anyrun

README

ANY.RUN - Go Client

A complete, idiomatic Go client for the ANY.RUN API, covering both the Sandbox API v1 and the Threat Intelligence API v1 with full endpoint coverage, structured types, and clear error handling.

The client is built strictly from the official API documentation (api-documentation, SandboxV1.json, and TIV1.json) and uses only the Go standard library, there are zero external dependencies.

---

Installation

go get github.com/dabumana/anyrun-go

Quick Start

package main

import (
	"fmt"
	"log"

	anyrun "github.com/dabumana/anyrun-go"
)

func main() {
	// Create a client with your API key
	client := anyrun.NewClient("your-api-key")

	// Sandbox: submit a URL for analysis
	req := anyrun.NewCreateTaskRequest()
	req.ObjType = "url"
	req.ObjURL = "https://example.com"

	sub, err := client.SubmitTask(req)
	if err != nil {
		log.Fatal(err)
	}
	if sub.Error {
		log.Fatalf("API error: %s", sub.Message)
	}

	// Wait for completion using the status stream
	id := sub.TaskID
	if sub.Queued() {
		id = sub.QueueTaskID
	}
	if err := client.MonitorTask(id, func(ev anyrun.MonitorEvent) error {
		fmt.Printf("event: completed=%v error=%v message=%q\n", ev.Completed, ev.Error, ev.Message)
		return nil
	}); err != nil {
		log.Fatal(err)
	}

	// Fetch the full report
	report, err := client.GetReport(sub.TaskID)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Printf("verdict: %s\n", report.Data.Analysis.Scores.Verdict.ThreatLevelText)
}

Authentication

You must obtain an API key from ANY.RUN after registering. Pass it to NewClient; the client adds the API-Key prefix automatically:

client := anyrun.NewClient("your-api-key")

Client Configuration

You can customise the client with optional Option functions:

Option	Description
WithHTTPClient(*http.Client)	Use a custom HTTP client (e.g. with proxy or timeouts).
WithBaseURL(string)	Override the base URL (useful for testing or mirrors).

Example:

customClient := &http.Client{Timeout: 60 * time.Second}
client := anyrun.NewClient(
	"your-api-key",
	anyrun.WithHTTPClient(customClient),
	anyrun.WithBaseURL("https://api.any.run"),
)

The default client uses https://api.any.run with a 30-second timeout.

---

API Methods

The client implements all endpoints documented in the official API.

Sandbox API v1

Method	Endpoint	Description
GetHistory(team, skip, limit)	GET /v1/analysis/	List previous analysis tasks.
SubmitTask(*CreateTaskRequest)	POST /v1/analysis/	Submit a file or URL for analysis (multipart).
GetReport(taskUUID)	GET /v1/analysis/{taskUuid}	Fetch the full analysis report.
AddTime(taskUUID)	PATCH /v1/analysis/addtime/{taskUuid}	Add time to a running analysis.
StopTask(taskUUID)	PATCH /v1/analysis/stop/{taskUuid}	Stop a running analysis.
DeleteTask(taskUUID)	DELETE /v1/analysis/delete/{taskUuid}	Delete a task.
MonitorTaskStream(taskUUID) / MonitorTask(taskUUID, onEvent)	GET /v1/analysis/monitor/{taskUuid}	Stream task status events (SSE).
GetEnvironments()	GET /v1/environment/	List available analysis environments.
GetUserLimits()	GET /v1/user/	Get current user limits.
GetUserPresets()	GET /v1/user/presets	Get user presets.
GetIOCs(taskUUID)	GET /report/{taskUuid}/ioc/json	Fetch extracted IOCs for a task.

Threat Intelligence API v1

Method	Endpoint	Description
SearchThreatIntelligence(SearchRequest)	POST /v1/intelligence/api/search	Run a threat intelligence search.
StartYaraSearch(rule)	POST /v1/intelligence/yara-lookup/search	Start a YARA rule lookup.
GetYaraResults(queryID, offset, limit, sort)	GET /v1/intelligence/yara-lookup/search/{queryId}	Get matched samples for a YARA search.
StopYaraSearch(queryID)	DELETE /v1/intelligence/yara-lookup/search/{queryId}	Stop a YARA search.
GetYaraResultsCount(queryID)	GET /v1/intelligence/yara-lookup/search/{queryId}/count	Count matched samples.
DownloadYaraResults(queryID, format)	GET /v1/intelligence/yara-lookup/search/{queryId}/download/{format}	Download results in STIX format.
TaxiiDiscovery()	GET /v1/feeds/taxii2/	TAXII 2 discovery.
TaxiiGetAPIRoot()	GET /v1/feeds/taxii2/api1/	TAXII API root.
TaxiiGetCollections()	GET /v1/feeds/taxii2/api1/collections/	List TAXII collections.
TaxiiGetCollection(collectionID)	GET /v1/feeds/taxii2/api1/collections/{collectionId}/	Get a TAXII collection.
TaxiiGetManifest(collectionID, TaxiiManifestParams)	GET /v1/feeds/taxii2/api1/collections/{collectionId}/manifest	Get a TAXII manifest.
TaxiiGetObjects(collectionID, TaxiiObjectsParams)	GET /v1/feeds/taxii2/api1/collections/{collectionId}/objects/	Get TAXII objects.
TaxiiGetObject(collectionID, objectID)	GET /v1/feeds/taxii2/api1/collections/{collectionId}/objects/{objectId}	Get a single TAXII object.

TAXII manifest/objects methods also return the documented X-TAXII-Date-* headers as *TaxiiPageInfo.

Data Types

• CreateTaskRequest - Multipart submission request mirroring every documented field (obj_type, file, obj_url, env_*, opt_network_*, opt_privacy_type, opt_timeout, obj_ext_*, auto_confirm_uac, run_as_root, user_tags, ...). NewCreateTaskRequest() pre-fills the documented defaults.
• TaskSubmission / TaskMessageResponse - Submission and action results, including Error and Message fields.
• TaskHistory / TaskStatus - History entries and live monitor status objects, including verdicts, tags, hashes, and threats.
• ReportResponse / TaskReport - The full analysis report: analysis metadata, verdicts/scores, environments, processes, network activity, modified files/registry, incidents, MITRE mappings, and malware configs.
• SearchResponse - Threat intelligence search results with related files, URLs, DNS, IPs, incidents, and summary counts.
• YaraJobInfo / YaraSearchResults - YARA lookup job state and matched samples with hashes and process details.
• Taxii* - TAXII 2 discovery, API root, collections, manifests, and object envelopes.
• HTTPError - Error type returned for non-2xx responses.

All fields are tagged for JSON serialisation.

Error Handling

Non-2xx responses are returned as *HTTPError, containing the status code and the raw error body. API-level failures (e.g. submission errors) are exposed through the Error and Message fields on response types:

_, err := client.GetHistory(false, 0, 0)
if err != nil {
	switch e := err.(type) {
	case *anyrun.HTTPError:
		fmt.Printf("HTTP %d: %s\n", e.StatusCode, e.Body)
	default:
		fmt.Printf("Other error: %v\n", err)
	}
}

Examples

1. Submit a File

file, err := os.Open("malware.exe")
if err != nil {
	log.Fatal(err)
}
defer file.Close()

req := anyrun.NewCreateTaskRequest() // file, Windows 10 x64, complete environment
req.File = file
req.FileName = "malware.exe"
req.UserTags = "exe,trojan"

sub, err := client.SubmitTask(req)
if err != nil {
	log.Fatal(err)
}
fmt.Printf("task: %s\n", sub.TaskID)

1. Fetch IOCs

iocs, err := client.GetIOCs("task-uuid")
if err != nil {
	log.Fatal(err)
}
for _, ioc := range iocs {
	fmt.Printf("%s - %s\n", ioc.Category, ioc.IOC)
}

1. Threat Intelligence Search

resp, err := client.SearchThreatIntelligence(anyrun.SearchRequest{
	Query: `threatName:"RedLineStealer"`,
})
if err != nil {
	log.Fatal(err)
}
fmt.Printf("related files: %d\n", len(resp.RelatedFiles))

1. YARA Lookup

job, err := client.StartYaraSearch(`rule Detect { strings: $a = "evil" condition: $a }`)
if err != nil {
	log.Fatal(err)
}

results, err := client.GetYaraResults(job.QueryID, 0, 100, "")
if err != nil {
	log.Fatal(err)
}
for _, m := range results.Matches {
	fmt.Printf("%s (%s)\n", m.FileFullName, m.Hashes.SHA256)
}

---

Important Notes

• Authentication - Every request includes an Authorization: API-Key <key> header; NewClient adds the prefix for you.
• Environments - NewCreateTaskRequest() pre-fills the documented defaults (Windows 10 x64, complete environment, network enabled, 60-second timeout), so a bare SubmitTask works out of the box.
• Monitoring - Task monitoring is a text/event-stream; use MonitorTask for parsed MonitorEvents or MonitorTaskStream for the raw stream.
• IOCs - IOC extraction is a separate JSON endpoint and returns structured indicators (category, type, reputation, discovery entry).
• Dependencies - The package and its tests use only the Go standard library.

Documentation

Index

• Constants
• type Client
  • func NewClient(authKey string, opts ...Option) *Client
  • func (c *Client) AddTime(taskUUID string) (*TaskMessageResponse, error)
  • func (c *Client) DeleteTask(taskUUID string) (*TaskMessageResponse, error)
  • func (c *Client) DownloadYaraResults(queryID, format string) (*YaraLookupResultsStix, error)
  • func (c *Client) GetEnvironments() ([]TaskEnvironment, error)
  • func (c *Client) GetHistory(team bool, skip, limit int) (*TasksHistoryResponse, error)
  • func (c *Client) GetIOCs(taskUUID string) ([]IOC, error)
  • func (c *Client) GetReport(taskUUID string) (*ReportResponse, error)
  • func (c *Client) GetUserLimits() (*UserLimits, error)
  • func (c *Client) GetUserPresets() ([]UserPreset, error)
  • func (c *Client) GetYaraResults(queryID string, offset, limit int, sort string) (*YaraSearchResults, error)
  • func (c *Client) GetYaraResultsCount(queryID string) (*YaraSearchResultsCount, error)
  • func (c *Client) MonitorTask(taskUUID string, onEvent func(MonitorEvent) error) error
  • func (c *Client) MonitorTaskStream(taskUUID string) (io.ReadCloser, error)
  • func (c *Client) SearchThreatIntelligence(req SearchRequest) (*SearchResponse, error)
  • func (c *Client) StartYaraSearch(rule string) (*YaraJobInfo, error)
  • func (c *Client) StopTask(taskUUID string) (*TaskMessageResponse, error)
  • func (c *Client) StopYaraSearch(queryID string) (*YaraJobInfo, error)
  • func (c *Client) SubmitTask(req *CreateTaskRequest) (*TaskSubmission, error)
  • func (c *Client) TaxiiDiscovery() (*TaxiiDiscovery, error)
  • func (c *Client) TaxiiGetAPIRoot() (*TaxiiAPIRoot, error)
  • func (c *Client) TaxiiGetCollection(collectionID string) (*TaxiiCollection, error)
  • func (c *Client) TaxiiGetCollections() (*TaxiiCollections, error)
  • func (c *Client) TaxiiGetManifest(collectionID string, params TaxiiManifestParams) (*TaxiiManifest, *TaxiiPageInfo, error)
  • func (c *Client) TaxiiGetObject(collectionID, objectID string) (*TaxiiEnvelope, *TaxiiPageInfo, error)
  • func (c *Client) TaxiiGetObjects(collectionID string, params TaxiiObjectsParams) (*TaxiiEnvelope, *TaxiiPageInfo, error)
• type CountryCount
• type CreateTaskRequest
  • func NewCreateTaskRequest() *CreateTaskRequest
• type DestinationIP
• type DestinationIPASN
• type Event
• type EventsCounters
• type EventsCountersRaw
• type GetYaraResultsParams
• type HTTPError
  • func (e *HTTPError) Error() string
• type Hashes
• type HistoryParams
• type IOC
• type Industry
• type MainObject
• type MatchedSample
• type MatchedSampleHashes
• type MonitorEvent
• type ObjectTrid
• type Option
  • func WithBaseURL(baseURL string) Option
  • func WithHTTPClient(c *http.Client) Option
• type ParallelsLimit
• type Process
• type ProcessDump
• type ProcessScores
• type ProcessScoresSpecs
• type RelatedDNS
• type RelatedFile
• type RelatedIncident
• type RelatedNetworkThreat
• type RelatedSynchronizationObject
• type RelatedURL
• type ReportArtifact
• type ReportAutomatization
• type ReportConnection
• type ReportContent
• type ReportCounterFiles
• type ReportCounterNetwork
• type ReportCounterProcesses
• type ReportCounterRegistry
• type ReportCounterSync
• type ReportCounterSyncOp
• type ReportCounterSyncType
• type ReportCounters
• type ReportDNSRequest
• type ReportDebugString
• type ReportEnvironment
• type ReportEnvironmentIE
• type ReportEnvironmentOS
• type ReportEnvironments
  • func (re *ReportEnvironments) UnmarshalJSON(b []byte) error
• type ReportHTTPBody
• type ReportHTTPMessage
• type ReportHTTPRequest
• type ReportHotfix
• type ReportIncident
• type ReportIncidentEvent
• type ReportIncidentMitre
• type ReportLinks
• type ReportMainObject
• type ReportMainObjectInfo
• type ReportMalconf
• type ReportMalconfConfig
• type ReportMitre
• type ReportModified
• type ReportModifiedFile
• type ReportModifiedFileInfo
• type ReportModifiedRegistry
• type ReportNetwork
• type ReportOptions
• type ReportProcess
• type ReportProcessCert
• type ReportProcessContext
• type ReportProcessModule
• type ReportProcessResolvedCOM
• type ReportProcessResolvedCOMModule
• type ReportProcessScores
• type ReportProcessSpecs
• type ReportProcessSyncObject
• type ReportProcessTimes
• type ReportProcessVersionInfo
• type ReportResponse
• type ReportSandbox
• type ReportSandboxPlan
• type ReportScores
• type ReportSoftware
• type ReportSpecs
• type ReportTLSFingerprint
• type ReportThreat
• type ReportTor
• type ReportVerdict
• type Screenshot
• type SearchRequest
• type SearchResponse
• type SourceTask
• type Summary
• type SummaryDetails
• type Tag
  • func (t *Tag) UnmarshalJSON(b []byte) error
• type Tags
• type TaskEnvSoftware
• type TaskEnvironment
• type TaskEnvironmentIE
• type TaskEnvironmentSoft
• type TaskHistory
• type TaskMessageResponse
• type TaskReport
• type TaskReportAnalysis
• type TaskStatus
• type TaskStatusActions
• type TaskStatusEnvironment
• type TaskStatusEnvironmentOS
• type TaskStatusMainObject
• type TaskStatusMainObjectNames
• type TaskStatusObjects
• type TaskStatusOptions
• type TaskStatusPublic
• type TaskStatusScores
• type TaskStatusSpecs
• type TaskStatusTimes
• type TaskStatusVerdict
• type TaskSubmission
  • func (s *TaskSubmission) Queued() bool
  • func (s *TaskSubmission) UnmarshalJSON(b []byte) error
• type TasksHistoryResponse
• type TaxiiAPIRoot
• type TaxiiCollection
• type TaxiiCollections
• type TaxiiDiscovery
• type TaxiiEnvelope
• type TaxiiManifest
• type TaxiiManifestEntry
• type TaxiiManifestParams
• type TaxiiObjectsParams
• type TaxiiPageInfo
• type ThreatNameCount
• type UserLimitWindow
• type UserLimits
• type UserPreset
• type YaraJobInfo
• type YaraLookupResultsStix
• type YaraProcessInfo
• type YaraSearchRequest
• type YaraSearchResults
• type YaraSearchResultsCount
• type YaraStixBundle
• type YaraStixFile
• type YaraStixReference

Constants

const (
	DefaultBaseURL = "https://api.any.run"
	DefaultTimeout = 30 * time.Second
	APIKeyPrefix   = "API-Key "
)

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

func NewClient

func NewClient(authKey string, opts ...Option) *Client

func (*Client) AddTime

func (c *Client) AddTime(taskUUID string) (*TaskMessageResponse, error)

func (*Client) DeleteTask

func (c *Client) DeleteTask(taskUUID string) (*TaskMessageResponse, error)

func (*Client) DownloadYaraResults

func (c *Client) DownloadYaraResults(queryID, format string) (*YaraLookupResultsStix, error)

func (*Client) GetEnvironments

func (c *Client) GetEnvironments() ([]TaskEnvironment, error)

func (*Client) GetHistory

func (c *Client) GetHistory(team bool, skip, limit int) (*TasksHistoryResponse, error)

func (*Client) GetIOCs

func (c *Client) GetIOCs(taskUUID string) ([]IOC, error)

func (*Client) GetReport

func (c *Client) GetReport(taskUUID string) (*ReportResponse, error)

func (*Client) GetUserLimits

func (c *Client) GetUserLimits() (*UserLimits, error)

func (*Client) GetUserPresets

func (c *Client) GetUserPresets() ([]UserPreset, error)

func (*Client) GetYaraResults

func (c *Client) GetYaraResults(queryID string, offset, limit int, sort string) (*YaraSearchResults, error)

func (*Client) GetYaraResultsCount

func (c *Client) GetYaraResultsCount(queryID string) (*YaraSearchResultsCount, error)

func (*Client) MonitorTask

func (c *Client) MonitorTask(taskUUID string, onEvent func(MonitorEvent) error) error

func (*Client) MonitorTaskStream

func (c *Client) MonitorTaskStream(taskUUID string) (io.ReadCloser, error)

func (*Client) SearchThreatIntelligence

func (c *Client) SearchThreatIntelligence(req SearchRequest) (*SearchResponse, error)

func (*Client) StartYaraSearch

func (c *Client) StartYaraSearch(rule string) (*YaraJobInfo, error)

func (*Client) StopTask

func (c *Client) StopTask(taskUUID string) (*TaskMessageResponse, error)

func (*Client) StopYaraSearch

func (c *Client) StopYaraSearch(queryID string) (*YaraJobInfo, error)

func (*Client) SubmitTask

func (c *Client) SubmitTask(req *CreateTaskRequest) (*TaskSubmission, error)

func (*Client) TaxiiDiscovery

func (c *Client) TaxiiDiscovery() (*TaxiiDiscovery, error)

func (*Client) TaxiiGetAPIRoot

func (c *Client) TaxiiGetAPIRoot() (*TaxiiAPIRoot, error)

func (*Client) TaxiiGetCollection

func (c *Client) TaxiiGetCollection(collectionID string) (*TaxiiCollection, error)

func (*Client) TaxiiGetCollections

func (c *Client) TaxiiGetCollections() (*TaxiiCollections, error)

func (*Client) TaxiiGetManifest

func (c *Client) TaxiiGetManifest(collectionID string, params TaxiiManifestParams) (*TaxiiManifest, *TaxiiPageInfo, error)

func (*Client) TaxiiGetObject

func (c *Client) TaxiiGetObject(collectionID, objectID string) (*TaxiiEnvelope, *TaxiiPageInfo, error)

func (*Client) TaxiiGetObjects

func (c *Client) TaxiiGetObjects(collectionID string, params TaxiiObjectsParams) (*TaxiiEnvelope, *TaxiiPageInfo, error)

type CountryCount

type CountryCount struct {
	CountryName string  `json:"countryName"`
	Count       float64 `json:"count"`
}

type CreateTaskRequest

type CreateTaskRequest struct {
	ObjType                       string `json:"obj_type"`
	File                          io.Reader
	FileName                      string
	ObjURL                        string `json:"obj_url,omitempty"`
	TaskRerunUUID                 string `json:"task_rerun_uuid,omitempty"`
	EnvOS                         string `json:"env_os,omitempty"`
	EnvBitness                    int    `json:"env_bitness,omitempty"`
	EnvVersion                    string `json:"env_version,omitempty"`
	EnvType                       string `json:"env_type,omitempty"`
	EnvLocale                     string `json:"env_locale,omitempty"`
	OptNetworkConnect             *bool  `json:"opt_network_connect,omitempty"`
	OptNetworkFakenet             bool   `json:"opt_network_fakenet,omitempty"`
	OptNetworkTor                 bool   `json:"opt_network_tor,omitempty"`
	OptNetworkGeo                 string `json:"opt_network_geo,omitempty"`
	OptNetworkMitm                bool   `json:"opt_network_mitm,omitempty"`
	OptNetworkResidentialProxy    bool   `json:"opt_network_residential_proxy,omitempty"`
	OptNetworkResidentialProxyGeo string `json:"opt_network_residential_proxy_geo,omitempty"`
	OptPrivacyType                string `json:"opt_privacy_type,omitempty"`
	OptTimeout                    int    `json:"opt_timeout,omitempty"`
	OptAutomatedInteractivity     *bool  `json:"opt_automated_interactivity,omitempty"`
	OptAutoDeleteAfter            string `json:"opt_auto_delete_after,omitempty"`
	ObjExtStartFolder             string `json:"obj_ext_startfolder,omitempty"`
	ObjExtCmd                     string `json:"obj_ext_cmd,omitempty"`
	ObjExtBrowser                 string `json:"obj_ext_browser,omitempty"`
	ObjExtUseragent               string `json:"obj_ext_useragent,omitempty"`
	ObjExtElevatePrompt           bool   `json:"obj_ext_elevateprompt,omitempty"`
	ObjForceElevation             bool   `json:"obj_force_elevation,omitempty"`
	AutoConfirmUAC                *bool  `json:"auto_confirm_uac,omitempty"`
	RunAsRoot                     bool   `json:"run_as_root,omitempty"`
	ObjExtExtension               bool   `json:"obj_ext_extension,omitempty"`
	OptPrivacyHideSource          bool   `json:"opt_privacy_hidesource,omitempty"`
	UserTags                      string `json:"user_tags,omitempty"`
}

func NewCreateTaskRequest

func NewCreateTaskRequest() *CreateTaskRequest

type DestinationIP

type DestinationIP struct {
	DestinationIP string   `json:"destinationIP"`
	Date          string   `json:"date"`
	ThreatLevel   float64  `json:"threatLevel"`
	ThreatName    []string `json:"threatName"`
	IsMalconf     bool     `json:"isMalconf"`
}

type DestinationIPASN

type DestinationIPASN struct {
	ASN  string `json:"asn"`
	Date string `json:"date"`
}

type Event

type Event struct {
	RuleName                string   `json:"ruleName"`
	CommandLine             string   `json:"commandLine"`
	ImagePath               string   `json:"imagePath"`
	PID                     float64  `json:"pid"`
	Title                   []string `json:"title"`
	DestinationPort         []string `json:"destinationPort"`
	DestinationIP           string   `json:"destinationIP"`
	DestinationIPGeo        []string `json:"destinationIPgeo"`
	DestinationIPASN        []string `json:"destinationIpAsn"`
	URL                     string   `json:"url"`
	FileName                string   `json:"fileName"`
	RegistryKey             string   `json:"registryKey"`
	RegistryName            []string `json:"registryName"`
	RegistryValue           []string `json:"registryValue"`
	ModuleImagePath         string   `json:"moduleImagePath"`
	InjectedFlag            bool     `json:"injectedFlag"`
	DomainName              []string `json:"domainName"`
	HTTPRequestContentType  string   `json:"httpRequestContentType"`
	HTTPRequestContentFile  string   `json:"httpRequestContentFile"`
	HTTPResponseContentType string   `json:"httpResponseContentType"`
	HTTPResponseContentFile string   `json:"httpResponseContentFile"`
	RuleThreatLevel         string   `json:"ruleThreatLevel"`
	SHA256                  string   `json:"sha256"`
}

type EventsCounters

type EventsCounters struct {
	Raw EventsCountersRaw `json:"raw"`
}

type EventsCountersRaw

type EventsCountersRaw struct {
	Registry float64 `json:"registry"`
	Files    float64 `json:"files"`
	Modules  float64 `json:"modules"`
	Objects  float64 `json:"objects"`
	RPC      float64 `json:"rpc"`
}

type GetYaraResultsParams

type GetYaraResultsParams struct {
	Offset int
	Limit  int
	Sort   string
}

type HTTPError

type HTTPError struct {
	StatusCode int
	Body       string
}

func (*HTTPError) Error

func (e *HTTPError) Error() string

type Hashes

type Hashes struct {
	MD5    string `json:"md5"`
	SHA1   string `json:"sha1"`
	SHA256 string `json:"sha256"`
	SSDeep string `json:"ssdeep"`
}

type HistoryParams

type HistoryParams struct {
	Team  bool
	Skip  int
	Limit int
}

type IOC

type IOC struct {
	Category           string `json:"category"`
	Type               string `json:"type"`
	Name               string `json:"name"`
	IOC                string `json:"ioc"`
	Reputation         int    `json:"reputation"`
	DiscoveringEntryID string `json:"discoveringEntryId"`
}

type Industry

type Industry struct {
	IndustryName string  `json:"industryName"`
	Confidence   float64 `json:"confidence"`
}

type MainObject

type MainObject struct {
	Type   string `json:"type"`
	Name   string `json:"name"`
	Hashes Hashes `json:"hashes"`
}

type MatchedSample

type MatchedSample struct {
	FirstSeen          string              `json:"firstSeen"`
	LastSeen           string              `json:"lastSeen"`
	Hashes             MatchedSampleHashes `json:"hashes"`
	Download           string              `json:"download"`
	Tasks              []string            `json:"tasks"`
	FilePartName       string              `json:"filePartName"`
	FileFullName       string              `json:"fileFullName"`
	FileSize           int64               `json:"fileSize"`
	FileExt            string              `json:"fileExt"`
	RelatedTags        []string            `json:"relatedTags"`
	Process            *YaraProcessInfo    `json:"process"`
	DiscoveringEntryID string              `json:"discoveringEntryId"`
	Task               string              `json:"task"`
	TaskUUID           string              `json:"taskUUID"`
}

type MatchedSampleHashes

type MatchedSampleHashes struct {
	SHA256 string `json:"sha256"`
	SHA1   string `json:"sha1"`
	MD5    string `json:"md5"`
	SSDeep string `json:"ssdeep"`
}

type MonitorEvent

type MonitorEvent struct {
	Task      *TaskStatus `json:"task"`
	Completed bool        `json:"completed"`
	Error     bool        `json:"error"`
	Message   string      `json:"message"`
}

type ObjectTrid

type ObjectTrid struct {
	Procent   float64 `json:"procent"`
	Extension string  `json:"extension"`
	Filetype  string  `json:"filetype"`
}

type Option

type Option func(*Client)

func WithBaseURL

func WithBaseURL(baseURL string) Option

func WithHTTPClient

func WithHTTPClient(c *http.Client) Option

type ParallelsLimit

type ParallelsLimit struct {
	Total     int `json:"total"`
	Available int `json:"available"`
}

type Process

type Process struct {
	CommandLine    string         `json:"commandLine"`
	ImagePath      string         `json:"imagePath"`
	ThreatName     string         `json:"threatName"`
	MITRE          []string       `json:"MITRE"`
	PID            float64        `json:"pid"`
	Scores         ProcessScores  `json:"scores"`
	EventsCounters EventsCounters `json:"eventsCounters"`
	ThreatLevel    float64        `json:"threatLevel"`
}

type ProcessDump

type ProcessDump struct {
	TaskUUID     string `json:"taskUUID"`
	FileNumber   int    `json:"fileNumber"`
	PermanentURL string `json:"permanentUrl"`
	Timestamp    int64  `json:"timestamp"`
	ProcessName  string `json:"processName"`
	PID          int    `json:"pid"`
	Address      string `json:"address"`
	Size         int    `json:"size"`
}

type ProcessScores

type ProcessScores struct {
	Specs ProcessScoresSpecs `json:"specs"`
}

type ProcessScoresSpecs

type ProcessScoresSpecs struct {
	KnownThreat       bool `json:"known_threat"`
	NetworkLoader     bool `json:"network_loader"`
	Network           bool `json:"network"`
	UACRequest        bool `json:"uac_request"`
	Injects           bool `json:"injects"`
	ServiceLuncher    bool `json:"service_luncher"`
	ExecutableDropped bool `json:"executable_dropped"`
	Multiprocessing   bool `json:"multiprocessing"`
	CrashedApps       bool `json:"crashed_apps"`
	DebugOutput       bool `json:"debug_output"`
	Stealing          bool `json:"stealing"`
	Exploitable       bool `json:"exploitable"`
	StaticDetections  bool `json:"static_detections"`
	SuspStruct        bool `json:"susp_struct"`
	Autostart         bool `json:"autostart"`
	LowAccess         bool `json:"low_access"`
	Tor               bool `json:"tor"`
	Spam              bool `json:"spam"`
	MalwareConfig     bool `json:"malware_config"`
	ProcessDump       bool `json:"process_dump"`
}

type RelatedDNS

type RelatedDNS struct {
	DomainName  string   `json:"domainName"`
	ThreatName  []string `json:"threatName"`
	ThreatLevel float64  `json:"threatLevel"`
	Date        string   `json:"date"`
	IsMalconf   bool     `json:"isMalconf"`
}

type RelatedFile

type RelatedFile struct {
	Task          string  `json:"task"`
	Title         string  `json:"title"`
	FileLink      string  `json:"fileLink"`
	Time          string  `json:"time"`
	FileName      string  `json:"fileName"`
	FileExtension string  `json:"fileExtension"`
	Process       Process `json:"process"`
	Hashes        Hashes  `json:"hashes"`
}

type RelatedIncident

type RelatedIncident struct {
	Task       string   `json:"task"`
	Time       string   `json:"time"`
	MITRE      []string `json:"MITRE"`
	ThreatName []string `json:"threatName"`
	Event      Event    `json:"event"`
	Process    Process  `json:"process"`
}

type RelatedNetworkThreat

type RelatedNetworkThreat struct {
	SuricataClass       string   `json:"suricataClass"`
	ImagePath           string   `json:"imagePath"`
	SuricataID          string   `json:"suricataID"`
	SuricataMessage     string   `json:"suricataMessage"`
	Tags                []string `json:"tags"`
	MITRE               []string `json:"MITRE"`
	SuricataThreatLevel string   `json:"suricataThreatLevel"`
	Task                string   `json:"task"`
}

type RelatedSynchronizationObject

type RelatedSynchronizationObject struct {
	SyncObjectTime      string  `json:"syncObjectTime"`
	SyncObjectType      string  `json:"syncObjectType"`
	SyncObjectOperation string  `json:"syncObjectOperation"`
	SyncObjectName      string  `json:"syncObjectName"`
	Task                string  `json:"task"`
	Process             Process `json:"process"`
}

type RelatedURL

type RelatedURL struct {
	URL         string   `json:"url"`
	Date        string   `json:"date"`
	ThreatLevel float64  `json:"threatLevel"`
	ThreatName  []string `json:"threatName"`
	IsMalconf   bool     `json:"isMalconf"`
}

type ReportArtifact

type ReportArtifact struct {
	Present      bool   `json:"present"`
	PermanentURL string `json:"permanentUrl"`
}

type ReportAutomatization

type ReportAutomatization struct {
	Interactivity bool `json:"interactivity"`
	UAC           bool `json:"uac"`
}

type ReportConnection

type ReportConnection struct {
	IP             string               `json:"ip"`
	Port           int                  `json:"port"`
	Protocol       string               `json:"protocol"`
	Country        string               `json:"country"`
	ASN            string               `json:"asn"`
	Time           string               `json:"time"`
	Process        string               `json:"process"`
	TLSFingerprint ReportTLSFingerprint `json:"tlsFingerprint"`
	Reputation     string               `json:"reputation"`
}

type ReportContent

type ReportContent struct {
	MainObject  ReportMainObject `json:"mainObject"`
	Video       ReportArtifact   `json:"video"`
	PCAP        ReportArtifact   `json:"pcap"`
	SSLKeys     ReportArtifact   `json:"sslkeys"`
	Screenshots []Screenshot     `json:"screenshots"`
	Dumps       []ProcessDump    `json:"dumps"`
}

type ReportCounterFiles

type ReportCounterFiles struct {
	Unknown    int `json:"unknown"`
	Text       int `json:"text"`
	Suspicious int `json:"suspicious"`
	Malicious  int `json:"malicious"`
}

type ReportCounterNetwork

type ReportCounterNetwork struct {
	HTTP        int `json:"http"`
	Connections int `json:"connections"`
	DNS         int `json:"dns"`
	Threats     int `json:"threats"`
}

type ReportCounterProcesses

type ReportCounterProcesses struct {
	Total      int `json:"total"`
	Monitored  int `json:"monitored"`
	Suspicious int `json:"suspicious"`
	Malicious  int `json:"malicious"`
}

type ReportCounterRegistry

type ReportCounterRegistry struct {
	Total  int `json:"total"`
	Read   int `json:"read"`
	Write  int `json:"write"`
	Delete int `json:"delete"`
}

type ReportCounterSync

type ReportCounterSync struct {
	Total     int                   `json:"total"`
	Operation ReportCounterSyncOp   `json:"operation"`
	Type      ReportCounterSyncType `json:"type"`
}

type ReportCounterSyncOp

type ReportCounterSyncOp struct {
	Open   int `json:"open"`
	Create int `json:"create"`
}

type ReportCounterSyncType

type ReportCounterSyncType struct {
	Mutex int `json:"mutex"`
	Event int `json:"event"`
}

type ReportCounters

type ReportCounters struct {
	Processes       ReportCounterProcesses `json:"processes"`
	Network         ReportCounterNetwork   `json:"network"`
	Files           ReportCounterFiles     `json:"files"`
	Registry        ReportCounterRegistry  `json:"registry"`
	Synchronization ReportCounterSync      `json:"synchronization"`
}

type ReportDNSRequest

type ReportDNSRequest struct {
	Time             int64    `json:"time"`
	Domain           string   `json:"domain"`
	IPs              []string `json:"ips"`
	Reputation       string   `json:"reputation"`
	ReputationNumber int      `json:"reputationNumber"`
}

type ReportDebugString

type ReportDebugString struct {
	Time    int64  `json:"time"`
	Message string `json:"message"`
	Process string `json:"process"`
}

type ReportEnvironment

type ReportEnvironment struct {
	OS               ReportEnvironmentOS `json:"os"`
	InternetExplorer ReportEnvironmentIE `json:"internetExplorer"`
	Software         []ReportSoftware    `json:"software"`
	Hotfixes         []ReportHotfix      `json:"hotfixes"`
}

type ReportEnvironmentIE

type ReportEnvironmentIE struct {
	Version string `json:"version"`
	Kbnum   string `json:"kbnum"`
}

type ReportEnvironmentOS

type ReportEnvironmentOS struct {
	Title       string `json:"title"`
	Build       int    `json:"build"`
	Product     string `json:"product"`
	Variant     string `json:"variant"`
	ProductType string `json:"productType"`
	Bitness     int    `json:"bitness"`
	Major       string `json:"major"`
	ServicePack string `json:"servicePack"`
	SoftSet     string `json:"softSet"`
}

type ReportEnvironments

type ReportEnvironments []ReportEnvironment

func (*ReportEnvironments) UnmarshalJSON

func (re *ReportEnvironments) UnmarshalJSON(b []byte) error

type ReportHTTPBody

type ReportHTTPBody struct {
	Request  ReportHTTPMessage `json:"request"`
	Response ReportHTTPMessage `json:"response"`
}

type ReportHTTPMessage

type ReportHTTPMessage struct {
	Size         int64  `json:"size"`
	Type         string `json:"type"`
	ThreatLevel  string `json:"threatLevel"`
	PermanentURL string `json:"permanentURL"`
	Hashes       Hashes `json:"hashes"`
}

type ReportHTTPRequest

type ReportHTTPRequest struct {
	Time          int64          `json:"time"`
	Method        string         `json:"method"`
	Host          string         `json:"host"`
	URL           string         `json:"url"`
	IP            string         `json:"ip"`
	Port          int            `json:"port"`
	ProxyDetected bool           `json:"proxyDetected"`
	UserAgent     string         `json:"user-agent"`
	Status        string         `json:"status"`
	HTTPCode      int            `json:"httpCode"`
	Process       string         `json:"process"`
	Reputation    string         `json:"reputation"`
	Country       string         `json:"country"`
	Body          ReportHTTPBody `json:"body"`
}

type ReportHotfix

type ReportHotfix struct {
	Title string `json:"title"`
}

type ReportIncident

type ReportIncident struct {
	ThreatLevel int                   `json:"threatLevel"`
	Title       string                `json:"title"`
	Desc        string                `json:"desc"`
	Source      string                `json:"source"`
	FirstSeen   int64                 `json:"firstSeen"`
	Count       int                   `json:"count"`
	Process     string                `json:"process"`
	Mitre       []ReportIncidentMitre `json:"mitre"`
	Events      []ReportIncidentEvent `json:"events"`
}

type ReportIncidentEvent

type ReportIncidentEvent struct {
	ID            string `json:"_id"`
	Time          any    `json:"time"`
	Image         string `json:"image"`
	Cmdline       string `json:"cmdline"`
	CmdChild      string `json:"cmdChild"`
	CmdParent     string `json:"cmdParent"`
	Size          string `json:"size"`
	Address       string `json:"address"`
	Protect       string `json:"protect"`
	Status        string `json:"status"`
	Operation     string `json:"operation"`
	Device        string `json:"device"`
	Object        string `json:"object"`
	Name          string `json:"name"`
	Created       string `json:"created"`
	Newname       string `json:"newname"`
	Access        string `json:"access"`
	Filename      string `json:"filename"`
	ContentType   string `json:"contentType"`
	MD5           string `json:"md5"`
	SHA1          string `json:"sha1"`
	SHA256        string `json:"sha256"`
	Key           string `json:"key"`
	Value         string `json:"value"`
	TypeValue     string `json:"typeValue"`
	Process       string `json:"process"`
	IPDst         string `json:"ipDst"`
	IPSrc         string `json:"ipSrc"`
	PortDst       any    `json:"portDst"`
	PortSrc       any    `json:"portSrc"`
	Protocol      string `json:"protocol"`
	Host          string `json:"host"`
	URL           string `json:"url"`
	IP            string `json:"ip"`
	Port          any    `json:"port"`
	Request       string `json:"request"`
	Method        string `json:"method"`
	Proxy         bool   `json:"proxy"`
	Type          string `json:"type"`
	IsWhiteListed bool   `json:"isWhiteListed"`
	Return        string `json:"Return"`
	Transport     string `json:"transport"`
	SID           string `json:"SID"`
	IPDstPacket   string `json:"ipDstPacket"`
	IPSrcPacket   string `json:"ipSrcPacket"`
	TotalBytes    string `json:"totalBytes"`
	EventID       string `json:"eventId"`
}

type ReportIncidentMitre

type ReportIncidentMitre struct {
	TID int `json:"tid"`
	SID int `json:"sid"`
	V   int `json:"v"`
}

type ReportLinks

type ReportLinks struct {
	HTML  string `json:"HTML"`
	IOC   string `json:"IOC"`
	STIX  string `json:"STIX"`
	MISP  string `json:"MISP"`
	Graph string `json:"graph"`
}

type ReportMainObject

type ReportMainObject struct {
	Type         string               `json:"type"`
	PermanentURL string               `json:"permanentUrl"`
	Filename     string               `json:"filename"`
	Basename     string               `json:"basename"`
	URL          string               `json:"url"`
	Hashes       Hashes               `json:"hashes"`
	Info         ReportMainObjectInfo `json:"info"`
}

type ReportMainObjectInfo

type ReportMainObjectInfo struct {
	Ext  string                    `json:"ext"`
	File string                    `json:"file"`
	Mime string                    `json:"mime"`
	Exif map[string]map[string]any `json:"exif"`
	Trid []ObjectTrid              `json:"trid"`
}

type ReportMalconf

type ReportMalconf struct {
	Config      ReportMalconfConfig `json:"config"`
	Family      string              `json:"family"`
	ProcessPID  int                 `json:"processPID"`
	ProcessTime int64               `json:"processTime"`
}

type ReportMalconfConfig

type ReportMalconfConfig struct {
	C2      string         `json:"C2"`
	Keys    map[string]any `json:"Keys"`
	Options map[string]any `json:"Options"`
	Strings []string       `json:"Strings"`
}

type ReportMitre

type ReportMitre struct {
	ID     string   `json:"id"`
	Name   string   `json:"name"`
	Phases []string `json:"phases"`
}

type ReportModified

type ReportModified struct {
	Files    []ReportModifiedFile     `json:"files"`
	Registry []ReportModifiedRegistry `json:"registry"`
}

type ReportModifiedFile

type ReportModifiedFile struct {
	Time         int64                  `json:"time"`
	Filename     string                 `json:"filename"`
	Size         int64                  `json:"size"`
	Type         string                 `json:"type"`
	ThreatLevel  string                 `json:"threatLevel"`
	Process      string                 `json:"process"`
	PermanentURL string                 `json:"permanentUrl"`
	Info         ReportModifiedFileInfo `json:"info"`
	Hashes       Hashes                 `json:"hashes"`
}

type ReportModifiedFileInfo

type ReportModifiedFileInfo struct {
	File string `json:"file"`
	Mime string `json:"mime"`
}

type ReportModifiedRegistry

type ReportModifiedRegistry struct {
	Key       string `json:"key"`
	Name      string `json:"name"`
	Value     string `json:"value"`
	Operation string `json:"operation"`
	Process   string `json:"process"`
	Time      int64  `json:"time"`
}

type ReportNetwork

type ReportNetwork struct {
	DNSRequests  []ReportDNSRequest  `json:"dnsRequests"`
	HTTPRequests []ReportHTTPRequest `json:"httpRequests"`
	Connections  []ReportConnection  `json:"connections"`
	Threats      []ReportThreat      `json:"threats"`
}

type ReportOptions

type ReportOptions struct {
	Timeout        int                  `json:"timeout"`
	AdditionalTime int                  `json:"additionalTime"`
	FakeNet        bool                 `json:"fakeNet"`
	HeavyEvasion   bool                 `json:"heavyEvasion"`
	MITM           bool                 `json:"mitm"`
	Presentation   bool                 `json:"presentation"`
	Video          bool                 `json:"video"`
	HideSource     bool                 `json:"hideSource"`
	Network        bool                 `json:"network"`
	Privacy        string               `json:"privacy"`
	PrivateSample  bool                 `json:"privateSample"`
	Tor            ReportTor            `json:"tor"`
	Automatization ReportAutomatization `json:"automatization"`
}

type ReportProcess

type ReportProcess struct {
	PID              int                       `json:"pid"`
	PPID             int                       `json:"ppid"`
	UUID             string                    `json:"uuid"`
	ParentUUID       string                    `json:"parentUUID"`
	Important        bool                      `json:"important"`
	Image            string                    `json:"image"`
	CommandLine      string                    `json:"commandLine"`
	FileName         string                    `json:"fileName"`
	FileType         string                    `json:"fileType"`
	MainProcess      bool                      `json:"mainProcess"`
	Times            ReportProcessTimes        `json:"times"`
	VersionInfo      ReportProcessVersionInfo  `json:"versionInfo"`
	Cert             ReportProcessCert         `json:"cert"`
	ResolvedCOM      ReportProcessResolvedCOM  `json:"resolvedCOM"`
	Context          ReportProcessContext      `json:"context"`
	Scores           ReportProcessScores       `json:"scores"`
	ThreatName       string                    `json:"threatName"`
	Status           string                    `json:"status"`
	ExitCode         int64                     `json:"exitCode"`
	HasMalwareConfig bool                      `json:"hasMalwareConfig"`
	Modules          []ReportProcessModule     `json:"modules"`
	Synchronization  []ReportProcessSyncObject `json:"synchronization"`
}

type ReportProcessCert

type ReportProcessCert struct {
	SN          string `json:"SN"`
	Status      int    `json:"status"`
	ContentHash string `json:"contentHash"`
	Thumbprint  string `json:"thumbprint"`
}

type ReportProcessContext

type ReportProcessContext struct {
	RebootNumber   int    `json:"rebootNumber"`
	IntegrityLevel string `json:"integrityLevel"`
	UserName       string `json:"userName"`
}

type ReportProcessModule

type ReportProcessModule struct {
	Time  int64  `json:"time"`
	Image string `json:"image"`
}

type ReportProcessResolvedCOM

type ReportProcessResolvedCOM struct {
	Title  string                         `json:"title"`
	Module ReportProcessResolvedCOMModule `json:"module"`
}

type ReportProcessResolvedCOMModule

type ReportProcessResolvedCOMModule struct {
	FullPath string `json:"fullPath"`
	FileName string `json:"fileName"`
}

type ReportProcessScores

type ReportProcessScores struct {
	MonitoringReason string             `json:"monitoringReason"`
	Dropped          bool               `json:"dropped"`
	Injected         bool               `json:"injected"`
	LoadsSusp        bool               `json:"loadsSusp"`
	Verdict          ReportVerdict      `json:"verdict"`
	Specs            ReportProcessSpecs `json:"specs"`
}

type ReportProcessSpecs

type ReportProcessSpecs struct {
	AutoStart         bool `json:"autoStart"`
	CrashedApps       bool `json:"crashedApps"`
	DebugOutput       bool `json:"debugOutput"`
	ExecutableDropped bool `json:"executableDropped"`
	Exploitable       bool `json:"exploitable"`
	Injects           bool `json:"injects"`
	KnownThreat       bool `json:"knownThreat"`
	LowAccess         bool `json:"lowAccess"`
	Network           bool `json:"network"`
	NetworkLoader     bool `json:"networkLoader"`
	Stealing          bool `json:"stealing"`
	PrivEscalation    bool `json:"privEscalation"`
	MalwareConfig     bool `json:"malwareConfig"`
}

type ReportProcessSyncObject

type ReportProcessSyncObject struct {
	Time      int64  `json:"time"`
	Name      string `json:"name"`
	Type      string `json:"type"`
	Operation string `json:"operation"`
}

type ReportProcessTimes

type ReportProcessTimes struct {
	Start           int64 `json:"start"`
	Terminate       int64 `json:"terminate"`
	MonitoringSince int64 `json:"monitoringSince"`
}

type ReportProcessVersionInfo

type ReportProcessVersionInfo struct {
	Company     string `json:"company"`
	Description string `json:"description"`
	Version     string `json:"version"`
}

type ReportResponse

type ReportResponse struct {
	Error bool       `json:"error"`
	Data  TaskReport `json:"data"`
}

type ReportSandbox

type ReportSandbox struct {
	Name string            `json:"name"`
	Plan ReportSandboxPlan `json:"plan"`
}

type ReportSandboxPlan

type ReportSandboxPlan struct {
	Name string `json:"name"`
}

type ReportScores

type ReportScores struct {
	Verdict ReportVerdict `json:"verdict"`
	Specs   ReportSpecs   `json:"specs"`
}

type ReportSoftware

type ReportSoftware struct {
	Title   string `json:"title"`
	Version string `json:"version"`
}

type ReportSpecs

type ReportSpecs struct {
	AutoStart         bool `json:"autoStart"`
	CPUOverrun        bool `json:"cpuOverrun"`
	CrashedApps       bool `json:"crashedApps"`
	CrashedTask       bool `json:"crashedTask"`
	DebugOutput       bool `json:"debugOutput"`
	ExecutableDropped bool `json:"executableDropped"`
	Exploitable       bool `json:"exploitable"`
	Injects           bool `json:"injects"`
	KnownThreat       bool `json:"knownThreat"`
	LowAccess         bool `json:"lowAccess"`
	MalwareConfig     bool `json:"malwareConfig"`
	MemOverrun        bool `json:"memOverrun"`
	Multiprocessing   bool `json:"multiprocessing"`
	NetworkLoader     bool `json:"networkLoader"`
	NetworkThreats    bool `json:"networkThreats"`
	NotStarted        bool `json:"notStarted"`
	PrivEscalation    bool `json:"privEscalation"`
	Rebooted          bool `json:"rebooted"`
	ServiceLauncher   bool `json:"serviceLauncher"`
	Spam              bool `json:"spam"`
	StaticDetections  bool `json:"staticDetections"`
	Stealing          bool `json:"stealing"`
	SuspStruct        bool `json:"suspStruct"`
	TorUsed           bool `json:"torUsed"`
}

type ReportTLSFingerprint

type ReportTLSFingerprint struct {
	JA3            string `json:"ja3"`
	JA3Fullstring  string `json:"ja3Fullstring"`
	JA3S           string `json:"ja3S"`
	JA3SFullstring string `json:"ja3SFullstring"`
	JARM           string `json:"jarm"`
}

type ReportThreat

type ReportThreat struct {
	Time     string `json:"time"`
	DstIP    string `json:"dstip"`
	SrcIP    string `json:"srcip"`
	DstPort  int    `json:"dstport"`
	SrcPort  int    `json:"srcport"`
	SID      int    `json:"sid"`
	Class    string `json:"class"`
	Msg      string `json:"msg"`
	Pro      int    `json:"pro"`
	Priority int    `json:"priority"`
	Process  string `json:"process"`
}

type ReportTor

type ReportTor struct {
	Used bool   `json:"used"`
	Geo  string `json:"geo"`
}

type ReportVerdict

type ReportVerdict struct {
	Score           float64 `json:"score"`
	ThreatLevel     float64 `json:"threatLevel"`
	ThreatLevelText string  `json:"threatLevelText"`
}

type Screenshot

type Screenshot struct {
	UUID         string `json:"uuid"`
	Time         int    `json:"time"`
	PermanentURL string `json:"permanentUrl"`
	ThumbnailURL string `json:"thumbnailUrl"`
}

type SearchRequest

type SearchRequest struct {
	Query     string `json:"query"`
	StartDate string `json:"startDate,omitempty"`
	EndDate   string `json:"endDate,omitempty"`
}

type SearchResponse

type SearchResponse struct {
	DestinationPort                    []float64                      `json:"destinationPort"`
	DestinationIPGeo                   []string                       `json:"destinationIPgeo"`
	DestinationIPASN                   []DestinationIPASN             `json:"destinationIpAsn"`
	RelatedTasks                       []string                       `json:"relatedTasks"`
	ThreatName                         []ThreatNameCount              `json:"threatName"`
	SubmissionCountries                []CountryCount                 `json:"submissionCountries"`
	Industries                         []Industry                     `json:"industries"`
	RelatedIncidents                   []RelatedIncident              `json:"relatedIncidents"`
	DestinationIP                      []DestinationIP                `json:"destinationIP"`
	RelatedFiles                       []RelatedFile                  `json:"relatedFiles"`
	RelatedDNS                         []RelatedDNS                   `json:"relatedDNS"`
	RelatedURLs                        []RelatedURL                   `json:"relatedURLs"`
	SourceTasks                        []SourceTask                   `json:"sourceTasks"`
	RelatedSynchronizationObjects      []RelatedSynchronizationObject `json:"relatedSynchronizationObjects"`
	RelatedNetworkThreats              []RelatedNetworkThreat         `json:"relatedNetworkThreats"`
	Summary                            Summary                        `json:"summary"`
	TotalTasks                         float64                        `json:"totalTasks"`
	TotalRelatedFiles                  float64                        `json:"totalRelatedFiles"`
	TotalRelatedURLs                   float64                        `json:"totalRelatedURLs"`
	TotalRelatedDNSs                   float64                        `json:"totalRelatedDNSs"`
	TotalDestinationIP                 float64                        `json:"totalDestinationIP"`
	TotalRelatedIncidents              float64                        `json:"totalRelatedIncidents"`
	TotalRelatedSynchronizationObjects float64                        `json:"totalRelatedSynchronizationObjects"`
	TotalNetworkThreats                float64                        `json:"totalNetworkThreats"`
	TotalDestinationPort               float64                        `json:"totalDestinationPort"`
	TotalDestinationIPGeo              float64                        `json:"totalDestinationIPgeo"`
	TotalDestinationIPASN              float64                        `json:"totalDestinationIpAsn"`
}

type SourceTask

type SourceTask struct {
	UUID        string     `json:"uuid"`
	Related     string     `json:"related"`
	Date        string     `json:"date"`
	ThreatLevel float64    `json:"threatLevel"`
	Tags        []string   `json:"tags"`
	MainObject  MainObject `json:"mainObject"`
}

type Summary

type Summary struct {
	ThreatLevel  float64          `json:"threatLevel"`
	LastSeen     string           `json:"lastSeen"`
	DetectedType string           `json:"detectedType"`
	IsTrial      bool             `json:"isTrial"`
	Tags         []string         `json:"tags"`
	Details      []SummaryDetails `json:"details"`
}

type SummaryDetails

type SummaryDetails struct {
	Type        string  `json:"type"`
	ThreatLevel float64 `json:"threatLevel"`
	LastSeen    string  `json:"lastSeen"`
	Count       float64 `json:"count"`
}

type Tag

type Tag struct {
	Value string
	Users bool
}

func (*Tag) UnmarshalJSON

func (t *Tag) UnmarshalJSON(b []byte) error

type Tags

type Tags []Tag

type TaskEnvSoftware

type TaskEnvSoftware struct {
	Name    string `json:"name"`
	Version string `json:"version"`
}

type TaskEnvironment

type TaskEnvironment struct {
	OS       string              `json:"os"`
	Version  string              `json:"version"`
	Bitness  int                 `json:"bitness"`
	Build    int                 `json:"build"`
	Variant  string              `json:"variant"`
	Type     string              `json:"type"`
	Software TaskEnvironmentSoft `json:"software"`
}

type TaskEnvironmentIE

type TaskEnvironmentIE struct {
	Version string `json:"version"`
}

type TaskEnvironmentSoft

type TaskEnvironmentSoft struct {
	IE   TaskEnvironmentIE `json:"ie"`
	Apps []TaskEnvSoftware `json:"apps"`
	Upps []string          `json:"upps"`
}

type TaskHistory

type TaskHistory struct {
	UUID    string `json:"uuid"`
	Verdict string `json:"verdict"`
	Name    string `json:"name"`
	Related string `json:"related"`
	PCAP    string `json:"pcap"`
	File    string `json:"file"`
	JSON    string `json:"json"`
	MISP    string `json:"misp"`
	Date    string `json:"date"`
	Tags    Tags   `json:"tags"`
	Hashes  Hashes `json:"hashes"`
}

type TaskMessageResponse

type TaskMessageResponse struct {
	Error   bool   `json:"error"`
	Message string `json:"message"`
}

type TaskReport

type TaskReport struct {
	Analysis     TaskReportAnalysis  `json:"analysis"`
	Environments ReportEnvironments  `json:"environments"`
	Counters     ReportCounters      `json:"counters"`
	Processes    []ReportProcess     `json:"processes"`
	Network      ReportNetwork       `json:"network"`
	Modified     ReportModified      `json:"modified"`
	Incidents    []ReportIncident    `json:"incidents"`
	Mitre        []ReportMitre       `json:"mitre"`
	Malconf      []ReportMalconf     `json:"malconf"`
	DebugStrings []ReportDebugString `json:"debugStrings"`
	Status       string              `json:"status"`
}

type TaskReportAnalysis

type TaskReportAnalysis struct {
	UUID         string        `json:"uuid"`
	PermanentURL string        `json:"permanentUrl"`
	Duration     int           `json:"duration"`
	Creation     int64         `json:"creation"`
	CreationText string        `json:"creationText"`
	StopExec     int64         `json:"stopExec"`
	StopExecText string        `json:"stopExecText"`
	Reports      ReportLinks   `json:"reports"`
	Tags         Tags          `json:"tags"`
	Sandbox      ReportSandbox `json:"sandbox"`
	Options      ReportOptions `json:"options"`
	Scores       ReportScores  `json:"scores"`
	Content      ReportContent `json:"content"`
}

type TaskStatus

type TaskStatus struct {
	ID        string            `json:"_id"`
	UUID      string            `json:"uuid"`
	Status    int               `json:"status"`
	Remaining int               `json:"remaining"`
	Times     TaskStatusTimes   `json:"times"`
	Public    TaskStatusPublic  `json:"public"`
	Tags      Tags              `json:"tags"`
	UsersTags Tags              `json:"usersTags"`
	Scores    TaskStatusScores  `json:"scores"`
	Actions   TaskStatusActions `json:"actions"`
	Threats   []string          `json:"threats"`
}

type TaskStatusActions

type TaskStatusActions struct {
	ManualClosed bool `json:"manualclosed"`
}

type TaskStatusEnvironment

type TaskStatusEnvironment struct {
	OS TaskStatusEnvironmentOS `json:"OS"`
}

type TaskStatusEnvironmentOS

type TaskStatusEnvironmentOS struct {
	Full        string `json:"full"`
	Build       int    `json:"build"`
	Product     string `json:"product"`
	Variant     string `json:"variant"`
	ProductType string `json:"product_type"`
	Bitness     string `json:"bitness"`
	Major       string `json:"major"`
	SP          string `json:"sp"`
	Type        string `json:"type"`
	ElPrompt    bool   `json:"elPrompt"`
}

type TaskStatusMainObject

type TaskStatusMainObject struct {
	Names  TaskStatusMainObjectNames `json:"names"`
	Hashes Hashes                    `json:"hashes"`
}

type TaskStatusMainObjectNames

type TaskStatusMainObjectNames struct {
	NeedRename bool   `json:"need_rename"`
	Real       string `json:"real"`
	URL        string `json:"url"`
	Basename   string `json:"basename"`
	Location   string `json:"location"`
}

type TaskStatusObjects

type TaskStatusObjects struct {
	RunType    string               `json:"runType"`
	MainObject TaskStatusMainObject `json:"mainObject"`
}

type TaskStatusOptions

type TaskStatusOptions struct {
	Private              string   `json:"private"`
	Whitelist            []string `json:"whitelist"`
	MITM                 bool     `json:"mitm"`
	Fakenet              bool     `json:"fakenet"`
	OpenVPN              string   `json:"openVPN"`
	TorGeo               string   `json:"torGeo"`
	Netviator            bool     `json:"netviator"`
	NetConnected         bool     `json:"netConnected"`
	Network              string   `json:"network"`
	Logger               string   `json:"logger"`
	Presentation         bool     `json:"presentation"`
	Teamwork             bool     `json:"teamwork"`
	Reboots              bool     `json:"reboots"`
	Onlyimportant        bool     `json:"onlyimportant"`
	Video                bool     `json:"video"`
	Locale               string   `json:"locale"`
	ResidentialProxyGeo  string   `json:"residentialProxyGeo"`
	ResidentialProxy     bool     `json:"residentialProxy"`
	AutoclickerDebugMode bool     `json:"autoclickerDebugMode"`
	Autoclicker          bool     `json:"autoclicker"`
	ChatGPT              bool     `json:"chatGPT"`
}

type TaskStatusPublic

type TaskStatusPublic struct {
	MaxAddedTimeReached bool                  `json:"maxAddedTimeReached"`
	Objects             TaskStatusObjects     `json:"objects"`
	Options             TaskStatusOptions     `json:"options"`
	Environment         TaskStatusEnvironment `json:"environment"`
}

type TaskStatusScores

type TaskStatusScores struct {
	Verdict TaskStatusVerdict `json:"verdict"`
	Specs   TaskStatusSpecs   `json:"specs"`
}

type TaskStatusSpecs

type TaskStatusSpecs struct {
	Autostart         bool `json:"autostart"`
	BadModuleCert     bool `json:"bad_module_certificate"`
	BadProcessCert    bool `json:"bad_process_certificate"`
	CPUOverrun        bool `json:"cpu_overrun"`
	CrashedApps       bool `json:"crashed_apps"`
	CrashedTask       bool `json:"crashed_task"`
	DebugOutput       bool `json:"debug_output"`
	ExecutableDropped bool `json:"executable_dropped"`
	Exploitable       bool `json:"exploitable"`
	HasTrace          bool `json:"has_trace"`
	Injects           bool `json:"injects"`
	KnownThreat       bool `json:"known_threat"`
	LowAccess         bool `json:"low_access"`
	MalwareConfig     bool `json:"malware_config"`
	MemOverrun        bool `json:"mem_overrun"`
	Multiprocessing   bool `json:"multiprocessing"`
	NetworkLoader     bool `json:"network_loader"`
	NetworkThreats    bool `json:"network_threats"`
	NotStarted        bool `json:"not_started"`
	ProcessDump       bool `json:"process_dump"`
	Reboot            bool `json:"reboot"`
	ServiceLuncher    bool `json:"service_luncher"`
	Spam              bool `json:"spam"`
	StaticDetections  bool `json:"static_detections"`
	Stealing          bool `json:"stealing"`
	SuspStruct        bool `json:"susp_struct"`
	Tor               bool `json:"tor"`
	UACRequest        bool `json:"uac_request"`
}

type TaskStatusTimes

type TaskStatusTimes struct {
	Timeout   int    `json:"timeout"`
	StartExec string `json:"startExec"`
}

type TaskStatusVerdict

type TaskStatusVerdict struct {
	ThreatLevel float64 `json:"threat_level"`
	Text        string  `json:"text"`
}

type TaskSubmission

type TaskSubmission struct {
	Error       bool   `json:"error"`
	Message     string `json:"message"`
	TaskID      string `json:"taskid"`
	QueueTaskID string `json:"queueTaskId"`
}

func (*TaskSubmission) Queued

func (s *TaskSubmission) Queued() bool

func (*TaskSubmission) UnmarshalJSON

func (s *TaskSubmission) UnmarshalJSON(b []byte) error

type TasksHistoryResponse

type TasksHistoryResponse struct {
	Error bool `json:"error"`
	Data  struct {
		Tasks []TaskHistory `json:"tasks"`
	} `json:"data"`
}

type TaxiiAPIRoot

type TaxiiAPIRoot struct {
	Title            string   `json:"title"`
	Description      string   `json:"description"`
	Versions         []string `json:"versions"`
	MaxContentLength int64    `json:"max_content_length"`
}

type TaxiiCollection

type TaxiiCollection struct {
	ID          string   `json:"id"`
	Title       string   `json:"title"`
	Description string   `json:"description"`
	CanRead     bool     `json:"can_read"`
	CanWrite    bool     `json:"can_write"`
	MediaTypes  []string `json:"media_types"`
}

type TaxiiCollections

type TaxiiCollections struct {
	Collections []TaxiiCollection `json:"collections"`
}

type TaxiiDiscovery

type TaxiiDiscovery struct {
	Title       string   `json:"title"`
	Description string   `json:"description"`
	Contact     string   `json:"contact"`
	APIRoots    []string `json:"api_roots"`
	Default     string   `json:"default"`
}

type TaxiiEnvelope

type TaxiiEnvelope struct {
	Type        string            `json:"type"`
	ID          string            `json:"id"`
	SpecVersion string            `json:"spec_version"`
	Objects     []json.RawMessage `json:"objects"`
	More        bool              `json:"more"`
	Next        string            `json:"next"`
}

type TaxiiManifest

type TaxiiManifest struct {
	Type        string               `json:"type"`
	ID          string               `json:"id"`
	SpecVersion string               `json:"spec_version"`
	Objects     []TaxiiManifestEntry `json:"objects"`
	More        bool                 `json:"more"`
	Next        string               `json:"next"`
}

type TaxiiManifestEntry

type TaxiiManifestEntry struct {
	ID        string `json:"id"`
	DateAdded string `json:"date_added"`
	Version   string `json:"version"`
	MediaType string `json:"media_type"`
}

type TaxiiManifestParams

type TaxiiManifestParams struct {
	AddedAfter    string
	ModifiedAfter string
	Limit         int
	Next          string
	MatchID       string
	MatchVersion  string
}

type TaxiiObjectsParams

type TaxiiObjectsParams struct {
	AddedAfter       string
	ModifiedAfter    string
	Limit            int
	Next             string
	MatchType        string
	MatchID          string
	MatchVersion     string
	MatchSpecVersion string
}

type TaxiiPageInfo

type TaxiiPageInfo struct {
	DateAddedFirst    string
	DateAddedLast     string
	DateModifiedFirst string
	DateModifiedLast  string
}

type ThreatNameCount

type ThreatNameCount struct {
	ThreatName string  `json:"threatName"`
	Count      float64 `json:"count"`
}

type UserLimitWindow

type UserLimitWindow struct {
	Minute int `json:"minute"`
	Hour   int `json:"hour"`
	Day    int `json:"day"`
	Month  int `json:"month"`
}

type UserLimits

type UserLimits struct {
	Web       UserLimitWindow `json:"web"`
	API       UserLimitWindow `json:"api"`
	Parallels ParallelsLimit  `json:"parallels"`
}

type UserPreset

type UserPreset struct {
	ID                     string `json:"_id"`
	Name                   string `json:"name"`
	UserID                 string `json:"userId"`
	UserPlanName           string `json:"userPlanName"`
	CreateTime             string `json:"createTime"`
	ExpirationTimeSelected bool   `json:"expirationTimeSelected"`
	ExpirationTime         string `json:"expirationTime"`
	Privacy                string `json:"privacy"`
	Timeout                int    `json:"timeout"`
	Type                   string `json:"type"`
	OS                     string `json:"os"`
	Version                string `json:"version"`
	Bitness                int    `json:"bitness"`
	Is64Bit                bool   `json:"is64Bit"`
	Locale                 string `json:"locale"`
	Autoclicker            bool   `json:"autoclicker"`
	Browser                string `json:"browser"`
	ChatGPT                bool   `json:"chatGPT"`
	EL                     bool   `json:"el"`
	Extension              bool   `json:"extension"`
	HideSource             bool   `json:"hide_source"`
	Location               string `json:"location"`
	Network                string `json:"network"`
	NetConnected           bool   `json:"netConnected"`
	Netviator              bool   `json:"netviator"`
	MITM                   bool   `json:"mitm"`
	Fakenet                bool   `json:"fakenet"`
	NoControls             bool   `json:"noControls"`
	VPN                    bool   `json:"vpn"`
	OpenVPN                string `json:"openVPN"`
	ResidentialProxy       bool   `json:"residentialProxy"`
	ResidentialProxyGeo    string `json:"residentialProxyGeo"`
	TorGeo                 string `json:"torGeo"`
}

type YaraJobInfo

type YaraJobInfo struct {
	Query               string  `json:"query"`
	QueryID             string  `json:"queryId"`
	RuleName            string  `json:"ruleName"`
	Status              string  `json:"status"`
	Created             string  `json:"created"`
	TimesLeft           float64 `json:"timesLeft"`
	Progress            float64 `json:"progress"`
	NormalizedQueryHash string  `json:"normalizedQueryHash"`
}

type YaraLookupResultsStix

type YaraLookupResultsStix struct {
	Status string         `json:"status"`
	Data   YaraStixBundle `json:"data"`
}

type YaraProcessInfo

type YaraProcessInfo struct {
	ProcessOID         string             `json:"processOID"`
	PID                int                `json:"pid"`
	Cmd                string             `json:"cmd"`
	Image              string             `json:"image"`
	ProcessScoresSpecs ProcessScoresSpecs `json:"processScoresSpecs"`
	ThreatName         string             `json:"threatName"`
	ThreatScore        float64            `json:"threatScore"`
	EventsCounters     EventsCounters     `json:"eventsCounters"`
}

type YaraSearchRequest

type YaraSearchRequest struct {
	Query string `json:"query"`
}

type YaraSearchResults

type YaraSearchResults struct {
	SearchInfo YaraJobInfo     `json:"searchInfo"`
	Matches    []MatchedSample `json:"matches"`
}

type YaraSearchResultsCount

type YaraSearchResultsCount struct {
	FoundMatches int64       `json:"foundMatches"`
	SearchInfo   YaraJobInfo `json:"searchInfo"`
}

type YaraStixBundle

type YaraStixBundle struct {
	Type    string         `json:"type"`
	ID      string         `json:"id"`
	Objects []YaraStixFile `json:"objects"`
}

type YaraStixFile

type YaraStixFile struct {
	Type               string              `json:"type"`
	ID                 string              `json:"id"`
	Hashes             map[string]string   `json:"hashes"`
	ExternalReferences []YaraStixReference `json:"external_references"`
}

type YaraStixReference

type YaraStixReference struct {
	SourceName string `json:"source_name"`
	URL        string `json:"url"`
}