Rescan

The sandbox can re-scan collected logs without the original sample (retro tasks). In the web interface, these appear as analysis results.

The following files are required for rescan:

drakvuf-trace.log.zst - events collected from the analysis system;
tcpdump.pcap - information about network interaction;

Code example

import asyncio
from pathlib import Path

from ptsandbox import Sandbox, SandboxKey


async def main():
    key = SandboxKey(
        name="test-key-1",
        key="<TOKEN_FROM_SANDBOX>",
        host="10.10.10.10",
    )

    sandbox = Sandbox(key)

    task = await sandbox.create_rescan(
        Path("./drakvuf-trace.log.zst"),
        Path("./tcpdump.pcap"),
    )

    result = await sandbox.wait_for_report(task)
    if (report := result.get_long_report()) is not None:
        print(report.artifacts)


asyncio.run(main())

Getting a report without additional waiting

To get the scan result immediately without waiting, set async_result=False. The sandbox returns the finished result in the same request.

task = await sandbox.create_rescan(
    Path("./drakvuf-trace.log.zst"),
    Path("./tcpdump.pcap"),
    async_result=False
)
print(task.get_long_report())

ptsandbox.sandbox.sandbox.Sandbox.create_rescan `async`

create_rescan(
    trace: str | Path | bytes | BytesIO,
    network: str | Path | bytes | BytesIO,
    /,
    *,
    rules: str | Path | bytes | BytesIO | None = None,
    priority: int = 3,
    short_result: bool = False,
    async_result: bool = True,
    read_timeout: int = 300,
    options: Options = SandboxBaseScanTaskRequest.Options(),
) -> SandboxBaseTaskResponse

Run a retro scan to check for detects without running a behavioral analysis.

It is useful if there is a trace from a malware that can't connect to C2C.

Or is it necessary to check the new correlation rules on the same trace.

Parameters:

trace (str | Path | bytes | BytesIO) –

path to drakvuf-trace.log.zst or just bytes
network (str | Path | bytes | BytesIO) –

path to tcpdump.pcap or just bytes
rules (str | Path | bytes | BytesIO | None, default: None ) –

if you have compiled the rules, then you can rescan with them, rather than using the sandbox embedded inside
priority (int, default: 3 ) –

the priority of the task, between 1 and 4. The higher it is, the faster it will get to work
short_result (bool, default: False ) –

Return only the overall result of the check.

The parameter value is ignored (true is used) if the value of the async_result parameter is also true.
async_result (bool, default: True ) –

Return only the scan_id.

Enabling this option may be usefull to send async requests for file checking.

You can receive full report in a separate request.
read_timeout (int, default: 300 ) –

response waiting time in seconds
options (Options, default: Options() ) –

additional sandbox options

Returns:

SandboxBaseTaskResponse –

The response from the sandbox is either with partial information (when using async_result), or with full information.

Raises:

SandboxUploadException –

if an error occurred when uploading files to the server
ClientResponseError –

if the server returns an error status
ClientError –

on connection or transport errors
ValidationError –

if the response body does not match the expected model

ptsandbox.sandbox.api._analysis.AnalysisMixin.create_rescan `async`

create_rescan(
    data: SandboxRescanTaskRequest, read_timeout: int = 300
) -> SandboxBaseTaskResponse