports/{{job_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------- | | `path_parameters.job_id` | string | Required | The job id obtained in the submit call. | | `parameters.report_format` | string | Optional | The requested report format. | | `headers` | object | Optional | HTTP headers for the request | | `headers.X-Correlation-ID` | string | Optional | An optional caller-provided identifier which will be included in the response object. | ### Input Example `{"parameters":{"report_format":"json"},"path_parameters":{"job_id":"949607c0b63a4a6fa2daad228380eca4"},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------ | -------- | -------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `correlationId` | string | Unique identifier | | `requestId` | string | Unique identifier | | `jobStatus` | string | Status value | | `report` | object | Output field: report | | `report.submission` | string | Output field: report.submission | | `report.analysis_type` | string | Type of the resource | | `report.object_type` | string | Type of the resource | | `report.score` | number | Score value | | `report.analysis_subject` | object | Output field: report.analysis\_subject | | `report.analysis_subject.sha1` | string | Output field: report.analysis\_subject.sha1 | | `report.analysis_subject.sha256` | string | Output field: report.analysis\_subject.sha256 | | `report.analysis_subject.mimeType` | string | Type of the resource | | `report.malicious_activity` | object | Output field: report.malicious\_activity | | `report.malicious_activity.Suspicious` | array | Output field: report.malicious\_activity.Suspicious | | `report.malicious_activity.Network` | array | Output field: report.malicious\_activity.Network | | `report.malicious_activity.Signature` | array | Output field: report.malicious\_activity.Signature | | `report.malicious_classifications` | array | Output field: report.malicious\_classifications | | `report.malicious_classifications.classification` | string | Output field: report.malicious\_classifications.classification | | `report.malicious_classifications.classification_type` | string | Type of the resource | | `report.malicious_classifications.artifact` | string | Output field: report.malicious\_classifications.artifact | | `report.malicious_classifications.artifact_type` | string | Type of the resource | | `report.malicious_classifications.threat_name` | string | Name of the resource | | `report.malicious_classifications.pid` | number | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"malicious_activity":{},"malicious_classifications":[],"detonation_info":{},"files":{},"registry":{},"network":{},"screenshots":[],"activity_tree":{},"mitre_overlay":{}},"jobId":"9...` ## Dynamic Analysis Submit File Submit a file for dynamic analysis ### Endpoint - **URL:** `/analysis/file/dynamic/v1` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------- | | `form_data` | object | Required | Response data | | `form_data.file` | array | Required | File to be uploaded. | | `form_data.file.file_name` | string | Required | Response data | | `form_data.file.file` | string | Required | Response data | | `form_data.report_format` | string | Optional | The requested report format. | | `form_data.passwords` | array | Optional | passwords can be provided in case of a password protected file submission as a list of strings. | | `headers` | object | Optional | HTTP headers for the request | | `headers.X-Correlation-ID` | string | Optional | HTTP headers for the request | ### Input Example `{"form_data":{"file":[{"file_name":"TEST_IMPORT.ssp","file":"TEST_IMPORT.ssp"}],"report_format":"json","passwords":["abc123"]},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------ | -------- | -------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `correlationId` | string | Unique identifier | | `requestId` | string | Unique identifier | | `jobStatus` | string | Status value | | `report` | object | Output field: report | | `report.submission` | string | Output field: report.submission | | `report.analysis_type` | string | Type of the resource | | `report.object_type` | string | Type of the resource | | `report.score` | number | Score value | | `report.analysis_subject` | object | Output field: report.analysis\_subject | | `report.analysis_subject.sha1` | string | Output field: report.analysis\_subject.sha1 | | `report.analysis_subject.sha256` | string | Output field: report.analysis\_subject.sha256 | | `report.analysis_subject.mimeType` | string | Type of the resource | | `report.malicious_activity` | object | Output field: report.malicious\_activity | | `report.malicious_activity.Suspicious` | array | Output field: report.malicious\_activity.Suspicious | | `report.malicious_activity.Network` | array | Output field: report.malicious\_activity.Network | | `report.malicious_activity.Signature` | array | Output field: report.malicious\_activity.Signature | | `report.malicious_classifications` | array | Output field: report.malicious\_classifications | | `report.malicious_classifications.classification` | string | Output field: report.malicious\_classifications.classification | | `report.malicious_classifications.classification_type` | string | Type of the resource | | `report.malicious_classifications.artifact` | string | Output field: report.malicious\_classifications.artifact | | `report.malicious_classifications.artifact_type` | string | Type of the resource | | `report.malicious_classifications.threat_name` | string | Name of the resource | | `report.malicious_classifications.pid` | number | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"malicious_activity":{},"malicious_classifications":[],"detonation_info":{},"files":{},"processes":[],"registry":{},"network":{},"screenshots":[],"activity_tree":{}},"jobId":"94960...` ## GET File Hash Lookup Get information on known malicious files, by file hash, from SophosLabs. ### Endpoint - **URL:** `/lookup/files/v1/{{sha256}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------- | | `path_parameters.sha256` | string | Required | The SHA256 hash of the requested file. | | `headers` | object | Optional | HTTP headers for the request | | `headers.X-Correlation-ID` | string | Optional | An optional caller-provided identifier which will be included in the response object. | ### Input Example `{"path_parameters":{"sha256":"6db36450e8fe2934106be5e653a160bec044c1ac552cdd04a300d7a9e2ddbf88"},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `correlationId` | string | Unique identifier | | `requestId` | string | Unique identifier | | `reputationScore` | number | Score value | | `detectionName` | string | Name of the resource | | `ttl` | number | Output field: ttl | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","reputationScore":18,"detectionName":"Mal/Generic-S","ttl":3600}}` ## Get IP Category Lookup Get IP information from SophosLabs. ### Endpoint - **URL:** `/lookup/ips/v1/{{ip}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------- | | `path_parameters.ip` | string | Required | The queried IP address. Currently only IP v4 is supported. | | `headers` | object | Optional | HTTP headers for the request | | `headers.X-Correlation-ID` | string | Optional | An optional caller-provided identifier which will be included in the response object. | ### Input Example `{"path_parameters":{"ip":"192.168.2.2"},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `correlationId` | string | Unique identifier | | `requestId` | string | Unique identifier | | `category` | array | Output field: category | | `ttl` | number | Output field: ttl | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","category":["spammers"],"ttl":300}}` ## GET Lookup URL Categorization Get URL information from SophosLabs. ### Endpoint - **URL:** `/lookup/urls/v1/{{url}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------- | | `path_parameters.url` | string | Required | The URL encoded URL to look up. | | `headers` | object | Optional | HTTP headers for the request | | `headers.X-Correlation-ID` | string | Optional | An optional caller-provided identifier which will be included in the response object. | ### Input Example `{"path_parameters":{"url":"https//www.sophos.com/Fen-us/Flp/free-security-scan.aspx"},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `correlationId` | string | Unique identifier | | `requestId` | string | Unique identifier | | `productivityCategory` | string | Output field: productivityCategory | | `productivityScore` | number | Score value | | `securityCategory` | string | Output field: securityCategory | | `securityScore` | number | Score value | | `riskLevel` | string | Output field: riskLevel | | `ttl` | number | Output field: ttl | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","productivityCategory":"PROD_SPYWARE_AND_MALWARE","productivityScore":0,"securityCategory":"SEC_MALWARE_REPOSITORY","securityScore":0,"riskLevel":"HIGH","ttl":300}}` ## Static Analysis Get Report by File Hash Get a report by file hash. ### Endpoint - **URL:** `/analysis/file/static/v1/reports` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------- | | `parameters.sha256` | string | Required | The SHA256 hash of the file. | | `parameters.report_format` | string | Optional | The requested report format. | | `headers` | object | Optional | HTTP headers for the request | | `headers.X-Correlation-ID` | string | Optional | An optional caller-provided identifier which will be included in the response object. | ### Input Example `{"parameters":{"sha256":"6db36450e8fe2934106be5e653a160bec044c1ac552cdd04a300d7a9e2ddbf88","report_format":"json"},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | -------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `correlationId` | string | Unique identifier | | `requestId` | string | Unique identifier | | `jobStatus` | string | Status value | | `report` | object | Output field: report | | `report.submission` | string | Output field: report.submission | | `report.analysis_type` | string | Type of the resource | | `report.object_type` | string | Type of the resource | | `report.score` | number | Score value | | `report.analysis_subject` | object | Output field: report.analysis\_subject | | `report.analysis_subject.sha1` | string | Output field: report.analysis\_subject.sha1 | | `report.analysis_subject.sha256` | string | Output field: report.analysis\_subject.sha256 | | `report.analysis_subject.mimeType` | string | Type of the resource | | `report.target` | object | Output field: report.target | | `report.target.sha1` | string | Output field: report.target.sha1 | | `report.target.sha256` | string | Output field: report.target.sha256 | | `report.target.mimeType` | string | Type of the resource | | `report.analysis_summary` | array | Output field: report.analysis\_summary | | `report.analysis_summary.name` | string | Name of the resource | | `report.analysis_summary.description` | string | Output field: report.analysis\_summary.description | | `report.analysis_summary.severity` | number | Output field: report.analysis\_summary.severity | | `report.container_analysis` | object | Output field: report.container\_analysis | | `report.container_analysis.children_count` | number | Count value | | `report.detection` | object | Output field: report.detection | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"target":{},"analysis_summary":[],"container_analysis":{},"detection":{},"ml_aggregate_results":{},"ml_file":{},"ml_filepath":{},"ml_inputs":{},"pe_analysis":{},"jobId":"949607c0b6...` ## Static Analysis Get Report by Job ID Get a report by job ID. ### Endpoint - **URL:** `/analysis/file/static/v1/reports/{{job_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | --------------------------------------- | | `path_parameters.job_id` | string | Required | The job id obtained in the submit call. | | `parameters.report_format` | string | Optional | The requested report format. | | `headers` | object | Optional | HTTP headers for the request | | `headers.X-Correlation-ID` | string | Optional | HTTP headers for the request | ### Input Example `{"parameters":{"report_format":"application/json"},"path_parameters":{"job_id":"949607c0b63a4a6fa2daad228380eca4"},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | -------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `jobId` | string | Unique identifier | | `correlationId` | string | Unique identifier | | `requestId` | string | Unique identifier | | `jobStatus` | string | Status value | | `report` | object | Output field: report | | `report.submission` | string | Output field: report.submission | | `report.analysis_type` | string | Type of the resource | | `report.object_type` | string | Type of the resource | | `report.score` | number | Score value | | `report.analysis_subject` | object | Output field: report.analysis\_subject | | `report.analysis_subject.sha1` | string | Output field: report.analysis\_subject.sha1 | | `report.analysis_subject.sha256` | string | Output field: report.analysis\_subject.sha256 | | `report.analysis_subject.mimeType` | string | Type of the resource | | `report.analysis_summary` | array | Output field: report.analysis\_summary | | `report.analysis_summary.name` | string | Name of the resource | | `report.analysis_summary.description` | string | Output field: report.analysis\_summary.description | | `report.analysis_summary.severity` | number | Output field: report.analysis\_summary.severity | | `report.container_analysis` | object | Output field: report.container\_analysis | | `report.container_analysis.children_count` | number | Count value | | `report.detection` | object | Output field: report.detection | | `report.detection.sophos` | string | Output field: report.detection.sophos | | `report.detection.sophos_ml` | string | Output field: report.detection.sophos\_ml | | `report.detection.positives` | number | Output field: report.detection.positives | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"analysis_summary":[],"container_analysis":{},"detection":{},"document_analysis":{},"ml_aggregate_results":{},"ml_file":{},"analyzed_counts":{},"overall_score":0.0789779,"overall_s...` ## Static Analysis Get URL Report by File Hash Get a report by URL sha256 hash. ### Endpoint - **URL:** `/analysis/url/static/v1/reports` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------- | | `parameters.sha256` | string | Required | The SHA256 hash of the normalized URL. | | `parameters.report_format` | string | Optional | The requested report format. | | `headers` | object | Optional | HTTP headers for the request | | `headers.X-Correlation-ID` | string | Optional | An optional caller-provided identifier which will be included in the response object. | ### Input Example `{"parameters":{"sha256":"d70a85f3ef7494f85a6bf35e60c666c8e2335563c7ad7e6d8ae69f058173ce2b","report_format":"json"},"headers":{"X-Correlation-ID":"Yxzxz124l"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `correlationId` | string | Unique identifier | | `requestId` | string | Unique identifier | | `jobStatus` | string | Status value | | `report` | object | Output field: report | | `report.submission` | string | Output field: report.submission | | `report.analysis_type` | string | Type of the resource | | `report.object_type` | string | Type of the resource | | `report.score` | number | Score value | | `report.analysis_subject` | object | Output field: report.analysis\_subject | | `report.analysis_subject.sha1` | string | Output field: report.analysis\_subject.sha1 | | `report.analysis_subject.sha256` | string | Output field: report.analysis\_subject.sha256 | | `report.analysis_subject.mimeType` | string | Type of the resource | | `report.analysis_subject.url` | string | URL endpoint for the request | | `report.productivity_category` | string | Output field: report.productivity\_category | | `report.risk_level` | string | Output field: report.risk\_level | | `report.ml_url` | object | URL endpoint for the request | | `report.ml_url.calibrated_score` | number | URL endpoint for the request | | `report.ml_url.raw_score` | number | URL endpoint for the request | | `report.ml_url.model_version` | string | URL endpoint for the request | | `report.url_analysis` | object | URL endpoint for the request | | `report.url_analysis.dns_info` | object | URL endpoint for the request | | `report.url_analysis.dns_info.a_records` | array | URL endpoint for the request | | `report.url_analysis.dns_info.aaaa_records` | array | URL endpoint for the request | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"productivity_category":"PROD_SPYWARE_AND_MALWARE","risk_level":"HIGH","ml_url":{},"url_analysis":{}},"jobId":"949607c0b63a4a6fa2daad228380eca4"}}` ## Static Analysis Get URL Report by Job ID Get a URL report by job ID. ### Endpoint - **URL:** `/analysis/url/static/v1/reports/{{job_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------- | | `path_parameters.job_id` | string | Required | The job id obtained in the submit call. | | `parameters.report_format` | string | Optional | The requested report format. | | `headers` | object | Optional | HTTP headers for the request | | `headers.X-Correlation-ID` | string | Optional | An optional caller-provided identifier which will be included in the response object. | ### Input Example `{"parameters":{"report_format":"json"},"path_parameters":{"job_id":"949607c0b63a4a6fa2daad228380eca4"},"headers":{"X-Correlation-ID":"Yabc123ijl"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `correlationId` | string | Unique identifier | | `requestId` | string | Unique identifier | | `jobStatus` | string | Status value | | `report` | object | Output field: report | | `report.submission` | string | Output field: report.submission | | `report.analysis_type` | string | Type of the resource | | `report.object_type` | string | Type of the resource | | `report.score` | number | Score value | | `report.analysis_subject` | object | Output field: report.analysis\_subject | | `report.analysis_subject.sha1` | string | Output field: report.analysis\_subject.sha1 | | `report.analysis_subject.sha256` | string | Output field: report.analysis\_subject.sha256 | | `report.analysis_subject.mimeType` | string | Type of the resource | | `report.analysis_subject.url` | string | URL endpoint for the request | | `report.productivity_category` | string | Output field: report.productivity\_category | | `report.risk_level` | string | Output field: report.risk\_level | | `report.ml_url` | object | URL endpoint for the request | | `report.ml_url.calibrated_score` | number | URL endpoint for the request | | `report.ml_url.raw_score` | number | URL endpoint for the request | | `report.ml_url.model_version` | string | URL endpoint for the request | | `report.url_analysis` | object | URL endpoint for the request | | `report.url_analysis.dns_info` | object | URL endpoint for the request | | `report.url_analysis.dns_info.a_records` | array | URL endpoint for the request | | `report.url_analysis.dns_info.aaaa_records` | array | URL endpoint for the request | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"productivity_category":"PROD_SPYWARE_AND_MALWARE","risk_level":"HIGH","ml_url":{},"url_analysis":{}},"jobId":"949607c0b63a4a6fa2daad228380eca4"}}` ## Static Analysis Submit File Submit a file for static analysis. ### Endpoint - **URL:** `/analysis/file/static/v1` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------- | | `form_data` | object | Required | Response data | | `form_data.file` | array | Required | File to be uploaded. | | `form_data.file.file_name` | string | Required | Response data | | `form_data.file.file` | string | Required | Response data | | `form_data.report_format` | string | Optional | The requested report format. | | `form_data.passwords` | array | Optional | passwords can be provided in case of a password protected file submission as a list of strings. | | `form_data.url` | string | Optional | The source URL for the HTML file (required for HTML file analysis). | | `headers` | object | Optional | HTTP headers for the request | | `headers.X-Correlation-ID` | string | Optional | HTTP headers for the request | ### Input Example `{"form_data":{"file":[{"file_name":"TEST_IMPORT.ssp","file":"TEST_IMPORT.ssp"}]},"headers":{"X-Correlation-ID":"Y3F2dGpja2c"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | -------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `correlationId` | string | Unique identifier | | `requestId` | string | Unique identifier | | `jobStatus` | string | Status value | | `report` | object | Output field: report | | `report.submission` | string | Output field: report.submission | | `report.analysis_type` | string | Type of the resource | | `report.object_type` | string | Type of the resource | | `report.score` | number | Score value | | `report.analysis_subject` | object | Output field: report.analysis\_subject | | `report.analysis_subject.sha1` | string | Output field: report.analysis\_subject.sha1 | | `report.analysis_subject.sha256` | string | Output field: report.analysis\_subject.sha256 | | `report.analysis_subject.mimeType` | string | Type of the resource | | `report.target` | object | Output field: report.target | | `report.target.sha1` | string | Output field: report.target.sha1 | | `report.target.sha256` | string | Output field: report.target.sha256 | | `report.target.mimeType` | string | Type of the resource | | `report.analysis_summary` | array | Output field: report.analysis\_summary | | `report.analysis_summary.name` | string | Name of the resource | | `report.analysis_summary.description` | string | Output field: report.analysis\_summary.description | | `report.analysis_summary.severity` | number | Output field: report.analysis\_summary.severity | | `report.container_analysis` | object | Output field: report.container\_analysis | | `report.container_analysis.children_count` | number | Count value | | `report.detection` | object | Output field: report.detection | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"target":{},"analysis_summary":[],"container_analysis":{},"detection":{},"document_analysis":{},"ml_aggregate_results":{},"ml_file":{},"ml_filepath":{},"ml_inputs":{},"pe_analysis"...` ## Static Analysis Submit URL Submit a URL for static analysis ### Endpoint - **URL:** `/analysis/url/static/v1` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------- | | `headers` | object | Optional | HTTP headers for the request | | `headers.X-Correlation-ID` | string | Optional | HTTP headers for the request | | `url` | string | Optional | URL to be submitted. | | `report_format` | string | Optional | An optional caller-provided identifier which will be included in the response object. | ### Input Example `{"json_body":{"url":"https://www.sophoslabs.com/malware","report_format":"html"},"headers":{"X-Correlation-ID":"Yabcxy123il"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `correlationId` | string | Unique identifier | | `requestId` | string | Unique identifier | | `jobStatus` | string | Status value | | `report` | object | Output field: report | | `report.submission` | string | Output field: report.submission | | `report.analysis_type` | string | Type of the resource | | `report.object_type` | string | Type of the resource | | `report.score` | number | Score value | | `report.analysis_subject` | object | Output field: report.analysis\_subject | | `report.analysis_subject.sha1` | string | Output field: report.analysis\_subject.sha1 | | `report.analysis_subject.sha256` | string | Output field: report.analysis\_subject.sha256 | | `report.analysis_subject.mimeType` | string | Type of the resource | | `report.analysis_subject.url` | string | URL endpoint for the request | | `report.productivity_category` | string | Output field: report.productivity\_category | | `report.risk_level` | string | Output field: report.risk\_level | | `report.ml_url` | object | URL endpoint for the request | | `report.ml_url.calibrated_score` | number | URL endpoint for the request | | `report.ml_url.raw_score` | number | URL endpoint for the request | | `report.ml_url.model_version` | string | URL endpoint for the request | | `report.url_analysis` | object | URL endpoint for the request | | `report.url_analysis.dns_info` | object | URL endpoint for the request | | `report.url_analysis.dns_info.a_records` | array | URL endpoint for the request | | `report.url_analysis.dns_info.aaaa_records` | array | URL endpoint for the request | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"correlationId":"11111111-2222-3333-4444-555555555555","requestId":"1f44cdb5-d3a0-43d1-8a3d-597a9ab18cc3","jobStatus":"SUCCESS","report":{"submission":"2018-03-14T16:13:48Z","analysis_type":"static","object_type":"file","score":0,"analysis_subject":{},"productivity_category":"PROD_SPYWARE_AND_MALWARE","risk_level":"HIGH","ml_url":{},"url_analysis":{}},"jobId":"949607c0b63a4a6fa2daad228380eca4"}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |