ptsandbox.models

ptsandbox.models

DebugOptions

Bases: TypedDict

Description of all available debugging options for very detailed scan configuration

keep_sandbox instance-attribute

keep_sandbox: NotRequired[bool]

Don't destroy the sandbox after scanning

skip_work instance-attribute

skip_work: NotRequired[bool]

Perform a scan, skipping the data collection stage for analysis

extract_crashdumps instance-attribute

extract_crashdumps: NotRequired[bool]

Extract crashdumps from the sandbox

save_debug_files instance-attribute

save_debug_files: NotRequired[bool]

Save files necessary for debugging (error logs, tcpdump logs, etc)

rules_url instance-attribute

rules_url: NotRequired[str]

Use the specified normalization and correlation rules The rules are specified as a link to the archive containing the compiled rules

sleep_work instance-attribute

sleep_work: NotRequired[bool]

Perform a scan, replacing the data collection stage for analysis with an equivalent waiting time

disable_syscall_hooks instance-attribute

disable_syscall_hooks: NotRequired[bool]

Disable syscall hooks functionality

Read more about these hooks in documentation

disable_dll_hooks instance-attribute

disable_dll_hooks: NotRequired[bool]

Disable dll hooks functionality

Read more about these hooks in documentation

disable_correlation instance-attribute

disable_correlation: NotRequired[bool]

Disable the functionality of normalization and correlation of events.

It is useful if the correlation results are not needed anyway.

In this case, all collected artifacts (drops, memdumps, procdumps) will be included in the response, without filtering at the level of correlation rules

custom_syscall_hooks instance-attribute

custom_syscall_hooks: NotRequired[str]

Use the specified list of system calls to intercept

The list is transmitted as an http link to a file with the names of system calls

Read more about this file in documentation

custom_dll_hooks instance-attribute

custom_dll_hooks: NotRequired[str]

Use the specified list of system calls to intercept

The list is transmitted as an http link to a file with the names of dll hooks for apimon plugin

Read more about this file in documentation

disable_retries instance-attribute

disable_retries: NotRequired[bool]

Disable task re-execution in case of a scan error

enable_sanitizers instance-attribute

enable_sanitizers: NotRequired[bool]

Enable the debugging mechanisms of the sanitizers group

allowed_outbound_connections instance-attribute

allowed_outbound_connections: NotRequired[list[str]]

Whitelist of IP addresses to which connections from a VM are allowed (backconnect)

payload_completion_event instance-attribute

payload_completion_event: NotRequired[str]

A regular expression for the raw DRAKVUF event, signaling the end of the useful work of the sample.

If this option is specified, sandbox-worker will calculate and log the PAYLOAD_SCAN_TIME metric.

disable_procdump_on_finish instance-attribute

disable_procdump_on_finish: NotRequired[bool]

Disable the functionality of removing the memory dump from the sample at the end of the observation

skip_update_time instance-attribute

skip_update_time: NotRequired[bool]

Do not synchronize the time in the VM with the host

disable_manual_scan_events instance-attribute

disable_manual_scan_events: NotRequired[bool]

Do not send lifecycle notifications for manual behavioral analysis (console is ready, console is closed, etc.)

bootkitmon_boot_timeout instance-attribute

bootkitmon_boot_timeout: NotRequired[int]

The maximum waiting time for VM loading in seconds (90 seconds by default)

custom_procdump_exclude instance-attribute

custom_procdump_exclude: NotRequired[str]

A file with a list of processes for which memory dumps should not be removed.

Each line in the file is a regular expression of the path to the process file on disk.

Read more about this file in documentation

custom_fileextractor_exclude instance-attribute

custom_fileextractor_exclude: NotRequired[str]

A file with a list of files that should not be extracted

Each line in the file is a regular expression of the path to the file on disk.

Read more about this file in documentation

validate_plugins instance-attribute

validate_plugins: NotRequired[bool]

Check plugins for at least one event during the entire behavioral analysis

extra_vm_init_url instance-attribute

extra_vm_init_url: NotRequired[str]

Run this script in the VM immediately before launching the behavioral analysis.

It is useful, for example, to check the network during analysis.

procdump_lightweight_mode instance-attribute

procdump_lightweight_mode: NotRequired[bool]

Use "light" memory dumps or not

custom_unimon_hooks instance-attribute

custom_unimon_hooks: NotRequired[str]

Use a special format for hooks (not stable, will changed in the future)

file_type_as_ext instance-attribute

file_type_as_ext: NotRequired[bool]

Use a file type as an extension for a file

SandboxAdvancedScanTaskRequest

Bases: SandboxBaseScanTaskRequest

Parameters of an API request to start analyzing a file previously uploaded to the product.

<URL>/analysis/createBAScanTask

file_uri instance-attribute

file_uri: str

The file URI received when uploading the file

sandbox class-attribute instance-attribute

sandbox: SandboxOptionsAdvanced = SandboxOptionsAdvanced()

Additional advanced scanning options

SandboxBaseOptions

Bases: BaseRequest

Common parameters of behavioral analysis shared by SandboxOptions and SandboxOptionsAdvanced.

image_id class-attribute instance-attribute

image_id: str = 'win7-sp1-x64'

ID of the VM image.

You can view it in the sandbox interface.

custom_command class-attribute instance-attribute

custom_command: str | None = None

The command to run the file.

The {file} marker in the string is replaced with the path to the file.

For example: rundll32.exe {file},#1

procdump_new_processes_on_finish class-attribute instance-attribute

procdump_new_processes_on_finish: bool = True

Take dumps for all spawned and non-dead processes

analysis_duration class-attribute instance-attribute

analysis_duration: int = Field(default=120, ge=10)

The duration of analysis the file in seconds. minimum: 10

bootkitmon class-attribute instance-attribute

bootkitmon: bool = False

Perform bootkitmon analysis

analysis_duration_bootkitmon class-attribute instance-attribute

analysis_duration_bootkitmon: int = Field(default=60, ge=10)

The duration of analysis at the bootkitmon stage in seconds. minimum: 10

save_video class-attribute instance-attribute

save_video: bool = True

Save video capture of the screen

mitm_enabled class-attribute instance-attribute

mitm_enabled: bool = True

Enable certificates injection with PT Sandbox certificates when decrypting and analyzing secure traffic

debug_options class-attribute instance-attribute

debug_options: DebugOptions = {'save_debug_files': False}

Fine-tuning

SandboxBaseScanTaskRequest

Bases: BaseRequest

Base class for all scan requests

file_name class-attribute instance-attribute

file_name: str | None = None

The name of the file to be checked, which will be displayed in the sandbox web interface.

If not specified, the hash value of the file is calculated using the SHA—256 algorithm.

short_result class-attribute instance-attribute

short_result: bool = False

Return only the overall result of the check.

The parameter value is ignored (true is used) if the value of the async_result parameter is also true.

async_result class-attribute instance-attribute

async_result: bool = True

Return only the scan_id.

Enabling this option may be usefull to send async requests for file checking.

You can receive full report in a separate request.

priority class-attribute instance-attribute

priority: int = Field(default=3, ge=1, le=4)

The priority of the task. The higher it is, the faster it will get to work

Options

Bases: BaseModel

analysis_depth class-attribute instance-attribute

analysis_depth: int = 2

The depth of the check.

The maximum level of decomposition of objects with a hierarchical structure (archives, emails, links, etc.) or the decompression level of compressed files.

If the value is 0, the check is performed without decomposition and decompression.

The higher the number, the longer the check can take.

scan_timeout class-attribute instance-attribute

scan_timeout: int = Field(default=1200, ge=10, le=3600)

Maximum response time

max_execution_time class-attribute instance-attribute

max_execution_time: int = Field(
    default=3600, ge=300, le=10800
)

Maximum waiting time for analysis

passwords_for_unpack class-attribute instance-attribute

passwords_for_unpack: list[str] = Field(
    default_factory=list[str]
)

List of passwords for unpacking encrypted archives

cache_enabled class-attribute instance-attribute

cache_enabled: bool = False

If the file has already been analyzed before, it will be taken from the cache, and not analyzed again.

url_extract_enabled class-attribute instance-attribute

url_extract_enabled: bool = True

Extract links from objects

enable_experimental_yara_rules class-attribute instance-attribute

enable_experimental_yara_rules: bool = False

Enable object analysis using yara test rules

mark_suspicious_files_options class-attribute instance-attribute

mark_suspicious_files_options: (
    SuspiciousFilesOptions | None
) = None

Settings for marking files as suspicious. By default, we do not send, but take the settings from the sandbox.

You can configure it by passing an object with the necessary options.

mark_dangerous_files_options class-attribute instance-attribute

mark_dangerous_files_options: (
    DangerousFilesOptions | None
) = DangerousFilesOptions()

Settings for marking files as dangerous. By default, we send this information because this labels are important.

You can configure it by passing an object with the necessary options or pass None to disable it

sandbox class-attribute instance-attribute

sandbox: SandboxOptions = SandboxOptions()

Behavioral Analysis Parameters

SuspiciousFilesOptions

Bases: BaseModel

Settings for marking files as suspicious

encrypted_not_unpacked class-attribute instance-attribute

encrypted_not_unpacked: bool = True

Encrypted and not unpacked file

max_depth_exceeded class-attribute instance-attribute

max_depth_exceeded: bool = True

Unpacking depth exceeded

office_encrypted class-attribute instance-attribute

office_encrypted: bool = True

Encrypted office file

office_has_macros class-attribute instance-attribute

office_has_macros: bool = True

Office file with macros

office_has_embedded class-attribute instance-attribute

office_has_embedded: bool = True

Office file with embedded objects

office_has_active_x class-attribute instance-attribute

office_has_active_x: bool = True

Office file with ActiveX controls

office_has_dde class-attribute instance-attribute

office_has_dde: bool = True

Office file with dynamic data exchange

office_has_remote_data class-attribute instance-attribute

office_has_remote_data: bool = True

Office file with remote data

office_has_remote_template class-attribute instance-attribute

office_has_remote_template: bool = True

Office file with remote templates

office_has_action class-attribute instance-attribute

office_has_action: bool = True

Office file with Action

pdf_encrypted class-attribute instance-attribute

pdf_encrypted: bool = True

Encrypted PDF file

pdf_has_embedded class-attribute instance-attribute

pdf_has_embedded: bool = True

PDF file with embedded objects

pdf_has_open_action class-attribute instance-attribute

pdf_has_open_action: bool = True

PDF file with Open Action

pdf_has_action class-attribute instance-attribute

pdf_has_action: bool = True

PDF file with Action

pdf_has_javascript class-attribute instance-attribute

pdf_has_javascript: bool = True

PDF file with Javascript

pdf_protected class-attribute instance-attribute

pdf_protected: bool = True

Protected PDF file

DangerousFilesOptions

Bases: BaseModel

Settings for marking files as dangerous

apk_tampered class-attribute instance-attribute

apk_tampered: bool = True

APK file with the label: "The format is compromised"

SandboxBaseTaskResponse

Bases: BaseResponse

Base class for all scan responses

data class-attribute instance-attribute

data: LongReport | ShortReport = Field(
    union_mode="left_to_right"
)

Only the ShortReport is returned if async_result = True

ShortReport

Bases: BaseModel

scan_id instance-attribute

scan_id: UUID

ID of the created task

LongReport

Bases: ShortReport

result instance-attribute

result: SandboxResult

The overall result of the check.

Missing from search responses

• createScanTask with the async_result parameter enabled;
• checkTask, if the file analysis has not been completed yet

artifacts class-attribute instance-attribute

artifacts: list[Artifact] = Field(
    default_factory=list[Artifact]
)

A file, email, or other object that was checked during file analysis.

Missing from search responses

• createScanTask with the async_result or short_result option enabled;
• checkTask

SandboxCheckTaskRequest

Bases: BaseRequest

Parameters of the API request for receiving file analysis results.

The request can be used to get the results of the file analysis, which was started by an asynchronous request (createScanTask with the async_result parameter enabled).

<URL>/analysis/checkTask

scan_id instance-attribute

scan_id: UUID

ID of the task

allow_preflight class-attribute instance-attribute

allow_preflight: bool = True

If this flag is set, an intermediate result with the is_preflight attribute will be returned for scanning with multiple stages (for example, static + BA).

SandboxCheckTaskResponse

Bases: BaseResponse

Data

Bases: BaseModel

scan_id instance-attribute

scan_id: UUID

ID of the created task

result class-attribute instance-attribute

result: SandboxResult | None = None

The overall result of the check.

Missing from search responses

• createScanTask with the async_result parameter enabled;
• checkTask, if the file analysis has not been completed yet

is_preflight class-attribute instance-attribute

is_preflight: bool | None = None

Is the result preliminary, for example, only static has completed

SandboxOptions

Bases: SandboxBaseOptions

Parameters of behavioral analysis.

In the absence, the source parameters are used for analysis, which are set in the system by default.

enabled class-attribute instance-attribute

enabled: bool = True

Perform a behavioral analysis

file_types class-attribute instance-attribute

file_types: list[str] | None = None

A list of the final file types or groups of files that will be sent for behavioral analysis

For example: ["adobe-acrobat/", "databases/", "executable-files/", "presentations/", "spreadsheets/", "word-processor/"]

filter_by_properties class-attribute instance-attribute

filter_by_properties: FilterProperties | None = None

Filtering a group of files by properties to send to the sandbox for analysis

SandboxOptionsAdvanced

Bases: SandboxBaseOptions

Run an advanced analysis of the uploaded file in the VM without unpacking.

Provides an opportunity to fine-tuning.

The options are in beta, so they may change in the future.

disable_clicker class-attribute instance-attribute

disable_clicker: bool = False

Disable auto-clicker startup

Useful when enabling manual analysis.

skip_sample_run class-attribute instance-attribute

skip_sample_run: bool = False

Disable sample launch

vnc_mode class-attribute instance-attribute

vnc_mode: VNCMode = DISABLED

Manual analysis mode

extra_files class-attribute instance-attribute

extra_files: list[ExtraFile] = Field(
    default_factory=list[ExtraFile]
)

A list of additional files that are placed in the VM

ExtraFile

Bases: BaseModel

An additional file to be placed next to the sample

uri instance-attribute

uri: str

Link to the uploaded object

name instance-attribute

name: str

Name in the VM

SandboxRescanTaskRequest

Bases: SandboxBaseScanTaskRequest

API request parameters for launching retro analysis.

Allows scanning with the new drakvuf-trace.log.zst and tcpdump.pcap rules

<URL>/analysis/createRetroTask

file_uri instance-attribute

file_uri: str

The file URI received when uploading the file

raw_events_uri class-attribute instance-attribute

raw_events_uri: str | None = None

Temporary URI of the raw trace file

raw_network_uri class-attribute instance-attribute

raw_network_uri: str | None = None

Temporary URI of the network file

options class-attribute instance-attribute

options: Options = Options()

Additional scanning options

SandboxScanTaskRequest

Bases: SandboxBaseScanTaskRequest

Parameters of an API request to start analyzing a file previously uploaded to the product.

<URL>/analysis/createScanTask

file_uri instance-attribute

file_uri: str

The file URI received when uploading the file

options class-attribute instance-attribute

options: Options = Options()

Additional scanning options

SandboxScanURLTaskRequest

Bases: SandboxBaseScanTaskRequest

Parameters of the API request to start URL analysis.

<URL>/analysis/createScanURLTask

url instance-attribute

url: str

URL address for analysis

options class-attribute instance-attribute

options: Options = Options()

Additional scanning options

SandboxTasksResponse

Bases: BaseModel

next_cursor class-attribute instance-attribute

next_cursor: str = ''

The cursor is for pagination, if the line is empty, then there is no more data. Indicates the data after the last record

Task

Bases: BaseModel

Brief information on the scan

id instance-attribute

id: str

Scan ID

name instance-attribute

name: str

Name of the scan

entry_point_id instance-attribute

entry_point_id: str

Name of the entry point

entry_point_type instance-attribute

entry_point_type: str

Type of the entry point

start_time instance-attribute

start_time: float

The beginning of the scan

scan_state instance-attribute

scan_state: ScanState

Scan status

duration class-attribute instance-attribute

duration: float | None = None

Duration of the check: total or for each antivirus and component.

duration_full class-attribute instance-attribute

duration_full: float | None = None

The duration of the check, taking into account the record in the database or the time of the request.

verdict class-attribute instance-attribute

verdict: Verdict | None = None

Scan result

threat class-attribute instance-attribute

threat: str | None = None

The type of malware.

SandboxKey

Bases: BaseModel

Abstraction over the key that is used to send to the sandbox

name instance-attribute

name: str

Custom key name

key instance-attribute

key: SecretStr

The key received in the sandbox interface

host instance-attribute

host: str

Hostname of the sandbox instance

For example: 1.1.1.1 or sandbox.example.com without https etc

description class-attribute instance-attribute

description: str = ''

A description of the key for easy representation somewhere in the interface

max_workers class-attribute instance-attribute

max_workers: int = Field(default=8, ge=1)

The maximum number of simultaneously running behavioral nodes

The quantity can be found in the interface

ui class-attribute instance-attribute

ui: UI | None = None

If necessary, you can also access the sandbox via the UI API

url property

url: str

https address for connecting via API

debug_url property

debug_url: str

https address for connecting via debug API

ui_url property

ui_url: str

https address for connecting via UI API

SandboxGetHealthStatusResponse

Bases: BaseResponse

Healthcheck results

Data

Bases: BaseModel

status instance-attribute

status: str

Health status

SandboxGetVersionResponse

Bases: BaseResponse

Get information about product

Data

Bases: BaseModel

version instance-attribute

version: str

Product version, for example '5.11.0.12345'

edition instance-attribute

edition: str

Filled in for test builds or certification builds.

SandboxGetImagesResponse

Bases: BaseResponse

Your application can get a list of virtual machine images installed in the PT Sandbox.

<URL>/engines/sandbox/getImages

SandboxScanWithSource

Bases: BaseRequest

Internal model for creating request

SandboxScanWithSourceFileRequest

Bases: SandboxScanWithSource

Internal model for creating request

SandboxScanWithSourceURLRequest

Bases: SandboxScanWithSource

Internal model for creating request

SandboxUploadScanFileResponse

Bases: BaseResponse

Before running the file analysis using the API, your application must upload this file to the sandbox.

<URL>/storage/uploadScanFile

Data

Bases: BaseModel

file_uri instance-attribute

file_uri: str

The ID of the uploaded file, used to create the analysis task.

ttl instance-attribute

ttl: int

The waiting time for the scan to start after uploading the file (in seconds). If the analysis has not been started during this time, the file will be deleted.

BaseRequest

Bases: BaseModel

The base class for all Request models related to the sandbox.

Alias conventions

• Public API requests (api/): fields use snake_case names that match the API directly — no aliases needed.
• UI API requests (ui/): fields use snake_case Python names with serialization_alias="camelCase" so that dict() / json() produce the camelCase keys the UI API expects.

dict() and json() always exclude None fields and use aliases, because the API rejects requests containing null values.

BaseResponse

Bases: BaseModel

The base class for all Response models related to the sandbox.

Alias conventions

• All response models use alias="camelCase" for validation, since both Public and UI APIs return camelCase JSON keys.
• by_alias=True is not needed for responses (they are only parsed, not serialized back to the API), but dict() / json() on responses will use aliases by default via model_config.

Artifact

Bases: BaseModel

A file, email, or other object

type instance-attribute

type: ArtifactType

The type of the analyzed object

result class-attribute instance-attribute

result: SandboxResult | None = None

File analysis result

file_info class-attribute instance-attribute

file_info: FileInfo | None = None

Information about the scanned file

engine_results class-attribute instance-attribute

engine_results: list[EngineResult] | None = None

The results of checking the file with specific antiviruses or other components

artifacts class-attribute instance-attribute

artifacts: list[Artifact] | None = None

Files that are archived.

If the file sent for analysis is not an archive or the allowed decompression depth is exceeded, the artifacts array is empty.

network_objects instance-attribute

network_objects: list[NetworkObject]

Network objects (url, ip, domain)

FileInfo

Bases: BaseModel

Information about the scanned file

Filled in for binary objects

file_uri instance-attribute

file_uri: str

ID of the file used for downloading

file_path instance-attribute

file_path: str

The path to the file (excluding the root file of the structure), including its title.

For example, for the file readme.txt at the root of the archive archive.zip will be specified as the value of this field. readme.txt, is an empty value for the archive itself.

mime_type instance-attribute

mime_type: str

The MIME type of the artifact is determined during the verification process.

md5 instance-attribute

md5: str

MD5 hash of the file

sha1 instance-attribute

sha1: str

SHA1 hash of the file

sha256 instance-attribute

sha256: str

SHA256 hash of the file

ssdeep class-attribute instance-attribute

ssdeep: str | None = None

SSDEEP hash of the file

size instance-attribute

size: int

File size in bytes

FileInfoDetails

Bases: BaseModel

The type of the nested object depends on the type value.

ProcessDump

Bases: BaseModel

It is filled in for process memory dumps.

Type is equal to PROCESS_DUMP

process_name instance-attribute

process_name: str

The name of the process

process_id instance-attribute

process_id: int

The process ID (PID).

dump_trigger instance-attribute

dump_trigger: str

The reason for extracting the dump

dump_create_time instance-attribute

dump_create_time: float

Dump creation time

EngineResult

Bases: BaseModel

engine_subsystem instance-attribute

engine_subsystem: EngineSubsystem

The analysis method

engine_code_name instance-attribute

engine_code_name: str

The name of the antivirus or component

engine_version class-attribute instance-attribute

engine_version: str | None = None

Antivirus or component version

database_version class-attribute instance-attribute

database_version: str | None = None

Version of the antivirus database or knowledge base

database_time class-attribute instance-attribute

database_time: datetime | None = None

Time to update the antivirus database or knowledge base

result instance-attribute

result: SandboxResult

The result of an antivirus or other component check

detections class-attribute instance-attribute

detections: list[Detection] = Field(
    default_factory=list[Detection]
)

An array with a description of the detected malware

Details

Bases: BaseModel

sandbox class-attribute instance-attribute

sandbox: Sandbox | None = None

Detailed information about behavioral analysis (if enabled)

Sandbox

Bases: BaseModel

Detailed information about behavioral analysis (if enabled)

image instance-attribute

image: SandboxImageInfo

Information about the VM image

logs instance-attribute

logs: list[Log]

A copy of network traffic, video recording, event logs, graph, debug files, mail headers.

artifacts class-attribute instance-attribute

artifacts: list[Artifact] | None = None

Virtual machine artifacts are files created during behavioral analysis.

stages class-attribute instance-attribute

stages: list[Stage] = Field(default_factory=list[Stage])

The stages of bootkit analysis.

analysis_duration class-attribute instance-attribute

analysis_duration: float | None = None

The actual duration of the behavioral analysis in seconds

bootkitmon class-attribute instance-attribute

bootkitmon: bool | None = None

Was the bootkitmon analysis performed during BA

network_objects class-attribute instance-attribute

network_objects: list[NetworkObject] = Field(
    default_factory=list[NetworkObject]
)

Network objects (url, ip, domain)

suspicious_behaviors class-attribute instance-attribute

suspicious_behaviors: list[SuspiciousBehaviors] = Field(
    default_factory=list[SuspiciousBehaviors]
)

List of triggered correlation rules

Stage

Bases: BaseModel

The result of a single scan stage with bootkitmon

result instance-attribute

result: SandboxResult

The overall result of the check

detections class-attribute instance-attribute

detections: list[Detection] = Field(
    default_factory=list[Detection]
)

A list of BA detections at this stage

logs class-attribute instance-attribute

logs: list[Log] = Field(default_factory=list[Log])

A copy of network traffic, video recording, event logs, graph, debug files, mail headers

artifacts class-attribute instance-attribute

artifacts: list[Artifact] = Field(
    default_factory=list["Artifact"]
)

Virtual machine artifacts are files created during behavioral analysis.

analysis_duration class-attribute instance-attribute

analysis_duration: float | None = None

The actual duration of the behavioral analysis in seconds

suspicious_behaviors class-attribute instance-attribute

suspicious_behaviors: list[SuspiciousBehaviors] = Field(
    default_factory=list[SuspiciousBehaviors]
)

List of triggered correlation rules

find_sandbox_result

find_sandbox_result() -> EngineResult | None

Find and return the first result with behavioral logs Remained for backward compatibility

get_sandbox_results

get_sandbox_results() -> Iterable[EngineResult]

Get a list of all behavioral logs It is necessary for tasks with multiple sandbox images

Detection

Bases: BaseModel

Detected malware

detect instance-attribute

detect: str

Malware

threat instance-attribute

threat: str

Type of malware

FilterProperties

Bases: BaseModel

Filtering a group of files by properties to send to the sandbox for analysis

Log

Bases: BaseModel

A copy of network traffic, video recording, event logs, graph, debug files, mail headers.

type instance-attribute

type: LogType

Log type

file_uri instance-attribute

file_uri: str

ID of the file used for downloading

file_name instance-attribute

file_name: str

File name

NetworkObject

Bases: BaseModel

type instance-attribute

type: NetworkObjectType

Type of network object

value instance-attribute

value: str

The value of the network object

SandboxImageInfo

Bases: BaseModel

Information about the VM image

image_id class-attribute instance-attribute

image_id: str | None = Field(
    default=None,
    validation_alias=AliasChoices("image_id", "name", "id"),
)

ID of the VM image

The new UI began to return the name of the image. However, in the form of a name.

type class-attribute instance-attribute

type: SandboxImageType | None = None

The type of image.

version class-attribute instance-attribute

version: str | None = None

Version of the VM image

os class-attribute instance-attribute

os: OS | None = None

Information about the operating system of the virtual machine image

OS

Bases: BaseModel

Information about the operating system of the virtual machine

name instance-attribute

name: str

Name of the operating system

version instance-attribute

version: str

Operating system version

architecture instance-attribute

architecture: str

Processor architecture supported by the operating system

service_pack class-attribute instance-attribute

service_pack: str | None = Field(
    default=None,
    validation_alias=AliasChoices(
        "service_pack", "servicePack"
    ),
)

The name of the operating system update package

locale instance-attribute

locale: str

Operating system locale

SandboxResult

Bases: BaseModel

File analysis result

scan_state instance-attribute

scan_state: ScanState

Analysis status

duration instance-attribute

duration: float

The duration of the analsysis in seconds.

It is recorded only in the general results (in the JSON object data → result).

duration_full instance-attribute

duration_full: float

The duration of the check, taking into account the record in the database or the time of the request.

verdict class-attribute instance-attribute

verdict: Verdict | None = None

Analysis verdict

threat class-attribute instance-attribute

threat: str | None = None

Type of malware

errors class-attribute instance-attribute

errors: list[Error] = Field(default_factory=list[Error])

Errors that occurred during analysis.

SuspiciousBehaviors

Bases: BaseModel

The correlation rule

name instance-attribute

name: str

Name of the rule

version class-attribute instance-attribute

version: str | None = None

Version of the rule

mitre_threat_id class-attribute instance-attribute

mitre_threat_id: str = Field(
    validation_alias=AliasChoices(
        "mitre_threat_id", "mitreThreatId"
    )
)

The MITRE Threat ID

weight instance-attribute

weight: int

The weight of the rule (how much it affects the overall detection)

ArtifactType

Bases: SoftEnum

The type of the analyzed object

EngineSubsystem

Bases: SoftEnum

The analysis method

LogType

Bases: SoftEnum

NETWORK class-attribute instance-attribute

NETWORK = 'NETWORK'

A copy of the network traffic in PCAP format

SCREENSHOT class-attribute instance-attribute

SCREENSHOT = 'SCREENSHOT'

Snapshot or video recording from the virtual machine screen

EVENT_RAW class-attribute instance-attribute

EVENT_RAW = 'EVENT_RAW'

Raw events from system

EVENT_CORRELATED class-attribute instance-attribute

EVENT_CORRELATED = 'EVENT_CORRELATED'

Correlated events

EVENT_NORMALIZED class-attribute instance-attribute

EVENT_NORMALIZED = 'EVENT_NORMALIZED'

Normalized events

DEBUG class-attribute instance-attribute

DEBUG = 'DEBUG'

Debugging files

GRAPH class-attribute instance-attribute

GRAPH = 'GRAPH'

.graph file of the graph

ScanState

Bases: SoftEnum

Status of completed analysis

UNKNOWN class-attribute instance-attribute

UNKNOWN = 'UNKNOWN'

What happened?

PARTIAL class-attribute instance-attribute

PARTIAL = 'PARTIAL'

Partial check

FULL class-attribute instance-attribute

FULL = 'FULL'

Full check

UNSCANNED class-attribute instance-attribute

UNSCANNED = 'UNSCANNED'

The analysis was not carried out

Verdict

Bases: SoftEnum

CLEAN class-attribute instance-attribute

CLEAN = 'CLEAN'

No threats detected

UNWANTED class-attribute instance-attribute

UNWANTED = 'UNWANTED'

Potentially dangerous

DANGEROUS class-attribute instance-attribute

DANGEROUS = 'DANGEROUS'

Malicious object

UNKNOWN class-attribute instance-attribute

UNKNOWN = 'UNKNOWN'

Threats are unknown (missing from the documentation)

VNCMode

Bases: SoftEnum

DISABLED class-attribute instance-attribute

DISABLED = 'DISABLED'

Manual analysis is disabled

FULL class-attribute instance-attribute

FULL = 'FULL'

Manual analysis is enabled

READ_ONLY class-attribute instance-attribute

READ_ONLY = 'READ_ONLY'

Manual analysis in viewing mode only

SandboxArtifactsFilterValuesResponse

Bases: FilterValues

Possible values for filters based on sources and validation results

<URL>/api/ui/v2/tasks/filter-values

SandboxAVDistributionPacksResponse

Bases: BaseResponse

Response from /av-distribution-packs — list of AV distributions available for installation.

Data

Bases: BaseModel

License

Bases: BaseModel

extensions class-attribute instance-attribute

extensions: list[str] = Field(default_factory=list[str])

Possible file extensions for the license

multiple class-attribute instance-attribute

multiple: bool = False

Whether multiple license files are allowed

Requirements

Bases: BaseModel

os class-attribute instance-attribute

os: str | None = None

Required OS

bit class-attribute instance-attribute

bit: str | None = None

Required architecture

Installer

Bases: BaseModel

name class-attribute instance-attribute

name: str | None = None

Installer file/package name

DistributionPack

Bases: BaseModel

engine_code_name class-attribute instance-attribute

engine_code_name: str = Field(alias='engineCodeName')

AV engine code name

maintenance_status class-attribute instance-attribute

maintenance_status: str = Field(alias='maintenanceStatus')

Maintenance status

pack instance-attribute

pack: str

Pack name

version instance-attribute

version: str

AV version

SandboxAVEngineSettingsResponse

Bases: BaseResponse

Response from /av-engines/{item_id} — settings of a specific AV engine.

Data

Bases: BaseModel

licenses class-attribute instance-attribute

licenses: list[License] = Field(
    default_factory=list[License]
)

List of licenses

License

Bases: BaseModel

content class-attribute instance-attribute

content: str | None = None

License file content

name class-attribute instance-attribute

name: str | None = None

License file name

SandboxAVEnginesResponse

Bases: BaseResponse

Data

Bases: BaseModel

engines_info class-attribute instance-attribute

engines_info: dict[str, Engine] = Field(
    default_factory=dict, alias="enginesInfo"
)

Mapping of engine code name to engine info.

Known keys: kaspersky, bitdefender, symantec, eset, drweb, clamav, avast, avira. New engines may appear in future API versions without library updates.

Engine

Bases: BaseModel

distribution_type class-attribute instance-attribute

distribution_type: str = Field(alias='distributionType')

Distribution type

engine_update_time class-attribute instance-attribute

engine_update_time: int = Field(alias='engineUpdateTime')

The time of the last update of the antivirus engine

distribution_version class-attribute instance-attribute

distribution_version: str = Field(
    alias="distributionVersion"
)

Distribution version

is_installed class-attribute instance-attribute

is_installed: bool = Field(alias='isInstalled')

Antivirus is installed

engine_version class-attribute instance-attribute

engine_version: str = Field(alias='engineVersion')

Engine version

enabled instance-attribute

enabled: bool

Antivirus is enabled

errors class-attribute instance-attribute

errors: list[Error] = Field(default_factory=list[Error])

Antivirus errors

is_initializing class-attribute instance-attribute

is_initializing: bool = Field(alias='isInitializing')

Antivirus initialization status

is_ready class-attribute instance-attribute

is_ready: bool = Field(alias='isReady')

The antivirus is ready to work

database_time class-attribute instance-attribute

database_time: int = Field(alias='databaseTime')

The time of the last database update

license_expiration class-attribute instance-attribute

license_expiration: int = Field(alias='licenseExpiration')

License validity period

SandboxBaqueueTasksResponse

Bases: BaseModel

Listing of issues in the BA queue

total instance-attribute

total: int

The total number of tasks that meet the search conditions

tasks instance-attribute

tasks: list[Task]

Task list

Task

Bases: BaseModel

result_task_id class-attribute instance-attribute

result_task_id: str | None = Field(
    default=None, alias="resultTaskId"
)

ID of the task from which the result was taken

order_number class-attribute instance-attribute

order_number: int | None = Field(
    default=None, alias="orderNumber"
)

Sequence number in the queue (for unfinished tasks)

state instance-attribute

state: BaqueueState

Task status

priority instance-attribute

priority: int

Task priority

priority_name class-attribute instance-attribute

priority_name: str = Field(alias='priorityName')

String representation of task priority

entry_point_id class-attribute instance-attribute

entry_point_id: str = Field(alias='entryPointId')

Source ID

entry_point_type class-attribute instance-attribute

entry_point_type: EntryPointType = Field(
    alias="entryPointType"
)

Source Type

object_mime_type class-attribute instance-attribute

object_mime_type: str = Field(alias='objectMimeType')

The object's mime type

task_object_name class-attribute instance-attribute

task_object_name: str = Field(alias='taskObjectName')

Task Name

task_object_type class-attribute instance-attribute

task_object_type: str = Field(alias='taskObjectType')

The type of the task object (FILE, EMAIL, ...)

object_properties class-attribute instance-attribute

object_properties: list[str] = Field(
    alias="objectProperties"
)

List of file labels

image_id class-attribute instance-attribute

image_id: str | None = Field(default=None, alias='imageId')

ID of the BA image

planned_duration class-attribute instance-attribute

planned_duration: int = Field(alias='plannedDuration')

Planned analysis time (seconds)

bootkitmon_enable class-attribute instance-attribute

bootkitmon_enable: bool = Field(alias='bootkitmonEnable')

Is bootkitmon enabled or not

planned_bootkitmon_duration class-attribute instance-attribute

planned_bootkitmon_duration: int | None = Field(
    default=None, alias="plannedBootkitmonDuration"
)

Planned time of the second stage analysis (seconds)

planned_total_duration class-attribute instance-attribute

planned_total_duration: float | None = Field(
    default=None, alias="plannedTotalDuration"
)

Scheduled total time (main + bootkit + costs) - seconds

real_duration class-attribute instance-attribute

real_duration: float | None = Field(
    default=None, alias="realDuration"
)

Actual duration (seconds)

object_name class-attribute instance-attribute

object_name: str = Field(alias='objectName')

File Name

object_sha256 class-attribute instance-attribute

object_sha256: str = Field(alias='objectSha256')

sha256 file

object_sandbox_type class-attribute instance-attribute

object_sandbox_type: str = Field(alias='objectSandboxType')

Sandbox file type

save_video class-attribute instance-attribute

save_video: bool = Field(alias='saveVideo')

Is video saving enabled or not

convert_video class-attribute instance-attribute

convert_video: bool = Field(alias='convertVideo')

Is video conversion enabled or not

procdump_enable class-attribute instance-attribute

procdump_enable: bool = Field(alias='procdumpEnable')

Is procdump enabled or not

custom_command class-attribute instance-attribute

custom_command: str = Field(alias='customCommand')

A custom command to run

ts_created class-attribute instance-attribute

ts_created: float = Field(alias='tsCreated')

Task creation timestamp

ts_starting class-attribute instance-attribute

ts_starting: float | None = Field(
    default=None, alias="tsStarting"
)

Timestamp recruitment attempts

ts_started class-attribute instance-attribute

ts_started: float | None = Field(
    default=None, alias="tsStarted"
)

Timestamp of the start of work

ts_ready class-attribute instance-attribute

ts_ready: float | None = Field(
    default=None, alias="tsReady"
)

Readiness timestamp

ts_finished class-attribute instance-attribute

ts_finished: float | None = Field(
    default=None, alias="tsFinished"
)

Completion timestamp

estimated_ts_finished class-attribute instance-attribute

estimated_ts_finished: float | None = Field(
    default=None, alias="estimatedTsFinished"
)

Predicted completion time

error_text class-attribute instance-attribute

error_text: str | None = Field(
    default=None, alias="errorText"
)

The error text. In addition to the constants defined below, there may be any error text.

TIMEOUT_START_EXCEEDED, TIMEOUT_FINISH_EXCEEDED, TIMEOUT_DOOMED_TO_START

SandboxClusterStatusResponse

Bases: BaseModel

Cluster information

high_availability class-attribute instance-attribute

high_availability: bool = Field(alias='highAvailability')

High availability mode

sb_nodes class-attribute instance-attribute

sb_nodes: int = Field(alias='sbNodes')

Number of nodes

sb_nodes_available class-attribute instance-attribute

sb_nodes_available: int = Field(alias='sbNodesAvailable')

Number of available BA nodes

vms_count class-attribute instance-attribute

vms_count: int = Field(alias='vmsCount')

Number of VMs

vms_count_available class-attribute instance-attribute

vms_count_available: int = Field(alias='vmsCountAvailable')

Number of available VMs

nodes class-attribute instance-attribute

nodes: list[Node] = Field(default_factory=list[Node])

List of nodes

Node

Bases: BaseModel

ready instance-attribute

ready: bool

Node status

cpu instance-attribute

cpu: int

Number of cores

ram instance-attribute

ram: int

The amount of RAM in Bytes

vm_capacity class-attribute instance-attribute

vm_capacity: int = Field(alias='vmCapacity')

The number of traps per node. Total capacity.

vm_allocatable class-attribute instance-attribute

vm_allocatable: int = Field(alias='vmAllocatable')

The number of traps per node. Currently in use.

conditions instance-attribute

conditions: list[Condition]

Problematic conditions on the node Problematic conditions on the node will be shown here.

Examples of conditions:

[
    { "message": "Calico is not running on this node", "type": "NetworkUnavailable" },
    { "message": "kubelet has unsufficient memory available", "type": "MemoryPressure" },
    { "message": "kubelet has disk pressure", "type": "DiskPressure" },
    { "message": "Kubelet stopped posting node status.", "type": "Ready" }
]

total_pods class-attribute instance-attribute

total_pods: int = Field(alias='totalPods')

The total number of pods per node

running_pods class-attribute instance-attribute

running_pods: int | None = Field(
    default=None, alias="runningPods"
)

The number of working pods on the node

roles instance-attribute

roles: list[str]

Node labels

Info

Bases: BaseModel

System Information: Component versions

kubernetes instance-attribute

kubernetes: str

Kubernetes version

container_runtime class-attribute instance-attribute

container_runtime: str = Field(alias='containerRuntime')

Containerd version

vm_cpu class-attribute instance-attribute

vm_cpu: int = Field(alias='vmCpu')

The number of cores allocated for the BA

vm_ram class-attribute instance-attribute

vm_ram: int = Field(alias='vmRam')

The amount of RAM allocated for the BA in Bytes

CorrelationInfo

Bases: BaseModel

Information about correlation

state instance-attribute

state: ScanState

The state of correlation

threat_classification class-attribute instance-attribute

threat_classification: ThreatClassification = Field(
    alias="threatClassification"
)

Object classification (VIRUS, SPAM, WORM, etc.)

threat_level class-attribute instance-attribute

threat_level: Verdict = Field(alias='threatLevel')

Threat level

threat_platform class-attribute instance-attribute

threat_platform: ThreatPlatform = Field(
    alias="threatPlatform"
)

Artifact Platform

verdict_priority class-attribute instance-attribute

verdict_priority: int | None = Field(
    default=None, alias="verdictPriority"
)

Threat priority

EntryPoint

Bases: BaseModel

Where did the task come from

id instance-attribute

id: str

Source ID

type instance-attribute

type: EntryPointType

Source Type

status instance-attribute

status: EntryPointStatus

Completion status

action instance-attribute

action: EntryPointAction

Type of action

quarantine instance-attribute

quarantine: Quarantine

Quarantine status

client_ip class-attribute instance-attribute

client_ip: str = Field(alias='clientIp')

The client's IP address

check_me class-attribute instance-attribute

check_me: CheckMe | None = None

Information about the sender and recipients

Quarantine

Bases: BaseModel

state instance-attribute

state: QuarantineState

Quarantine state

events class-attribute instance-attribute

events: list[QuarantineEvent] = Field(
    default_factory=list[QuarantineEvent]
)

List of quarantine events. Filled in only in API /summary, there is no such field in the listing.

QuarantineEvent

Bases: BaseModel

time instance-attribute

time: int

Event creation time (UNIX timestamp)

user_id class-attribute instance-attribute

user_id: str | None = Field(default=None, alias='userId')

User ID (for SEND only)

smtp_host class-attribute instance-attribute

smtp_host: str | None = Field(
    default=None, alias="smtpHost"
)

SMTP Host (for SEND only)

smtp_port class-attribute instance-attribute

smtp_port: int | None = Field(
    default=None, alias="smtpPort"
)

SMTP Port (for SEND only)

recipients class-attribute instance-attribute

recipients: list[str] | None = None

List of recipients (for SEND only)

CheckMe

Bases: BaseModel

from_address class-attribute instance-attribute

from_address: str = Field(alias='fromAddress')

The sender received from the SMTP session (the 'MAIL FROM' command)

recipients instance-attribute

recipients: list[str]

The list of recipients received from the SMTP session (the 'RCPT TO' command)

ICAP

Bases: BaseModel

method instance-attribute

method: str

ICAP method (RESPMOD, REQMOD)

url instance-attribute

url: str

ICAP address of the service

version instance-attribute

version: str

ICAP version

client_ip class-attribute instance-attribute

client_ip: str = Field(alias='clientIp')

ICAP header value: 'X-Client-IP'

client_username class-attribute instance-attribute

client_username: str = Field(alias='clientUsername')

ICAP header value: 'X-Client-Username'

DPI

Bases: BaseModel

src_ip class-attribute instance-attribute

src_ip: str = Field(alias='srcIp')

The IP address where the object was sent from

src_port class-attribute instance-attribute

src_port: int = Field(alias='srcPort')

PORT where the object was sent from

dst_ip class-attribute instance-attribute

dst_ip: str = Field(alias='dstIp')

The IP address where the object was sent to

dst_port class-attribute instance-attribute

dst_port: int = Field(default=..., alias='dstPort')

PORT where the object was sent to

proto instance-attribute

proto: str

Protocol. For HTTP or SMTP values, the corresponding keys are added.

SMTP

Bases: BaseModel

message_id class-attribute instance-attribute

message_id: str = Field(default=..., alias='messageId')

The EML value of the 'Message-Id' header

sender instance-attribute

sender: str

Sender of the received email header 'From'

MailAgent

Bases: BaseModel

from_address class-attribute instance-attribute

from_address: str = Field(alias='fromAddress')

The sender received from the SMTP session (the 'MAIL FROM' command)

recipients instance-attribute

recipients: list[str]

The list of recipients received from the SMTP session (the 'RCPT TO' command)

mail_results class-attribute instance-attribute

mail_results: list[MailResult] | None = Field(
    default=None, alias="mailResults"
)

The results are sent by mail. Filled in only in API /summary, there is no such field in the listing.

MailBcc

Bases: BaseModel

from_address class-attribute instance-attribute

from_address: str = Field(alias='fromAddress')

The sender received from the SMTP session (the 'MAIL FROM' command)

recipients instance-attribute

recipients: list[str]

The list of recipients received from the SMTP session (the 'RCPT TO' command)

FileInbox

Bases: BaseModel

src_path class-attribute instance-attribute

src_path: str = Field(alias='srcPath')

The original path to the file

dst_path class-attribute instance-attribute

dst_path: str = Field(alias='dstPath')

The path where the file was moved

FileMonitor

Bases: BaseModel

src_path class-attribute instance-attribute

src_path: str = Field(alias='srcPath')

The original path to the file

MailGateway

Bases: BaseModel

from_address class-attribute instance-attribute

from_address: str = Field(alias='fromAddress')

The sender received from the SMTP session (the 'MAIL FROM' command)

recipients instance-attribute

recipients: list[str]

The list of recipients received from the SMTP session (the 'RCPT TO' command)

mail_results class-attribute instance-attribute

mail_results: list[MailResult] | None = Field(
    default=None, alias="mailResults"
)

The results are sent by mail. Filled in only in API /summary, there is no such field in the listing.

PTNAD

Bases: BaseModel

src_ip class-attribute instance-attribute

src_ip: str = Field(alias='srcIp')

The IP address where the object was sent from

src_port class-attribute instance-attribute

src_port: int = Field(alias='srcPort')

PORT where the object was sent from

dst_ip class-attribute instance-attribute

dst_ip: str = Field(default=..., alias='dstIp')

The IP address where the object was sent to

dst_port class-attribute instance-attribute

dst_port: int = Field(default=..., alias='dstPort')

PORT where the object was sent to

ref instance-attribute

ref: str

Link to the PTNAD session

proto instance-attribute

proto: str

Protocol

ClientWebInfo

Bases: BaseModel

user_agent class-attribute instance-attribute

user_agent: str = Field(alias='userAgent')

The value of the HTTP header 'User-Agent'

x_forwarded_for class-attribute instance-attribute

x_forwarded_for: str = Field(alias='xForwardedFor')

The value of the HTTP header 'X-Forwarded-For' is used to determine the IP of the HTTP client

referer instance-attribute

referer: str

The value of the HTTP 'Referer' header, from which page the request was sent

EntryPointToken

Bases: BaseModel

id instance-attribute

id: int

ID of the token in the Postgres database

name instance-attribute

name: str

Token name

deleted class-attribute instance-attribute

deleted: float | None = Field(default=None)

UNIX time the time of token deletion

Error

Bases: BaseModel

duration class-attribute instance-attribute

duration: int | None = None

Waiting time

ErrorWithLimit

Bases: Error

limit_size class-attribute instance-attribute

limit_size: int | None = Field(
    default=None, alias="limitSize"
)

The value of the restriction

FilterValues

Bases: BaseModel

entry_points class-attribute instance-attribute

entry_points: list[EntryPoint] = Field(alias='entryPoints')

Possible values for filters by source

threat_classifications class-attribute instance-attribute

threat_classifications: list[str] = Field(
    alias="threatClassifications"
)

Possible values for filters based on the analysis result

properties instance-attribute

properties: list[str]

Possible values for filters by file properties

categories instance-attribute

categories: list[str]

Possible values for filters by link category

HTTPDescription

Bases: BaseModel

referer instance-attribute

referer: str

The value of the HTTP 'Referer' header, from which page the request was sent

user_agent class-attribute instance-attribute

user_agent: str = Field(alias='userAgent')

The value of the HTTP header 'User-Agent'

host instance-attribute

host: str

The value of the HTTP header 'Host'

uri instance-attribute

uri: str

Full request URL

SMTPDefaultRecord

Bases: BaseModel

SMTP connection settings

priority instance-attribute

priority: int

Priority for recording

Token

Bases: BaseModel

name instance-attribute

name: str

Name of the PublicAPI token.

Pattern: ^[a-zA-Z][a-zA-Z0-9-]{3,28}[a-zA-Z]$

comment class-attribute instance-attribute

comment: str | None = None

Comment on the token

permissions instance-attribute

permissions: list[TokenPermissions]

Token Access Rights

id instance-attribute

id: int

ID of the record in the database

creator_login class-attribute instance-attribute

creator_login: str = Field(alias='creatorLogin')

Login of the user who created the token

created instance-attribute

created: float

UNIX time the time of token creation

modified class-attribute instance-attribute

modified: float | None = None

UNIX time the time when the token comment was changed

deleted class-attribute instance-attribute

deleted: float | None = None

UNIX time the time of token deletion

EntryPoint

Bases: BaseModel

The entrypoint to which the api token is linked.

It is used for listing and for obtaining a specific token.

id instance-attribute

id: str

Entrypoint ID

name instance-attribute

name: str

Entrypoint name

SandboxComponentsResponse

Bases: BaseModel

Information about system components

Component

Bases: BaseModel

total_pods class-attribute instance-attribute

total_pods: int = Field(alias='totalPods')

How many pods are there in total

ready_pods class-attribute instance-attribute

ready_pods: int = Field(alias='readyPods')

How many are running

nodes instance-attribute

nodes: list[str]

The list of nodes running the component's pods

status instance-attribute

status: ComponentStatus

Component status

type instance-attribute

type: ComponentType

Component type

pods class-attribute instance-attribute

pods: list[Pod] = Field(default_factory=list[Pod])

List of pods

Pod

Bases: BaseModel

component_name class-attribute instance-attribute

component_name: str = Field(alias='componentName')

Which component does it belong to

ready instance-attribute

ready: bool

Ready status

node instance-attribute

node: str

The name of the node it is running on

error_reason class-attribute instance-attribute

error_reason: str = Field(alias='errorReason')

The type of error, if any

error_message class-attribute instance-attribute

error_message: str = Field(alias='errorMessage')

Error message, if any

uptime instance-attribute

uptime: int

Time elapsed since the container was launched (in seconds)

containers_running class-attribute instance-attribute

containers_running: int = Field(alias='containersRunning')

The number of working containers for a given hearth

containers_total class-attribute instance-attribute

containers_total: int = Field(alias='containersTotal')

The total number of containers specified in the pod specification (excluding init containers)

EntryPointRules

Bases: BaseModel

base_url class-attribute instance-attribute

base_url: str | None = Field(default=None, alias='baseUrl')

Web interface address

notify_destination class-attribute instance-attribute

notify_destination: str | None = Field(
    default=None, alias="notifyDistention"
)

Where to send notifications: to the sender or recipient

locale class-attribute instance-attribute

locale: str | None = None

Language

quarantine class-attribute instance-attribute

quarantine: bool | None = None

Use quarantine

scan_timeout class-attribute instance-attribute

scan_timeout: int | None = Field(
    default=None, alias="scanTimeout"
)

Timeout

max_execution_time class-attribute instance-attribute

max_execution_time: int | None = Field(
    default=None, alias="maxExecutionTime"
)

Maximum scan execution time

exclude_blocks class-attribute instance-attribute

exclude_blocks: list[str] | None = Field(
    default=None, alias="excludeBlocks"
)

Exclude mail addresses from blocking

max_unpack_level class-attribute instance-attribute

max_unpack_level: int | None = Field(
    default=None, alias="maxUnpackLevel"
)

Archive unpacking depth

notify_domains class-attribute instance-attribute

notify_domains: list[str] | None = Field(
    default=None, alias="notifyDomains"
)

Email domains for notifications

notify_sender_message class-attribute instance-attribute

notify_sender_message: str | None = Field(
    default=None, alias="notifySenderMessage"
)

Message to sender

notify_recipient_message class-attribute instance-attribute

notify_recipient_message: str | None = Field(
    default=None, alias="notifyRecipientMessage"
)

Message to the recipient

send_notify class-attribute instance-attribute

send_notify: bool | None = Field(
    default=None, alias="sendNotify"
)

Sending notifications

background_dynamic_analysis class-attribute instance-attribute

background_dynamic_analysis: bool | None = Field(
    default=None, alias="backgroundDynamicAnalysis"
)

Dynamic scanning in the background

sandbox_enabled class-attribute instance-attribute

sandbox_enabled: bool | None = Field(
    default=None, alias="sandboxEnabled"
)

Sandbox scanning

save_clean_files class-attribute instance-attribute

save_clean_files: bool | None = Field(
    default=None, alias="saveCleanFiles"
)

Save non-dangerous files to the incubator

url_extract_enabled class-attribute instance-attribute

url_extract_enabled: bool | None = Field(
    default=None, alias="urlExtractEnabled"
)

Link Extraction

url_content_analysis_enabled class-attribute instance-attribute

url_content_analysis_enabled: bool | None = Field(
    default=None, alias="urlContentAnalysisEnabled"
)

Scanning content by links

url_heuristic_prefilter_enabled class-attribute instance-attribute

url_heuristic_prefilter_enabled: bool | None = Field(
    default=None, alias="urlHeuristicPrefilterEnabled"
)

Using heuristic analysis to scan links

url_patterns_included class-attribute instance-attribute

url_patterns_included: list[str] | None = Field(
    default=None, alias="urlPatternsIncluded"
)

List of domains for link scanning (wildcards are allowed)

url_patterns_excluded class-attribute instance-attribute

url_patterns_excluded: list[str] | None = Field(
    default=None, alias="urlPatternsExcluded"
)

List of domain exclusions for link scanning (wildcards are allowed)

url_limit_scanning_per_email class-attribute instance-attribute

url_limit_scanning_per_email: int | None = Field(
    default=None, alias="urlLimitScanningPerEmail"
)

Limit the number of scanned links per email

exclude_categories class-attribute instance-attribute

exclude_categories: list[list[str]] | None = Field(
    default=None, alias="excludeCategories"
)

A list of lists of url categories excluded from scanning

without_behavior_analysis_if_has_dangerous class-attribute instance-attribute

without_behavior_analysis_if_has_dangerous: bool | None = (
    Field(
        default=None,
        alias="withoutBehaviorAnalysisIfHasDangerous",
    )
)

Don't run behavioral analysis if a dangerous file is found in the task

without_behavior_analysis_if_has_suspicious class-attribute instance-attribute

without_behavior_analysis_if_has_suspicious: bool | None = (
    Field(
        default=None,
        alias="withoutBehaviorAnalysisIfHasSuspicious",
    )
)

Don't run behavioral analysis if a suspicious file is found in the task

auto_select_sandbox_enabled class-attribute instance-attribute

auto_select_sandbox_enabled: bool | None = Field(
    default=None, alias="autoSelectSandboxEnabled"
)

Sandbox scanning with auto-image selection

disarming_enabled class-attribute instance-attribute

disarming_enabled: bool | None = Field(
    default=None, alias="disarmingEnabled"
)

Enable email neutralization

disarming_by_conditions class-attribute instance-attribute

disarming_by_conditions: bool | None = Field(
    default=None, alias="disarmingByConditions"
)

Neutralize emails according to the conditions

disarming_from_senders class-attribute instance-attribute

disarming_from_senders: list[str] | None = Field(
    default=None, alias="disarmingFromSenders"
)

The list of senders whose emails need to be neutralized

disarming_to_recipients class-attribute instance-attribute

disarming_to_recipients: list[str] | None = Field(
    default=None, alias="disarmingToRecipients"
)

The list of recipients whose emails need to be neutralized

disarming_blocked_emails class-attribute instance-attribute

disarming_blocked_emails: bool | None = Field(
    default=None, alias="disarmingBlockedEmails"
)

Neutralize blocked emails

rules_scan_config class-attribute instance-attribute

rules_scan_config: ScanConfig | None = Field(
    default=None, alias="rulesScanConfig"
)

Custom rules for detection

enable_experimental_yara_rules class-attribute instance-attribute

enable_experimental_yara_rules: bool | None = Field(
    default=None, alias="enableExperimentalYaraRules"
)

Enable object verification using yara test rules

Sandbox

Bases: _SandboxInternal

image_name class-attribute instance-attribute

image_name: str = Field(alias='imageName')

Sandbox image name

SandboxMultiple

Bases: _SandboxInternal

image_names class-attribute instance-attribute

image_names: list[str] = Field(alias='imageNames')

A set of BA images for auto-selection

ScanConfig

Bases: BaseModel

rules class-attribute instance-attribute

rules: list[FileRule | FileInverseRule | URLRule] = Field(
    default_factory=list[
        FileRule | FileInverseRule | URLRule
    ]
)

List of custom detection rules

FileRule

Bases: _BaseRule

A custom rule for detecting files

file instance-attribute

file: File

A custom rule for detecting files

File

Bases: BaseModel

types instance-attribute

types: list[str]

List of file extensions to detect

name_patterns class-attribute instance-attribute

name_patterns: list[str] = Field(alias='namePatterns')

List of file name patterns for detection

mime_type_patterns class-attribute instance-attribute

mime_type_patterns: list[str] = Field(
    alias="mimeTypePatterns"
)

List of mime type patterns for detection

properties instance-attribute

properties: list[list[str]]

List of file properties for detection

FileInverseRule

Bases: _BaseRule

Inverse user rule for file detection

FileInverse

Bases: BaseModel

types instance-attribute

types: list[str]

List of file extensions to detect

name_patterns class-attribute instance-attribute

name_patterns: list[str] = Field(alias='namePatterns')

List of file name patterns for detection

mime_type_patterns class-attribute instance-attribute

mime_type_patterns: list[str] = Field(
    alias="mimeTypePatterns"
)

List of mime type patterns for detection

URLRule

Bases: _BaseRule

Custom rule for link detection

URL

Bases: BaseModel

categories_list class-attribute instance-attribute

categories_list: list[list[str]] = Field(
    alias="categoriesList"
)

List of lists by link category

EntryPointSettings

Bases: BaseModel

balancer_host class-attribute instance-attribute

balancer_host: str | None = Field(
    default=None, alias="balancerHost"
)

Balancer Host

balancer_port class-attribute instance-attribute

balancer_port: int | None = Field(
    default=None, alias="balancerPort"
)

Balancer port

destination_login class-attribute instance-attribute

destination_login: str | None = Field(
    default=None, alias="destinationLogin"
)

Login of the destination file resource

destination_options class-attribute instance-attribute

destination_options: str | None = Field(
    default=None, alias="destinationOptions"
)

Connection settings for the destination file resource

destination_password class-attribute instance-attribute

destination_password: str | None = Field(
    default=None, alias="destinationPassword"
)

Password of the destination file resource

destination_port class-attribute instance-attribute

destination_port: int | None = Field(
    default=None, alias="destinationPort"
)

The port of the destination file resource

destination_server class-attribute instance-attribute

destination_server: str | None = Field(
    default=None, alias="destinationServer"
)

Destination file resource address

destination_share_path class-attribute instance-attribute

destination_share_path: str | None = Field(
    default=None, alias="destinationSharePath"
)

The path to the destination file resource

destination_type class-attribute instance-attribute

destination_type: str | None = Field(
    default=None, alias="destinationType"
)

The type of the destination file resource

destination_version class-attribute instance-attribute

destination_version: str | None = Field(
    default=None, alias="destinationVersion"
)

Version of the destination file resource

destination_auth_type class-attribute instance-attribute

destination_auth_type: (
    Literal["NTLM", "KERBEROS"] | None
) = Field(default=None, alias="destinationAuthType")

The type of authentication when connecting to an SMB-share

destination_dc_ip class-attribute instance-attribute

destination_dc_ip: str | None = Field(
    default=None, alias="destinationDcIp"
)

Address of the domain controller

destination_use_ssl class-attribute instance-attribute

destination_use_ssl: bool | None = Field(
    default=None, alias="destinationUseSsl"
)

Use SSL when connecting to S3 file source

destination_ssl_check class-attribute instance-attribute

destination_ssl_check: bool | None = Field(
    default=None, alias="destinationSslChek"
)

Verifying the authenticity of an SSL certificate when connecting to an S3 file source

destination_s3_region class-attribute instance-attribute

destination_s3_region: str | None = Field(
    default=None, alias="destinationS3Region"
)

S3 Region

email class-attribute instance-attribute

email: str | None = Field(default=None, alias='email')

Mailing address

grpc_service_port class-attribute instance-attribute

grpc_service_port: int | None = Field(
    default=None, alias="grpcServicePort"
)

The port of the Mail Agent MTA management server

imap_auth_type class-attribute instance-attribute

imap_auth_type: str | None = Field(
    default=None, alias="imapAuthType"
)

The type of IMAP authentication

imap_host class-attribute instance-attribute

imap_host: str | None = Field(
    default=None, alias="imapHost"
)

IMAP server address

imap_port class-attribute instance-attribute

imap_port: int | None = Field(
    default=None, alias="imapPort"
)

IMAP server port

imap_use_ssl class-attribute instance-attribute

imap_use_ssl: bool | None = Field(
    default=None, alias="imapUseSsl"
)

Use ssl

smtp_is_enabled class-attribute instance-attribute

smtp_is_enabled: bool | None = Field(
    default=None, alias="smtpIsEnabled"
)

Send the result in a reply email

smtp_tls_method class-attribute instance-attribute

smtp_tls_method: (
    Literal["NO_TLS", "SMTP_TLS", "SOCKET_TLS"] | None
) = Field(default=None, alias="smtpTlsMethod")

TLS encryption method

login class-attribute instance-attribute

login: str | None = Field(default=None, alias='login')

Login

password class-attribute instance-attribute

password: str | None = Field(default=None, alias="password")

Password

port class-attribute instance-attribute

port: int | None = Field(default=None, alias='port')

Port

quarantine_login class-attribute instance-attribute

quarantine_login: str | None = Field(
    default=None, alias="quarantineLogin"
)

Login for quarantine

quarantine_options class-attribute instance-attribute

quarantine_options: str | None = Field(
    default=None, alias="quarantineOptions"
)

Quarantine parameters

quarantine_password class-attribute instance-attribute

quarantine_password: str | None = Field(
    default=None, alias="quarantinePassword"
)

Quarantine password

quarantine_port class-attribute instance-attribute

quarantine_port: int | None = Field(
    default=None, alias="quarantinePort"
)

Quarantine port

quarantine_server class-attribute instance-attribute

quarantine_server: str | None = Field(
    default=None, alias="quarantineServer"
)

Quarantine server

quarantine_share_path class-attribute instance-attribute

quarantine_share_path: str | None = Field(
    default=None, alias="quarantineSharePath"
)

Quarantine path to the directory

quarantine_type class-attribute instance-attribute

quarantine_type: str | None = Field(
    default=None, alias="quarantineType"
)

Type of quarantine

quarantine_version class-attribute instance-attribute

quarantine_version: str | None = Field(
    default=None, alias="quarantineVersion"
)

Quarantine version

quarantine_auth_type class-attribute instance-attribute

quarantine_auth_type: Literal["NTLM", "KERBEROS"] | None = (
    Field(default=None, alias="quarantineAuthType")
)

The type of authentication when connecting to an SMB-share

quarantine_dc_ip class-attribute instance-attribute

quarantine_dc_ip: str | None = Field(
    default=None, alias="quarantineDcIp"
)

Address of the domain controller

quarantine_use_ssl class-attribute instance-attribute

quarantine_use_ssl: bool | None = Field(
    default=None, alias="quarantineUseSsl"
)

Use SSL when connecting to S3 file source

quarantine_ssl_check class-attribute instance-attribute

quarantine_ssl_check: bool | None = Field(
    default=None, alias="quarantineSslChek"
)

Verifying the authenticity of an SSL certificate when connecting to an S3 file source

quarantine_s3_region class-attribute instance-attribute

quarantine_s3_region: str | None = Field(
    default=None, alias="quarantineS3Region"
)

S3 Region

scan_max_file_size class-attribute instance-attribute

scan_max_file_size: int | None = Field(
    default=None, alias="scanMaxFileSize"
)

Maximum size of the scanned file

source_login class-attribute instance-attribute

source_login: str | None = Field(
    default=None, alias="sourceLogin"
)

Login of the source file resource

source_options class-attribute instance-attribute

source_options: str | None = Field(
    default=None, alias="sourceOptions"
)

Source file resource settings

source_password class-attribute instance-attribute

source_password: str | None = Field(
    default=None, alias="sourcePassword"
)

The password of the source file resource

source_port class-attribute instance-attribute

source_port: int | None = Field(
    default=None, alias="sourcePort"
)

The port of the source file resource

source_server class-attribute instance-attribute

source_server: str | None = Field(
    default=None, alias="sourceServer"
)

The server address of the source file resource

source_share_path class-attribute instance-attribute

source_share_path: list[str] | None = Field(
    default=None, alias="sourceSharePath"
)

List of paths to the source file resource

source_type class-attribute instance-attribute

source_type: str | None = Field(
    default=None, alias="sourceType"
)

The type of the source file resource

source_version class-attribute instance-attribute

source_version: str | None = Field(
    default=None, alias="sourceVersion"
)

Version of the source file resource

source_use_ssl class-attribute instance-attribute

source_use_ssl: bool | None = Field(
    default=None, alias="sourceUseSsl"
)

Use SSL when connecting to S3 file source

source_ssl_check class-attribute instance-attribute

source_ssl_check: bool | None = Field(
    default=None, alias="sourceSslCheck"
)

Verifying the authenticity of an SSL certificate when connecting to an S3 file source

source_s3_region class-attribute instance-attribute

source_s3_region: str | None = Field(
    default=None, alias="sourceS3Region"
)

S3 Region

source_auth_type class-attribute instance-attribute

source_auth_type: Literal["NTLM", "KERBEROS"] | None = (
    Field(default=None, alias="sourceAuthType")
)

The type of authentication when connecting to an SMB-share

source_dc_ip class-attribute instance-attribute

source_dc_ip: str | None = Field(
    default=None, alias="sourceDcIp"
)

Address of the domain controller

use_tls class-attribute instance-attribute

use_tls: bool | None = Field(default=None, alias='useTls')

Use TLS

token class-attribute instance-attribute

token: EntryPointToken | None = None

API token

incoming_hosts class-attribute instance-attribute

incoming_hosts: list[str] | None = Field(
    default=None, alias="incomingHosts"
)

List of additional source IP addresses

whitelist_ips class-attribute instance-attribute

whitelist_ips: list[str] | None = Field(
    default=None, alias="whitelistIps"
)

The list of allowed IP addresses for connecting to the source.

Format: ip/cidr, if set without /cidr, we assume that this is a specific ip address.

Cidr can be set from 1 to 32.

use_whitelist_ips class-attribute instance-attribute

use_whitelist_ips: bool | None = Field(
    default=None, alias="useWhitelistIps"
)

Use the list of allowed IP addresses to connect to the source

processing_mode class-attribute instance-attribute

processing_mode: Literal["ASYNC", "SYNC"] | None = Field(
    default=None, alias="processingMode"
)

SMTP response mode to the client

process_x_original_to class-attribute instance-attribute

process_x_original_to: bool | None = Field(
    default=None, alias="processXOriginalTo"
)

Process the recipient's address from the X-Original-To header

SMTPSettings

Bases: BaseModel

Route

Bases: BaseModel

enabled instance-attribute

enabled: bool

On/Off Route

pattern instance-attribute

pattern: str

The template for the domain

Resolver

Bases: BaseModel

records class-attribute instance-attribute

records: list[SMTPDefaultRecord] = Field(
    default_factory=list[SMTPDefaultRecord]
)

Only available if type is "static"

ExtraBCCAddresses

Bases: BaseModel

enabled instance-attribute

enabled: bool

Enable email forwarding to additional recipient addresses

addresses class-attribute instance-attribute

addresses: list[str] = Field(default_factory=list[str])

Additional recipient addresses

SandboxCreateEntryPointRequest

Bases: BaseRequest

enabled class-attribute instance-attribute

enabled: bool = True

Status of the verification source

name instance-attribute

name: str

Name of the source

type instance-attribute

type: EntryPointType

Type of the source

SandboxEntryPointResponse

Bases: BaseResponse

EntryPoint

Bases: BaseModel

Information about the verification source

enabled instance-attribute

enabled: bool

Source status

errors instance-attribute

errors: list[str]

Errors

name instance-attribute

name: str

Source name

type instance-attribute

type: EntryPointType

Source type

target instance-attribute

target: str

The server address for verified mail

id instance-attribute

id: str

Unique name of the source

blocking_enabled class-attribute instance-attribute

blocking_enabled: bool | None = Field(
    default=None, alias="blockingEnabled"
)

Blocking mode

allow_blocking class-attribute instance-attribute

allow_blocking: bool | None = Field(
    default=None, alias="allowBlocking"
)

Allow email blocking notifications

settings class-attribute instance-attribute

settings: EntryPointSettings | None = None

Entry point settings

SandboxEntryPointsResponse

Bases: BaseResponse

EntryPoint

Bases: BaseModel

Information about the verification source

enabled instance-attribute

enabled: bool

Source status

errors instance-attribute

errors: list[str]

Errors

name instance-attribute

name: str

Source name

type instance-attribute

type: EntryPointType

Source type

target instance-attribute

target: str

The server address for verified mail

id instance-attribute

id: str

Unique name of the source

blocking_enabled class-attribute instance-attribute

blocking_enabled: bool | None = Field(
    default=None, alias="blockingEnabled"
)

Blocking mode

allow_blocking class-attribute instance-attribute

allow_blocking: bool | None = Field(
    default=None, alias="allowBlocking"
)

Allow email blocking notifications

sandbox_enabled class-attribute instance-attribute

sandbox_enabled: bool = Field(alias='sandboxEnabled')

Checking in the sandbox

token class-attribute instance-attribute

token: EntryPointToken | None = None

Token

SandboxEntryPointsTypesResponse

Bases: BaseResponse

List of possible sources to check

EntryPoint

Bases: BaseModel

allow_blocking class-attribute instance-attribute

allow_blocking: bool = Field(alias='allowBlocking')

Blocking mode

entrypoint_id class-attribute instance-attribute

entrypoint_id: str = Field(alias='entrypointId')

The unique name of the source

type instance-attribute

type: EntryPointType

Type of scan source

SandboxLicenseResponse

Bases: BaseResponse

License status and details

Data

Bases: BaseModel

state instance-attribute

state: LicenseStatus

License status - is there, is it expired

serial_number class-attribute instance-attribute

serial_number: str = Field(alias='serialNumber')

Serial number of the current license

UpdateStatus

Bases: BaseModel

Information about the last attempt to update the license

error instance-attribute

error: LicenseUpdateError

Error if the status is FAILED

license_update_time class-attribute instance-attribute

license_update_time: AwareDatetime = Field(
    alias="licenseUpdateTime"
)

When the license itself was updated, not when it was checked

product instance-attribute

product: Literal['Sandbox', 'MultiScanner']

Product type

License

Bases: BaseModel

entry_points class-attribute instance-attribute

entry_points: list[LicenseEntryPoint] = Field(
    alias="entryPoints"
)

Allowed entrypoints

expiration_time class-attribute instance-attribute

expiration_time: AwareDatetime = Field(
    alias="expirationTime"
)

License expiration date

external_av_engines class-attribute instance-attribute

external_av_engines: list[LicenseAvEngine] = Field(
    alias="externalAvEngines"
)

Allowed external engines

files_per_hour class-attribute instance-attribute

files_per_hour: int = Field(alias='filesPerHour')

Throughput capacity

grace_period class-attribute instance-attribute

grace_period: int = Field(alias='gracePeriod')

The number of grace period days in seconds

perpetual instance-attribute

perpetual: bool

Is the license permanent

internal_av_engines class-attribute instance-attribute

internal_av_engines: list[LicenseAvEngine] = Field(
    alias="internalAvEngines"
)

Allowed internal engines

is_entry_points_blocking_mode class-attribute instance-attribute

is_entry_points_blocking_mode: bool = Field(
    alias="isEntryPointsBlockingMode"
)

Is blocking mode allowed?

license_version class-attribute instance-attribute

license_version: int = Field(
    default=2, alias="licenseVersion"
)

License version

nodes_limit class-attribute instance-attribute

nodes_limit: NodesLimit = Field(alias='nodesLimit')

Maximum number of nodes by type

number instance-attribute

number: int

License number issued

performance class-attribute instance-attribute

performance: list[Performance] = Field(
    default_factory=list[Performance]
)

Bandwidth by traffic type

Performance

Bases: BaseModel

Bandwidth by traffic type

Sandbox

Bases: BaseModel

enabled instance-attribute

enabled: bool

Is behavioral analysis allowed?

images instance-attribute

images: list[str]

Images that can be used in behavioral analysis

Telemetry

Bases: BaseModel

enabled instance-attribute

enabled: bool

Is telemetry enabled

SandboxLicenseUpdateResponse

Bases: BaseResponse

License update attempt status

SandboxScansResponse

Bases: BaseModel

Scan results

StorageItem

Bases: TypedDict

A small abstraction that allows you to better type an object

SandboxSystemSettingsResponse

Bases: BaseResponse

System Settings

Data

Bases: BaseModel

Telemetry

Bases: BaseModel

enabled instance-attribute

enabled: bool

Telemetry status

SIEMNotifier

Bases: BaseModel

enabled instance-attribute

enabled: bool

Status of event collection and analysis

host instance-attribute

host: str

Syslog Server

port instance-attribute

port: int

Port syslog server

transport_protocol class-attribute instance-attribute

transport_protocol: Literal["tcp", "udp"] = Field(
    alias="transportProtocol"
)

Transmission protocol

audit_enabled class-attribute instance-attribute

audit_enabled: bool = Field(alias='auditEnabled')

Send audit events to the system log

CybsiNotifier

Bases: BaseModel

enabled instance-attribute

enabled: bool

Enabling/disabling sending reports to Cybsi

api_url class-attribute instance-attribute

api_url: str = Field(alias='apiUrl')

Cybsi URL API

api_key class-attribute instance-attribute

api_key: str = Field(alias='apiKey')

Key for the Cybsi API

share_level class-attribute instance-attribute

share_level: Literal["White", "Green", "Amber", "Red"] = (
    Field(alias="shareLevel")
)

The access level applied to all artifacts

upload_strategy class-attribute instance-attribute

upload_strategy: UploadStrategy = Field(
    alias="uploadStrategy"
)

The rule for uploading artifacts

EmailNotifier

Bases: BaseModel

enabled instance-attribute

enabled: bool

Enabling/disabling the sending of notifications by mail

notify_unwanted class-attribute instance-attribute

notify_unwanted: bool = Field(alias='notifyUnwanted')

Notification of unwanted objects

locale instance-attribute

locale: str

Locale for generated messages

sender_address class-attribute instance-attribute

sender_address: str = Field(alias='senderAddress')

Sender's address

recipients instance-attribute

recipients: list[str]

List of recipient addresses

smtp_default_records class-attribute instance-attribute

smtp_default_records: list[SMTPDefaultRecord] = Field(
    alias="smtpDefaultRecords"
)

List of mail servers

Authentication

Bases: BaseModel

anonymous_deny class-attribute instance-attribute

anonymous_deny: bool = Field(alias='anonymousDeny')

Anonymous analysis is prohibited

Unpacker

Bases: BaseModel

passwords instance-attribute

passwords: list[str]

List of passwords for unpacking password-protected archives

EventCombiner

Bases: BaseModel

events_eviction_days class-attribute instance-attribute

events_eviction_days: int = Field(
    alias="eventsEvictionDays"
)

Retention period of the verification history

Storage

Bases: BaseModel

Settings

Bases: BaseModel

bytes instance-attribute

bytes: int

Size in bytes

items instance-attribute

items: int

Number of files

Components

Bases: BaseModel

Component

Bases: BaseModel

Settings

Bases: BaseModel

bytes instance-attribute

bytes: int

Size in bytes

items instance-attribute

items: int

Number of files

Threshold

Bases: BaseModel

bytes_percent class-attribute instance-attribute

bytes_percent: int = Field(alias='bytesPercent')

Percentage of threshold in bytes

items_percent class-attribute instance-attribute

items_percent: int = Field(alias='itemsPercent')

The percentage of the threshold in the number of files

Quarantine

Bases: BaseModel

retention_period class-attribute instance-attribute

retention_period: int = Field(alias='retentionPeriod')

Storage period in quarantine

use_smtp class-attribute instance-attribute

use_smtp: bool = Field(alias='useSMTP')

Use a backup mail server to forward emails

smtp_default_records class-attribute instance-attribute

smtp_default_records: list[SMTPDefaultRecord] = Field(
    alias="smtpDefaultRecords"
)

List of mail servers

Retro

Bases: BaseModel

enabled instance-attribute

enabled: bool

The status of the retro check

SandboxSystemStatusResponse

Bases: BaseModel

System events are returned here with information about the current state of the system, i.e. a slice of the current state.

The event may relate to a specific object, in this case the ObjectId field is filled in. Basically, the event codes indicate a specific problem. Some events may contain additional parameters. For example AV_ENGINE_IN_NOT_GENERAL_AVAILABILITY

Description of current errors:

• AV_ENGINE_IN_NOT_GENERAL_AVAILABILITY - the engine is approaching or becoming unavailable. The ObjectId specifies the name of the engine. Example of parameters

  {
      "engineCodeName": "clamav",
      "distributionPack": "...",
      "distributionVersion": "1.1.1",
      "maintenanceStatus": "END_OF_SUPPORT"
  }
  

• STORAGE_CAPACITY_EXCEEDED_COMPONENTS_MAX_SIZE_BYTES - Exceeding limits for a specific component

• STORAGE_CAPACITY_EXCEEDED_MINIMUM - Exceeding the total minimum required free space

• COMPONENT_CAPACITY_EXCEEDED_THRESHOLD - Exceeding the threshold for free space for a specific component (ObjectId)

• COMPONENT_CAPACITY_EXCEEDED_MAX_SIZE - Exceeding the limit for a specific component (ObjectId) A list of possible components, similar to the Settings API: ['incubator', 'quarantine', 'system', 'sandbox_images']

• SANDBOX_RECONFIGURING - The configuration is being performed.

• NODE_IS_NOT_READY - The node is unavailable (with the not ready status). The ObjectId contains the node name. The parameters indicate the time from which the status changed.

  {
      "since": 1111111.0
  }
  

• COMPONENT_ERROR - An error in specific components of the group. The ObjectId specifies a group of components. Example:

  {
      "code": "COMPONENT_ERROR",
      "group": "SANDBOX",
      "level": "ERROR",
      "objectId": "SANDBOX",
      "params": {
          "sb-worker-1": {
              "error_codes": [
                  "OFFLINE"
              ]
          },
          "traps-resource-plugin": {
              "error_codes": [
                  "OFFLINE"
              ]
          }
      }
      ...
  }
  

  This error should be interpreted roughly as: An error of the "SANDBOX" subsystem. Affected components: "sb-worker-1", "traps-resource-plugin"

• COMPONENT_PARTIALLY_AVAILABLE - Similar to COMPONENT_ERROR, only it's about the unavailability of a part of the pod, or a decrease in performance

• NEW_VERSION_AVAILABLE - A new version is available. The ObjectId specifies the version

• NEW_VERSION_INSTALLATION_SCHEDULED - A new version is available and it is scheduled for installation. The ObjectId specifies the version. In the settings, the scheduled installation time is

  {
      "time": 1111111
  }
  

• END_OF_SUPPORT_SOON - Support for the END_OF_SUPPORT version will end soon - Support for the version has been discontinued in params

  {
      "eosTs": 1111111
  }
  

• IMAGE_INSTALL_ERROR - Error when installing the image, the name of the image is entered in the ObjectId.

• NODE_HAVE_ERROR - There are errors on the node. The ObjectId contains the node name. The error types are specified in the parameters.

  {
      "error_types": ["NetworkUnavailable", "MemoryPressure", "DiskPressure"]
  }
  

Event

Bases: BaseModel

group instance-attribute

group: SystemGroup

Group (subsystem)

code instance-attribute

code: SystemCode

Event/Error code

object_id class-attribute instance-attribute

object_id: str = Field(alias='objectId')

The object's ID. It can be an empty string for general events.

level instance-attribute

level: Literal['INFO', 'WARNING', 'ERROR']

Event/Error level

created_ts class-attribute instance-attribute

created_ts: int = Field(alias='createdTs')

Time when the event was created

updated_ts class-attribute instance-attribute

updated_ts: int = Field(alias='updatedTs')

Event update Time

params class-attribute instance-attribute

params: dict[str, Any] = {}

Additional event parameters

SandboxUpdateSystemSettingsRequest

Bases: BaseRequest

SIEMNotifier

Bases: BaseModel

enabled class-attribute instance-attribute

enabled: bool | None = None

Status of event collection and analysis

host class-attribute instance-attribute

host: str | None = None

Syslog Server

port class-attribute instance-attribute

port: int | None = None

Port syslog server

transport_protocol class-attribute instance-attribute

transport_protocol: Literal["tcp", "udp"] | None = Field(
    default=None, serialization_alias="transportProtocol"
)

Transmission protocol

audit_enabled class-attribute instance-attribute

audit_enabled: bool | None = Field(
    default=None, serialization_alias="auditEnabled"
)

Send audit events to the system log

CybsiNotifier

Bases: BaseModel

enabled class-attribute instance-attribute

enabled: bool | None = None

Enabling/disabling sending reports to Cybsi

api_url class-attribute instance-attribute

api_url: str | None = Field(
    default=None, serialization_alias="apiUrl"
)

Cybsi URL API

api_key class-attribute instance-attribute

api_key: str | None = Field(
    default=None, serialization_alias="apiKey"
)

Key for the Cybsi API

share_level class-attribute instance-attribute

share_level: (
    Literal["White", "Green", "Amber", "Red"] | None
) = Field(default=None, serialization_alias="shareLevel")

The access level applied to all artifacts

upload_strategy class-attribute instance-attribute

upload_strategy: UploadStrategy | None = Field(
    default=None, serialization_alias="uploadStrategy"
)

The rule for uploading artifacts

EmailNotifier

Bases: BaseModel

enabled instance-attribute

enabled: bool

Enabling/disabling the sending of notifications by mail

notify_unwanted class-attribute instance-attribute

notify_unwanted: bool = Field(
    serialization_alias="notifyUnwanted"
)

Notification of unwanted objects

locale instance-attribute

locale: str

Locale for generated messages

sender_address class-attribute instance-attribute

sender_address: str = Field(
    serialization_alias="senderAddress"
)

Sender's address

recipients instance-attribute

recipients: list[str]

List of recipient addresses

smtp_default_records class-attribute instance-attribute

smtp_default_records: list[SMTPDefaultRecord] = Field(
    serialization_alias="smtpDefaultRecords"
)

List of mail servers

Authentication

Bases: BaseModel

anonymous_deny class-attribute instance-attribute

anonymous_deny: bool = Field(
    serialization_alias="anonymousDeny"
)

Anonymous analysis is prohibited

Unpacker

Bases: BaseModel

passwords instance-attribute

passwords: list[str]

List of passwords for unpacking password-protected archives

EventCombiner

Bases: BaseModel

events_eviction_days class-attribute instance-attribute

events_eviction_days: int = Field(
    serialization_alias="eventsEvictionDays"
)

Retention period of the verification history

Storage

Bases: BaseModel

Components

Bases: BaseModel

Component

Bases: BaseModel

Settings

Bases: BaseModel

bytes class-attribute instance-attribute

bytes: int | None = None

Size in bytes

items class-attribute instance-attribute

items: int | None = None

Number of files

Quarantine

Bases: BaseModel

retention_period class-attribute instance-attribute

retention_period: int | None = Field(
    default=None, serialization_alias="retentionPeriod"
)

Storage period in quarantine

use_smtp class-attribute instance-attribute

use_smtp: bool | None = Field(
    default=None, serialization_alias="useSMTP"
)

Use a backup mail server to forward emails

smtp_default_records class-attribute instance-attribute

smtp_default_records: list[SMTPDefaultRecord] | None = (
    Field(
        default=None,
        serialization_alias="smtpDefaultRecords",
    )
)

List of mail servers

Retro

Bases: BaseModel

enabled instance-attribute

enabled: bool

The status of the retro check

SandboxTasksFilterValuesResponse

Bases: FilterValues

Possible values for filters based on sources and validation results

<URL>/api/ui/v2/tasks/filter-values

SandboxTasksSummaryResponse

Bases: BaseModel

Information about a specific task

<URL>/api/ui/v2/tasks/{scanId}/summary

SandboxUITasksResponse

Bases: BaseModel

Tasks listing

<URL>/api/ui/v2/tasks

tasks instance-attribute

tasks: list[Task]

Array of tasks

current_cursor class-attribute instance-attribute

current_cursor: str = Field(alias='currentCursor')

The cursor for pagination, points to the data after the first record (if any)

next_cursor class-attribute instance-attribute

next_cursor: str = Field(alias='nextCursor')

The cursor is for pagination, if the line is empty, then there is no more data. Indicates the data after the last record

Task

Bases: BaseModel

id instance-attribute

id: UUID

Task ID

name instance-attribute

name: str

Task Name

object_type class-attribute instance-attribute

object_type: FileInfoTypes = Field(alias='objectType')

Object type

start instance-attribute

start: datetime

Task creation time (UNIX timestamp)

correlation class-attribute instance-attribute

correlation: CorrelationInfo | None = None

The overall verdict of the product on the file. It's based on the sandbox, so it is on antiviruses and the result of static analysis.

sandbox_correlation class-attribute instance-attribute

sandbox_correlation: CorrelationInfo | None = Field(
    default=None, alias="sandboxCorrelation"
)

The verdict is exclusively sandbox

entry_point class-attribute instance-attribute

entry_point: EntryPoint = Field(alias='entryPoint')

Where did the task come from

start_time class-attribute instance-attribute

start_time: float = Field(alias='startTime')

Task creation time (float UNIX timestamp)

processed_time class-attribute instance-attribute

processed_time: float = Field(alias='processedTime')

Task execution time (float UNIX timestamp)

verdict_time class-attribute instance-attribute

verdict_time: float = Field(alias='verdictTime')

Task verdict time (float UNIX timestamp)

SandboxCreateTokenResponse

Bases: Token

token instance-attribute

token: str

The secret value of the token, which is shown only when creating a new PublicAPI token.

key instance-attribute

key: str

Hash of the secret value

SandboxTokensResponse

Bases: BaseModel

Listing of current Public API tokens

total instance-attribute

total: int

The number of tokens in the system

entries class-attribute instance-attribute

entries: list[Token] = Field(default_factory=list[Token])

List of tokens

SandboxInfo

Bases: BaseModel

analysis_duration class-attribute instance-attribute

analysis_duration: int = Field(alias='analysisDuration')

Duration of behavioral analysis

analysis_planned_duration class-attribute instance-attribute

analysis_planned_duration: int = Field(
    alias="analysisPlannedDuration"
)

Planned duration of the analysis

dpi_rules_version class-attribute instance-attribute

dpi_rules_version: str = Field(alias='dpiRulesVersion')

PT DPI rules version

correlation_rules_version class-attribute instance-attribute

correlation_rules_version: str = Field(
    alias="correlationRulesVersion"
)

Version of the correlation rules

mitm instance-attribute

mitm: bool

Was MITM enabled during the scan?

file_type class-attribute instance-attribute

file_type: str | None = Field(
    default=None, alias="fileType"
)

What type of file was launched with

File type (apparently, how the sandbox decided)

image_info class-attribute instance-attribute

image_info: SandboxImageInfo = Field(alias='imageInfo')

Image Information

auto_select class-attribute instance-attribute

auto_select: bool = Field(alias='autoSelect')

Was the image selected automatically

suspicious_behaviors class-attribute instance-attribute

suspicious_behaviors: list[SuspiciousBehaviors] = Field(
    alias="suspiciousBehaviors"
)

List of suspicious rules

detections instance-attribute

detections: list[DetectionUI]

List of malware rules

bootkitmon instance-attribute

bootkitmon: bool

Was bootkitmon enabled during the scan?

bootkitmon_stage class-attribute instance-attribute

bootkitmon_stage: BootkitmonStage | None = Field(
    default=None, alias="bootkitmonStage"
)

Type of bootkitmon analysis stage

stage_index class-attribute instance-attribute

stage_index: int = Field(alias='stageIndex')

The number of the bootkitmon analysis stage

MSDNError

Bases: BaseModel

name instance-attribute

name: str

MSDN name of the image initialization error

code instance-attribute

code: int

The MSDN number of the image initialization error

SandboxTreeResponse

Bases: BaseModel

has_more class-attribute instance-attribute

has_more: bool = Field(default=False, alias='hasMore')

If true, the number of records is greater than the limit and you can get additional ones using 'offset'

TreeNode

Bases: BaseModel

node_id class-attribute instance-attribute

node_id: int = Field(alias='nodeId')

The node ID. It starts from 1

parent_ids class-attribute instance-attribute

parent_ids: list[int] | None = Field(
    default=None, alias="parentIds"
)

A list of parent node IDs. It starts from the root

The chain! parents. 0 -> 1 -> 2 -> 3 <=> nodeId=3, parentIds=[0,1,2]

node_type class-attribute instance-attribute

node_type: TreeNodeType = Field(
    default=..., alias="nodeType"
)

Node Type

scans instance-attribute

scans: list[Scan]

List of scans

info instance-attribute

info: Info

Node information - hashes, file name, mime type

correlation class-attribute instance-attribute

correlation: CorrelationInfo | None = None

Correlation results

archive_info class-attribute instance-attribute

archive_info: ArchiveInfo | None = Field(
    default=None, alias="archiveInfo"
)

If the node is an archive, and the sandbox has managed to find a password, it will be in this field.

sandbox_info class-attribute instance-attribute

sandbox_info: SandboxInfo | None = Field(
    default=None, alias="sandboxInfo"
)

Sandbox-specific scan results

sandbox_correlated_info class-attribute instance-attribute

sandbox_correlated_info: SandboxCorrelatedInfo | None = (
    Field(default=None, alias="sandboxCorrelatedInfo")
)

Correlated sandbox result (filled in if sandbox_correlated_state != UNKNOWN)

scan_artifacts class-attribute instance-attribute

scan_artifacts: list[ScanArtifact] | None = Field(
    default=None, alias="scanArtifacts"
)

Sandbox artifacts: trails, events, graph, videos...

first_child_count class-attribute instance-attribute

first_child_count: int = Field(alias='firstChildCount')

Number of children of the first level

is_match class-attribute instance-attribute

is_match: bool | None = Field(default=None, alias="isMatch")

Used for the filtering API.

Does the node match the search conditions, if false, then it's just the parent element?

matched_fields class-attribute instance-attribute

matched_fields: list[list[str]] | None = Field(
    default=None, alias="matchedFields"
)

Used for the filtering API. The list of fields that fall under the text query

The path to the field, for example ['info', 'name']

SandboxDropInfo

Bases: BaseModel

bootkitmon instance-attribute

bootkitmon: bool

Was bootkitmon enabled during the scan?

bootkitmon_stage class-attribute instance-attribute

bootkitmon_stage: BootkitmonStage = Field(
    alias="bootkitmonStage"
)

ID of the bootkitmon analysis stage

stage_index class-attribute instance-attribute

stage_index: int | None = Field(alias='stageIndex')

The number of the bootkitmon analysis stage

graph_node_id class-attribute instance-attribute

graph_node_id: int | None = Field(alias='graphNodeId')

ID of the node in the BA graph

HTTPInfo

Bases: BaseModel

direction instance-attribute

direction: HTTPDirection

Direction of HTTP query

Request

Bases: BaseModel

user_agent class-attribute instance-attribute

user_agent: str = Field(alias='userAgent')

The value of the HTTP header 'User-Agent'

x_forwarded_for class-attribute instance-attribute

x_forwarded_for: str = Field(
    default=..., alias="xForwardedFor"
)

The value of the HTTP header 'X-Forwarded-For' is used to determine the IP of the HTTP client

referer instance-attribute

referer: str

The value of the HTTP 'Referer' header, from which page the request was sent

UnpackerInfo

Bases: BaseModel

state instance-attribute

state: ScanState

Unpacking status

DownloadUrlInfo

Bases: BaseModel

state instance-attribute

state: ScanState

Url loading status

version instance-attribute

version: str

Engine version

status_code class-attribute instance-attribute

status_code: int = Field(alias='statusCode')

Status code from the HTTP Status Line

reason_phrase class-attribute instance-attribute

reason_phrase: str = Field(alias='reasonPhrase')

The reason for the code from the HTTP Status Line

BwListsInfo

Bases: BaseModel

state instance-attribute

state: ScanState

Check status in WB lists

status instance-attribute

status: BlacklistStatus

The result of the check on the WB lists

hashes instance-attribute

hashes: list[HashType]

The type of hash for which a match was found in the WB lists

errors class-attribute instance-attribute

errors: list[Error] = Field(default_factory=list[Error])

Errors in checking by WB lists

CategorizerInfo

Bases: BaseModel

Result

Bases: BaseModel

state instance-attribute

state: ScanState

Check status in PTCategorizer

categories class-attribute instance-attribute

categories: list[str] = Field(default_factory=list[str])

PTCategorizer Categories

errors class-attribute instance-attribute

errors: list[Error] = Field(default_factory=list[Error])

PTCategorizer check errors

CacheInfo

Bases: BaseModel

source_scan_id class-attribute instance-attribute

source_scan_id: str | int = Field(alias='sourceScanId')

The original task ID

source_node_id class-attribute instance-attribute

source_node_id: int = Field(alias='sourceNodeId')

The source node ID

timestamp instance-attribute

timestamp: int

The time of creation of the initial task (UNIX timestamp)

NetworkObject

Bases: BaseModel

type instance-attribute

type: NetworkObjectType

Type of network object

value instance-attribute

value: str

The value of the network object

is_scanned class-attribute instance-attribute

is_scanned: bool = Field(alias='isScanned')

Has the network artifact been scanned?

ParentObjectInfo

Bases: BaseModel

type instance-attribute

type: FileInfoTypes

The type of artifact that the current node was derived from.

name instance-attribute

name: str

The name of the artifact from which the current node was derived.

ContextCrawlerInfo

Bases: BaseModel

url instance-attribute

url: str

The URL from which the file was received

engine_name class-attribute instance-attribute

engine_name: EngineName | None = None

The name of the engine used for downloading