Package: reversinglabs-sdk-py3
ReversingLabsSDKA Python SDK for ReversingLabs REST services (TitaniumCloud and appliances) - Python 3 version.The idea behind this SDK is to enable easier out-of-the-box development of software integrations and automation services that need to interact with ReversingLabs.The SDK consists of several modules, where each module represents either one ReversingLabs service, ReversingLabs appliance or the ReversingLabs TitaniumCloud.Module: a1000A Python module representing the ReversingLabs A1000 malware analysis platform.Class:classA1000(object):def__init__(self,host,username,password,token,fields_v2,ticore_fields,wait_time_seconds,retries,verify,proxies,user_agent):Parameters:host- A1000 addressusername- A1000 usernamepassword- A1000 passwordtoken- A1000 user token for the REST APIfields_v2- optional fields that will be returned in the analysis reportticore_fields- optional fields that will be returned in the report from the TitaniumScale endpointwait_time_seconds- wait time between each report fetching retryretries- number of report fetching retriesverify- verify SSL certificateproxies- optional proxies in useuser_agent- optional user agent stringNOTE!The default means of authorization on the ReversingLabs A1000 REST API is the token.If username and password are used instead, a token fetching request will be done so the token can be used in further actions without the user explicitly providing the token.Class methods:configuration_dumpReturns the configuration of the instantiated A1000 objecttest_connectionCreates a request towards the A1000 Check Status API to test the connection with A1000upload_sample_from_pathAccepts a file path string and returns a response containing the analysis task IDupload_sample_from_fileAccepts a file open in 'rb' mode and returns a response containing the analysis task IDupload_sample_from_urlAccepts a url and returns a response containing the analysis task IDcheck_submitted_url_statusAccepts a task id returned by upload_sample_from_url and returns a response containing processing status and
report if the report is readyget_submitted_url_reportAccepts a task ID returned by upload_sample_from_url and returns a responseThis method utilizes the set number of retries and wait time in seconds to time
out if the analysis results are not readyupload_sample_from_url_and_get_reportAccepts a url and returns a response containing the analysis reportThe result fetching action of this method utilizes the set number of retries and wait time in seconds to time
out if the analysis results are not readyget_summary_report_v2Accepts a single hash or a list of hashes and returns JSON containing a summary report for each of themThis method utilizes the set number of retries and wait time in seconds to time
out if the analysis results are not readyupload_sample_and_get_summary_report_v2Accepts either a file path string or an open file in 'rb' mode for file upload and returns a summary analysis
report responseThis method combines uploading a sample and obtaining the summary analysis reportThe result fetching action of this method utilizes the set number of retries and wait time in seconds to time
out if the analysis results are not readyget_detailed_report_v2Accepts a single hash or a list of hashes and returns a detailed analysis report for the selected samplesThis method utilizes the set number of retries and wait time in seconds and times out if the
analysis results are not readyget_classification_v3Get classification for one samplereanalyze_samples_v2Accepts a single hash or a list of hashes of various types and reanalyzes the corresponding sample(s)This method can be used for reanalyzing a single sample or a batch of samples, depending on the data type
passedlist_extracted_files_v2Get a list of all files TitaniumCore engine extracted from the requested sample during static analysislist_extracted_files_v2_aggregatedGet a list of all files TitaniumCore engine extracted from the requested sample during static analysisPaging is done automatically and results from individual responses aggregated into one list and returneddownload_extracted_filesAccepts a single hash string and returns a downloadable archive file containing files extracted from the desired sampledownload_sampleAccepts a single hash string and returns a downloadable sampledelete_samplesAccepts a single hash string or a list of hashes and deletes the corresponding samples from A1000check_sample_removal_status_v2"Accepts the task ID returned by the bulk sample removal endpoint and returns a response that
indicates if the removal request was finished successfully and if all samples have been deletedcreate_pdf_reportAccepts a single hash string and initiates the creation of a PDF analysis report for the requested sample.
The response includes links to the pdf creation status endpoint and pdf download ednpoint for the requested
samplecheck_pdf_report_creationAccepts a single hash string that should correspond to the hash used in the request with
create_pdf_report method. The response includes an informative message about the status of the PDF
report previously requesteddownload_pdf_reportAccepts a single hash string that should correspond to the hash used in the request with
create_pdf_report methodget_titanium_core_report_v2Accepts a single hash string and gets the full TitaniumCore static analysis report for the requested sample.
The requested sample must be present on the appliance. If the optional fields parameter is not provided in the
request, all available parts of the static analysis report are returned in the responsecreate_dynamic_analysis_reportAccepts a single hash string and initiates the creation of PDF or HTML reports for samples that have gone
through dynamic analysis in the ReversingLabs Cloud Sandbox.
The response includes links to the report creation status endpoint and report download ednpoint for the
requested samplecheck_dynamic_analysis_report_statusAccepts a single hash string and report format parameters that should correspond to the parameters used in
the request with create_dynamic_analysis_report method. The response includes an informative
message about the status of the report previously requesteddownload_dynamic_analysis_reportAccepts a single hash string and report format parameters that should correspond to the parameters used in
the request with create_dynamic_analysis_report methodset_classificationAccepts a single hash string, allows the user to set the classification of a sample, either in TitaniumCloud
or locally on the A1000. Returns a response containing a new classificationdelete_classificationAccepts a single hash string, allows the user to delete the classification of a sample, either in
TitaniumCloud or locally on the A1000get_user_tagsAccepts a single hash string and returns lists of existing user tags for the requested samplepost_user_tagsAccepts a single hash string and adds one or more user tags to the requested sampledelete_user_tagsAccepts a single hash string and removes one or more user tags from the requested sampleget_yara_rulesets_on_the_appliance_v2Retrieves a list of YARA rulesets that are on the A1000 applianceThe list can be filtered by several criteria (ruleset status, source, and owner) using optional parametersget_yara_ruleset_contentsRetrieves the full contents of the requested ruleset in raw text/plain formatAll rulesets can be retrieved, regardless of their current status on the appliance (enabled, disabled…)get_yara_ruleset_matches_v2Retrieves the list of YARA matches (both local and cloud) for requested rulesetsIf multiple rulesets are provided in the request, only the samples that match all requested rulesets are listed in
the response.create_or_update_yara_rulesetCreates a new YARA ruleset if it doesn’t existIf a ruleset with the specified name already exists, a new revision (update) of the ruleset is createddelete_yara_rulesetDeletes the specified YARA ruleset and its matches from the applianceenable_or_disable_yara_rulesetEnables/disables ruleset on the applianceAdministrators can manage any ruleset while regular A1000 users can only manage their own rulesetsget_yara_ruleset_synchronization_timeGets information about the current synchronization status for TitaniumCloud-enabled rulesetsupdate_yara_ruleset_synchronization_timeUpdates the TitaniumCloud synchronization time for TitaniumCloud-enabled YARA rulesetsstart_or_stop_yara_local_retro_scanAllows users to initiate the Local Retro scan on the A1000 appliance, and stop the Local Retro scan that is
in progress on the applianceget_yara_local_retro_scan_statusGets the status of Local Retro scan on the A1000 appliancestart_or_stop_yara_cloud_retro_scanAllows users to start and stop a Cloud Retro scan for a specified ruleset on the A1000 appliance, as well as
to clear all Cloud Retro results for the rulesetget_yara_cloud_retro_scan_statusGets the status of Cloud Retro for the specified YARA ruleset. The response indicates the
current state of Cloud Retroadvanced_search_v3Sends a query string to the A1000 Advanced Search API v3advanced_search_v3_aggregatedSends a query string to the A1000 Advanced Search API v3Paging is done automatically and results from individual
responses aggregated into one list and returnedlist_containers_for_hashesGets a list of all top-level containers from which the requested sample has been extracted during analysisThis is a bulk API, meaning that a single request can be used to simultaneously query containers for multiple
file hashesnetwork_url_reportAccepts a URL string and returns a report about the requested URLnetwork_domain_reportAccepts a domain string and returns a report about the requested domainnetwork_ip_addr_reportAccepts an IP address string and returns a report about the requested IP addressnetwork_ip_to_domainAccepts an IP address string and returns a list of IP-to-domain mappingsnetwork_ip_to_domain_aggregatedAccepts an IP address string and returns a list of IP-to-domain mappings.This method performs the paging automatically and returns a specified maximum number of recordsnetwork_urls_from_ipAccepts an IP address string and returns a list of URLs hosted on the requested IP addressnetwork_urls_from_ip_aggregatedAccepts an IP address string and returns a list of URLs hosted on the requested IP addressThis method performs the paging automatically and returns a specified maximum number of recordsnetwork_files_from_ipAccepts an IP address string and returns a list of hashes and classifications for files found on the requested IP addressnetwork_files_from_ip_aggregatedAccepts an IP address string and returns a list of hashes and classifications for files found on the requested IP addressThis method performs the paging automatically and returns a specified maximum number of recordsModule: ticloudA Python module representing the ReversingLabs TitaniumCloud API-s.Each class in this module represents one TitaniumCloud API and can be instantiated using the same set of parameters:def__init__(self,host,username,password,verify,proxies,user_agent,allow_none_return)Parameters:host- TitaniumCloud addressusername- TitaniumCloud usernamepassword- TitaniumCloud passwordverify- verify SSL certificateproxies- optional proxies in useuser_agent- optional user agent stringallow_none_return- if set toTrue,404response codes will returnNoneinstead ofNotFoundErrorClass:classFileReputation(TiCloudAPI)TCA-0101Methods:get_file_reputationAccepts a hash string or a list of hash strings and returns file reputationHash strings in a passed list must all be of the same hashing algorithmClass:classAVScanners(TiCloudAPI)TCA-0103Methods:get_scan_resultsAccepts a hash string or a list of hash strings and returns AV scanner resultsHash strings in a passed list must all be of the same hashing algorithmClass:classFileAnalysis(TiCloudAPI)TCA-0104Methods:get_analysis_resultsAccepts a hash string or a list of hash strings and returns extended file analysisextract_uri_list_from_reportAccepts a list of entries from the FileAnalysis report and returns a list of URI-s from those entries.get_file_typeAccepts a sample hash and returns the file type stringClass:classRHA1FunctionalSimilarity(TiCloudAPI)TCA-0301Methods:get_similar_hashesAccepts a hash string and returns a list of functionally similar hashesReturns only one defined page of results using one requestget_similar_hashes_aggregatedAccepts a hash string and returns a list of functionally similar hashesReturns a list of results aggregated through multiple paginated requestsClass:classRHA1Analytics(TiCloudAPI)TCA-0321Methods:get_rha1_analyticsAccepts one or more hash strings and returns a count of functionally similar hashes grouped by classificationClass:classURIStatistics(TiCloudAPI)TCA-0402Methods:get_uri_statisticsAccepts a URI string and returns a count of files associated with that URI grouped by classificationClass:classURIIndex(TiCloudAPI)TCA-0401Methods:get_uri_indexAccepts a URI string and returns a list of files associated with this URIReturns only one defined page of results using one requestget_uri_index_aggregatedAccepts a URI string and returns a list of files associated with this URIReturns a list of results aggregated through multiple paginated requestsClass:classAdvancedSearch(TiCloudAPI)TCA-0320Methods:searchAccepts a search query string and performs advanced search on the APIReturns only one defined page of results using one requestsearch_aggregatedAccepts a search query string and performs advanced search on the APIReturns a list of results aggregated through multiple paginated requestsClass:classExpressionSearch(TiCloudAPI)TCA-0306Methods:searchProvides samples first seen on a particular date, filtered by search criteria.search_aggregatedProvides samples first seen on a particular date, filtered by search criteria.This method performs the paging automatically.get_latest_expressionProvdes samples for yesterday’s date tha match the requested criteria.statistics_searchReturns statistics about new samples in ReversingLabs TitaniumCloud on the requested date that match the used search criteria.get_latest_statisticsReturns statistics about new samples in ReversingLabs TitaniumCloud from yesterday's date.Class:classFileDownload(TiCloudAPI)TCA-0201Methods:get_download_statusAccepts a hash string and returns the sample's availability for downloaddownload_sampleAccepts a hash string and downloads the related sample from TitaniumCloudClass:classURLThreatIntelligence(TiCloudAPI)TCA-0403Methods:get_url_reportAccepts a URL string and returns detailed URL analysis infoget_downloaded_filesAccepts a URL string and returns a list of files downloaded from that URLget_latest_url_analysis_feedReturns the latest URL analysis reportsReturns only one defined page of results using one requestget_latest_url_analysis_feed_aggregatedReturns the latest URL analysis reportsReturns a list of results aggregated through multiple paginated requestsget_url_analysis_feed_from_dateAccepts time format and a start time and returns URL analysis reports from that defined time onwardReturns only one defined page of results using one requestget_url_analysis_feed_from_date_aggregatedAccepts time format and a start time and returns URL analysis reports from that defined time onwardReturns a list of results aggregated through multiple paginated requestsClass:classAnalyzeURL(TiCloudAPI)TCA-0404Methods:submit_urlSends a URL string for analysis and returns an analysis task IDClass:classFileUpload(TiCloudAPI)TCA-0202 and TCA-0203Methods:upload_sample_from_pathAccepts a file path string and uploads the desired file to the File Upload APIupload_sample_from_fileAccepts an open file handle and uploads the desired file to the File Upload APIClass:classDeleteFile(TiCloudAPI)TCA-0204Methods:delete_samplesAccepts a single hash string or a list of hash strings belonging to samples you want to delete from the cloudYou can only delete samples that were uploaded by the same cloud accountClass:classReanalyzeFile(TiCloudAPI)TCA-0205Methods:reanalyze_samplesAccepts a single hash string or a list of hash strings belonging to samples in the cloud you want to reanalyzeThe samples need to be already present in the cloud in order to be reanalyzedClass:classDynamicAnalysis(TiCloudAPI)TCA-0207 and TCA-0106Methods:detonate_sampleSubmits a sample available in the cloud for dynamic analysis and returns processing infoThe sample needs to be available in TitaniumCloud beforehanddetonate_urlSubmits a URL for dynamic analysis and returns processing infoget_dynamic_analysis_resultsReturns dynamic analysis results for a desired sample or URLThe analysis of the selected sample or URL must be finished for the results to be availableClass:classCertificateIndex(TiCloudAPI)TCA-0501Methods:get_certificate_informationAccepts a hash (thumbprint) and returns a list of SHA1 hashes for samples signed with the certificate matching the requested thumbprintget_certificate_information_aggregatedAccepts a hash (thumbprint) and returns a list of SHA1 hashes for samples signed with the certificate matching the requested thumbprintThis method automatically handles paging and returns a list of results instead of a Response objectClass:classCertificateAnalytics(TiCloudAPI)TCA-0502Methods:get_certificate_analyticsAccepts a certificate hash thumbprint (hash string) and returns certificate analytics resultsClass:classCertificateThumbprintSearch(TiCloudAPI)TCA-0503Methods:search_common_namesAccepts a certificate common name and returns common names matching the request, along with the list of thumbprints of all the certificates sharing that common namesearch_common_names_aggregatedAccepts a certificate common name and returns common names matching the request, along with the list of thumbprints of all the certificates sharing that common nameThis method automatically handles paging and returns a list of results instead of a Response objectClass:classRansomwareIndicators(TiCloudAPI)Ransomware Indicators FeedMethods:get_indicatorsAccepts a list of indicator type strings and integers for historical hours, health check and returning only freemium indicators. Returns indicators of ransomware and related toolsClass:classNewMalwareFilesFeed(ContinuousFeed)TCF-0101Methods:pull_with_timestampAccepts a time format definition and a time value. Returns malware detections from the requested timepullReturns a list of malware detections since the point in time set by the set_start method. If the user has not previously used this method, nor has the set_start method been called, it will return records starting with the current timestampset_startThis method sets the starting time for the pull methodClass:classMWPChangeEventsFeed(ContinuousFeed)TCF-0111Methods:pull_with_timestampAccepts a time format definition and a time value. Returns samples with a newly calculated or changed malware presence (MWP) classification and threat name from the requested timepullReturns a list of classification and threat name changes since the point in time set by the set_start() methodset_startThis method sets the starting time for the pull() methodClass:classNewMalwareURIFeed(TiCloudAPI)TCF-0301Methods:pull_with_timestampAccepts a time format definition and a time value. Returns records with Ps, domains, URLs, emails, and sample hashes extracted from malware samplespull_latestReturns a maximum of 1000 latest records with Ps, domains, URLs, emails, and sample hashes extracted from malware samplesClass:classNewFilesFirstScan(TiCloudAPI)TCF-0107Methods:feed_queryAccepts a time format definition and a time value. Optional arguments are available sample and result limitReturns a list of hashes for samples collected from various sources and scanned for the frist time in TitaniumCloud systemstart_queryAccepts a time format definition and a time valueSets the starting timestamp for the pull_querypull_queryReturns the list of hashes for samples scanned for the first time starting with the timestamp defined with start_queryClass:classNewFilesFirstAndRescan(TiCloudAPI)TCF-0108Methods:feed_queryAccepts a time format definition and a time value. Optional arguments are available sample and result limitReturns a continuous list of samples in the TitaniumCloud system which have been scanned for the frist time or rescannedstart_queryAccepts a time format definition and a time valueSets the starting timestamp for the pull_querypull_queryReturns the list of hashes for scanned samples starting with the timestamp defined with the start_queryClass:classFilesWithDetectionChanges(TiCloudAPI)TCF-0109Methods:feed_queryAccepts a time format definition and a time value. Optional arguments are available sample and result limitReturns a list of hashes for scanned samples (first time scan or detection changes), starting with the provided timestampstart_queryAccepts a time format definition and a time valueSets the starting timestamp for the pull_querypull_queryReturns the list of hashes for scanned samples starting with the timestamp defined with the start_queryClass:classCvesExploitedInTheWild(TiCloudAPI)TCF-0202Methods:pull_daily_cve_reportAccepts a time format definition and a time value.Returns a document containing the list of malware hashes (SHA1, SHA256, MD5), threat names, and threat counts associated with the CVE identifiers for the requested daypull_latest_cve_reportReturns a document containing the list of malware hashes (SHA1, SHA256, MD5), threat names, and threat counts associated with the CVE identifiers for the latest day for which we have dataClass:classNewExploitOrCveSamplesFoundInWildHourly(TiCloudAPI)TCF-0203Methods:hourly_exploit_list_queryAccepts a time format definition and a time value. Optional arguments are available sample and result limitReturns a list of new file hashes that contain CVE or exploit identification and that are detected within the requested one-hour period in the TitaniumCloud systemlatest_hourly_exploit_list_queryReturns the results from latest hour for which we have dataClass:classNewExploitAndCveSamplesFoundInWildDaily(TiCloudAPI)TCF-0204Methods:daily_exploit_list_queryAccepts a time format definition and a time value. Optional arguments are available sample and result limitReturns a list of ne file hashes that contain CVE or exploit identification and that are detected per day period in th TitaniumCloud systemlatest_daily_exploit_list_queryReturns the results from latest day for which we have dataClass:classNewWhitelistedFiles(TiCloudAPI)TCF-0501Methods:feed_queryAccepts a time definition and a time value. Optional arguments are available sample and result limitReturns a list of newly whitelisted samples since the requested timestart_querySets the starting timestamp for the pull_querypull_queryReturns the list of newly whitelisted samples, with the timestamp defined with the start_queryClass:classChangesWhitelistedFiles(TiCloudAPI)TCF-0502Methods:feed_queryAccepts a time definition and a time valueReturns a list of the samples which changed their whitelist status since requested timelatest_queryReturns the 1000 latest samples which changed their whitelist statusClass:classImpHashSimilarity(TiCloudAPI)TCA-0302Methods:get_imphash_indexAccepts an imphash and returns a list of SHA-1 hashes of files sharing that imphashget_imphash_index_aggregatedAccepts an imphash and returns a list of SHA-1 hashes of files sharing that imphashThis method automatically handles paging and returns a list of results instead of a Response objectClass:classYARAHunting(TiCloudAPI)TCA-0303Methods:create_rulesetCreates a new YARA rulesetThe ruleset_text parameter needs to be a stringified YARA ruleset / a Unicode stringdelete_rulesetDeletes a YARA rulesetget_ruleset_infoGet information for a specific YARA ruleset or all YARA rulesets in the collectionget_ruleset_textGet the text of a YARA rulesetyara_matches_feedReturns a recordset of YARA ruleset matches in the specified time rangeClass:classYARARetroHunting(TiCloudAPI)TCA-0319Methods:enable_retro_huntEnables the retro hunt for the specified ruleset that has been submitted to TitaniumCloud prior to deployment of YARA retrostart_retro_huntStarts the retro hunt for the specified rulesetcheck_statusChecks the retro hunt status for the specified rulesetcancel_retro_huntCancels the retro hunt for the specified rulesetyara_retro_matches_feedReturns a recordset of YARA ruleset matches in the specified time rangeClass:classFileReputationUserOverride(TiCloudAPI)TCA-0102Methods:override_classificationAccepts two parametersA list of samples whose classification needs to be overridenA list of samples whose classification override needs to me removedlist_active_overridesAccepts a hash type designation and returns the hashes of all currently active classification overrides for the current organization.list_active_overrides_aggregatedAccepts a hash type designation and returns the hashes of all currently active classification overrides for the current organization. This method does the paging action automatically and a maximum number of results returned in the list can be defined with the max_results parameter.Class:classDomainThreatIntelligence(TiCloudAPI)TCA-0405Methods:get_domain_reportAccepts a domain string and returns threat intelligence data for the submitted domain.get_downloaded_filesAccepts a domain string and retrieves a list of files downloaded from the submitted domain.get_downloaded_files_aggregatedAccepts a domain string and retrieves a list of files downloaded from the submitted domain. This method performs the paging automatically and returns a list of results. The maximum number of results to be returned can be set.urls_from_domainAccepts a domain string and returns a list of URLs associated with the requested domain.urls_from_domain_aggregatedAccepts a domain string and returns a list of URLs associated with the requested domain. This method performs the paging automatically and returns a list of results. The maximum number of results to be returned can be set.domain_to_ip_resolutionsAccepts a domain string and returns a list of domain-to-IP mappings for the requested domain.domain_to_ip_resolutions_aggregatedAccepts a domain string and returns a list of domain-to-IP mappings for the requested domain. This method performs the paging automatically and returns a list of results. The maximum number of results to be returned can be set.related_domainsAccepts a domain string and returns a list of domains that have the same top parent domain as the requested domain.related_domains_aggregatedAccepts a domain string and returns a list of domains that have the same top parent domain as the requested domain. This method performs the paging automatically and returns a list of results. The maximum number of results to be returned can be set.Class:classIPThreatIntelligence(TiCloudAPI)TCA-0406Methods:get_ip_reportAccepts an IP address as a string and returns threat intelligence data for the submitted IP address.get_downloaded_filesAccepts an IP address as a string and returns a list of files downloaded from the submitted IP address.get_downloaded_files_aggregatedAccepts an IP address as a string and returns a list of files downloaded from the submitted IP address. This method performs the paging automatically and returns a list of results. The maximum number of results to be returned can be set.urls_from_ipAccepts an IP address as a string and returns a list of URLs associated with the requested IP.urls_from_ip_aggregatedAccepts an IP address as a string and returns a list of URLs associated with the requested IP. This method performs the paging automatically and returns a list of results. The maximum number of results to be returned can be set.ip_to_domain_resolutionsAccepts an IP address as a string and returns a list of IP-to-domain mappings for the specified IP address.ip_to_domain_resolutions_aggregatedAccepts an IP address as a string and returns a list of IP-to-domain mappings for the specified IP address. This method performs the paging automatically and returns a list of results. The maximum number of results to be returned can be set.Class:classFileAnalysisNonMalicious(TiCloudAPI)TCA-0105Methods:get_analysis_resultsAccepts a hash string or a list of hash strings and returns knowledge about the given samples if they are classified as goodware.Class:classDataChangeSubscription(TiCloudAPI)TCA-0206Methods:subscribeSubscribes to a list of samples (hashes) for which the changed data (if there are any) will be delivered in the Data Change Feed.unsubscribeUnsubscribes from a list of samples that the user was previously subscribed to.set_start_timeSets the starting point for the DataChangeSubscription.pull_from_feed method.pull_from_feedReturns a recordset with samples to which the user is subscribed. The starting point for this action is set using the DataChangeSubscription.set_start_time method. If the starting point is not set, this method will return records starting with the current timestamp. Every subsequent request will continue from the timestamp where the previous request ended.continuous_data_change_feedReturns a recordset with samples to which the user is subscribed from the timestamp stated in the request onwards. To fetch the next recordset, use the last_timestamp value from the response and submit it in a new request as the time_value parameter.Class:classNewMalwarePlatformFiltered(TiCloudAPI)TCF-0102-0106Methods:feed_queryReturns a list of malware samples optionally filtered by platform since the requested timestamp.start_querySets the starting timestamp for the pull_query.pull_queryReturns the list of malware samples optionally filtered by platform since a point in time set by the start_query.Class:classCustomerUsage(TiCloudAPI)TCA-9999Methods:daily_usageReturns information about daily service usage for the TitaniumCloud account that sent the
request.monthly_usageReturns information about monthly service usage for the TitaniumCloud account that sent the
request.date_range_usageThis method returns total usage for all product licenses with a fixed quota over a single date range.active_yara_rulesetsThis method returns information about the number of active YARA rulesets for the TitaniumCloud
account that sent the request.quota_limitsThis method returns current quota limits for API-s accessible to the authenticated user.Class:classNetworkReputation(TiCloudAPI)TCA-0407Methods:get_network_reputationReturns reputation information about queried URL-, domains and IP addresses.Class:classMalwareFamilyDetection(TiCloudAPI)TCA-0305Methods:get_malware_familyReturns all malware families to which sample belongs based on the detections from the latest AV scanClass:classVerticalFeedsStatistics(TiCloudAPI)Vertical Feed Statistics API provides information about new malware samples detection in the ReversingLabs TitaniumCloud system, filtered by category (industry). Categories and API codes correspond to the ReversingLabs Targeted and Industry-Specific File Indicator Feeds (e.g., Financial, Retail, Exploits...).CodesFeed NameTCA-0307APT (Advanced Persistent Threats) StatisticsTCA-0308Financial Services Malware StatisticsTCA-0309Retail Sector Malware StatisticsTCA-0310Ransomware StatisticsTCA-0311CVE Exploits StatisticsTCA-0317Malware configuration StatisticsMethods:feed_queryReturns information about new malware samples detected in TitaniumCloud, filtered by categoryClass:classVerticalFeedsSearch(TiCloudAPI)Service can be used to retrieve information about new malware samples from ReversingLabs Targeted and Industry-Specific File Indicator Feeds by searching for malware family names. The feeds are specialized collections of malware families that are known to have significant impact within specific industries (Retail, Financial), as well as of malware families that share a common trait (exploits, ransomware). ReversingLabs carefully selects malware families for each feed based on public and internal research.CodesFeed nameMalware Family NamesTCA-0312APT (Advanced Persistent Threats)CosmicDuke, CozyBear, Stuxnet, HellsingTCA-0313Financial Services MalwareAlice, Dorkbot, Ramnit, RipperTCA-0314Retail Sector MalwareAbaddonPOS, ChewBacca, Katrina, PoseidonTCA-0315RansomwareBitCrypt, Nanolocker, NotPetya, WannaCryTCA-0316CVE ExploitsCVE-2008-4844, CVE-2014-0495, CVE-2017-0147, CVE-2017-8291TCA-0318Malware ConfigurationDarkComet, PoisonIvy, XtremeRAT, CyberGateMethods:latest_queryReturns latest information about new malware samples from ReversingLabs Targeted and Industry-Specific File Indicator Feeds by searching for malware family names.feed_queryRetruns information about new malware samples from ReversingLabs Targeted and Industry-Specific File Indicator Feeds by searching for malware family names based on time when they are added to a particular feedClass:classNetworkReputationUserOverride(TiCloudAPI)TCA-0408Methods:reputation_overrideThis method enables two actions in one request:Send a list of network locations whose classification needs to be overriden.Send a list of network locations whose classification override needs to be removed.list_overridesReturns a list of overrides that the user has made.Class:classTAXIIRansomwareFeed(TiCloudAPI)Methods:discovery_infoReturns the information from the TAXII Server's discovery endpoint.The returned info shows the available api roots.api_root_infoReturns information about a specific api root.collections_infoReturns information about available collections in an api root.get_objectsReturns objects from a TAXII collection.Results can be filtered using several parameters.Module: tiscaleA Python module representing the ReversingLabs TitaniumScale malware analysis appliance.Class:classTitaniumScale(object):def__init__(self,host,token,wait_time_seconds,retries,verify,proxies,user_agent)Parameters:host- TitaniumScale addresstoken- TitaniumScale user token for the REST APIwait_time_seconds- wait time between each report fetching retryretries- number of report fetching retriesverify- verify SSL certificateproxies- optional proxies in useuser_agent- optional user agent stringMethods:upload_sample_from_pathAccepts a file path string for file upload and returns a response containing the analysis task URLupload_sample_from_fileAccepts a file opened in 'rb' mode for file upload and returns a response containing the analysis task URLget_resultsAccepts an analysis task URL and returns a file analysis summary or a full analysis reportThis method utilizes the set number of retries and wait time in seconds to time out if the analysis results are not readyupload_sample_and_get_resultsAccepts a file path string or an opened file in 'rb' mode for file upload and returns a file analysis summary or a full analysis reportThis method combines uploading a sample and obtaining the analysis resultsThe result obtaining action of this method utilizes the set number of retries and wait time in seconds to time out if the analysis results are not readylist_processing_tasksLists processing tasks generated by file submission requests.get_processing_task_infoRetrieves information about a completed file processing taskdelete_processing_taskDeletes a processing task record from the system.delete_multiple_tasksDeletes multiple task records from the system based on the time when they were submitted.get_yara_idRetrieves the identifier of the current set of YARA rules on the TitaniumScale Worker instance.Module: clouddeepscanHandles communication with Cloud Deep Scan API endpoints.Class:classCloudDeepScan(object)Parameters:token_endpoint- token endpoint that is used to fetch authorization tokenrest_hostname- REST API hostname that is used as base URL to generate endpointsclient_id- ID of OAuth2.0 client used for authorizationclient_secret- secret of OAuth2.0 client used for authorizationMethods:upload_sampleAccepts a file path string of a file that should be scanned and optional configuration of how many part uploads to do concurrently, returns submission IDfetch_submissionAccepts submission ID and returns an instance of CloudDeepScanSubmissionStatusfetch_submission_historyAccepts either sample name or sample hash and returns list of CloudDeepScanSubmissionStatus objectsdownload_reportAccepts sha1 hash of the sample and path of the output file where JSON report will be stored and stores report to that locationClass:classCloudDeepScanSubmissionStatus(object)Parameters:id_- submission ID of the submissioncreated_at- datetime instance of time when submission is createdstatus- submission status, can be one of: scanned, scanning, errorreport- URL pointing to report location, None if status is not "scanned"ExamplesA1000fromReversingLabs.SDK.a1000importA1000# Using username and password for authorizationa1000=A1000(host="https://a1000.address",username="username",password="password",verify=True,wait_time_seconds=3,retries=10)response=a1000.upload_sample_and_get_summary_report_v2(file_path="/path/to/file.exe",retry=True,custom_filename="CustomName",tags="custom,tags,go,here",)json_report=response.json()fromReversingLabs.SDK.a1000importA1000# Using the token for authorizationa1000=A1000(host="http://a1000.address",token="1js76asmklaslk288japj29s89z",verify=False,wait_time_seconds=2,retries=15)response=a1000.list_extracted_files_v2(sample_hash="cf23df2207d99a74fbe169e3eba035e633b65d94",page_size=30)json_report=response.json()TitaniumCloudfromReversingLabs.SDK.ticloudimportFileReputation,URIStatistics,FileDownload,FileUploadhost="https://data.reversinglabs.com"username="username"password="password"user_agent="MyCustom App v0.0.1"file_reputation=FileReputation(host=host,username=username,password=password,user_agent=user_agent)reputation=file_reputation.get_file_reputation(hash_input="cf23df2207d99a74fbe169e3eba035e633b65d94",extended_results=True,show_hashes_in_results=False)uri_statistics=URIStatistics(host=host,username=username,password=password,user_agent=user_agent)statistics=uri_statistics.get_uri_statistics(uri_input="youtube.com")file_download=FileDownload(host=host,username=username,password=password,user_agent=user_agent)download=file_download.download_sample(hash_input="cf23df2207d99a74fbe169e3eba035e633b65d94")withopen("/path/to/file","wb")asfile_handle:file_handle.write(download.content)file_upload=FileUpload(host=host,username=username,password=password,user_agent=user_agent)upload=file_upload.upload_sample_from_path(file_path="/path/to/file",sample_name="Custom Sample Name",sample_domain="webdomain.com")TitaniumScalefromReversingLabs.SDK.tiscaleimportTitaniumScaletitanium_scale=TitaniumScale(host="https://tiscale.address",token="examplesecrettoken",# replace with a proper tokenverify=True,wait_time_seconds=5,retries=6)results=titanium_scale.upload_sample_and_get_results(file_source=open("/path/to/file.exe","rb"),full_report=True)CloudDeepScanfromReversingLabs.SDK.clouddeepscanimportCloudDeepScan,CloudDeepScanExceptioncloud_deep_scan=CloudDeepScan(token_endpoint="https://exampletokenendpoint.reversinglabs.com/oauth2/token",rest_hostname="https://example.clouddeepscan.com",client_id="exampleclientid",client_secret="exampleclientsecret")try:submission_id=cloud_deep_scan.upload_sample(sample_path="/path/to/file/suspicious_file.exe")exceptCloudDeepScanException:passtry:status_data=cloud_deep_scan.fetch_submission(submission_id=submission_id)# Returns CloudDeepScanSubmissionStatus instanceprint(status_data.id)# submission idprint(str(status_data.created_at))# datetime instanceprint(status_data.status)# statusprint(status_data.report)# URI path to the report fileexceptCloudDeepScanException:passtry:submission_history=cloud_deep_scan.fetch_submission_history(sample_hash="0f5de47158e40b5d791cb3698b7dc599be21cf95")forsubmission_statusinsubmission_history:print(submission_status.id)# submission idprint(str(submission_status.created_at))# datetime instanceprint(submission_status.status)# statusprint(submission_status.report)# URI path to the report fileexceptCloudDeepScanException:passtry:cloud_deep_scan.download_report(sample_hash="0f5de47158e40b5d791cb3698b7dc599be21cf95",report_output_path="reports/report1.json")# report parent directory must existexceptCloudDeepScanException:pass