Recorded Future Sandbox

https://tria.ge/docs
Admin
Recorded Future Sandbox is an automated malware analysis platform that performs static and...
Tokens:50,527
Snippets:327
Trust Score:9.8
Update:3 weeks ago
Show doc for...
Tokens:
Raw
### GET /users/{userID}/apikeys - Example response

Source: https://tria.ge/docs/cloud-api/users

Example response for GET /users/{userID}/apikeys, listing all API keys for the user.

```json
{
  "data": [
    {
      "name": "foo",
      "key": "cfde93eeab451dc73fb43986f525ccd9fe197a1c"
    }
  ]
}

```

--------------------------------

### GET /stats/user example

Source: https://tria.ge/docs/cloud-api/stats

Retrieves usage statistics for the requesting user. Requires an access key in the Authorization header. The response contains the samples_submitted field.

```bash
curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    'https://tria.ge/api/v0/stats/user'
```

```json
// Response:
{
  "samples_submitted": 880
}
```

--------------------------------

### GET /samples/{sampleID}/events - curl example

Source: https://tria.ge/docs/cloud-api/samples

Opens a JSONL stream to track the progress of a sample in real time. Requires an access key in the Authorization header. The stream sends the current status when opened and closes after a terminal status ("reported" or "failed") is sent; do not reconnect. Returns a 404 NOT_FOUND error if the sample does not exist.

```bash
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    'https://tria.ge/api/v0/samples/<SAMPLE_ID>/events'

```

--------------------------------

### GET /stats/org example

Source: https://tria.ge/docs/cloud-api/stats

Retrieves usage statistics aggregated across the organization the requesting user is a member of. Requires an access key in the Authorization header. The response contains the samples_submitted field.

```bash
curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    'https://tria.ge/api/v0/stats/org'
```

```json
// Response:
{
  "samples_submitted": 2180
}
```

--------------------------------

### GET /profiles - List Profiles

Source: https://tria.ge/docs/cloud-api/profiles

Lists all profiles for the company. Uses the GET /profiles endpoint with an authorization header.

```bash
curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    https://tria.ge/api/v0/profiles/<PROFILE_ID>
```

--------------------------------

### Platform/OS search examples

Source: https://tria.ge/docs/cloud-api/search

Filter for Android or Linux analyses using the tag operator.

```text
tag:android
tag:linux

```

--------------------------------

### GET /search with curl and JSON response

Source: https://tria.ge/docs/cloud-api/samples

Use this curl command to search for samples using the Search API. The query is placed in the `query` GET parameter, here filtering by family:emotet. The response includes a data array and a next cursor for pagination.

```bash
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    'https://tria.ge/api/v0/search?query=family:emotet'

```

```json
{
  "data": [
    {
      "id": "201026-n8zz26cd4s",
      "status": "reported",
      "kind": "file",
      "filename": "888d012fd36d8fa86ab57e0d547eb429e68303fcdf76b08191942e9307a74f78",
      "private": false,
      "submitted": "2020-10-26T16:51:31Z",
      "completed": "2020-10-26T16:52:55Z",
      "user_id": "59b43c0d-3bbe-495b-a80c-349a4c058426"
    },
    ...
  ],
  "next": "2020-10-26T16:51:21.232458Z"
}

```

--------------------------------

### GET /samples/{sampleID}/events

Source: https://tria.ge/docs/cloud-api/samples

Opens a JSONL stream to track the progress of a sample in real time. Requires an authorization bearer token.

```APIDOC
## GET /samples/{sampleID}/events

### Description
Opens a JSONL stream to keep track of the progress of a sample in real time. The stream consists of a series of events labeled `sample` with a JSON encoded sample object as payload. When the connection is opened, the current status of the sample is always sent. After a sample with a terminal status (`"reported"`, `"failed"`) is sent, the connection is closed.

### Method
GET

### Endpoint
/samples/{sampleID}/events

### Parameters
#### Path Parameters
- **sampleID** (string) - Required - The unique identifier of the sample.

### Request Example
```
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    'https://tria.ge/api/v0/samples/<SAMPLE_ID>/events'
```

### Response
#### Success Response (200)
- A JSONL stream of events, each labeled `sample` with a JSON encoded sample object as payload.

#### Error Handling
- `404, "NOT_FOUND"` - if the sample does not exist.

```

--------------------------------

### GET /org/settings

Source: https://tria.ge/docs/cloud-api/org-settings

Retrieves the current organization settings, including the magic link configuration.

```APIDOC
## GET /org/settings

### Description
Returns the available organization settings.

### Method
GET

### Endpoint
/org/settings

### Response
#### Success Response (200)
- **magic_link** (object) - The magic link settings.
  - **enabled** (boolean) - Whether magic link creation is enabled or not.

#### Response Example
{
  "magic_link": {
    "enabled": false
  }
}
```

--------------------------------

### GET /samples/{sampleID}/reports/static

Source: https://tria.ge/docs/cloud-api/samples

Retrieves the generated static report for a sample. Requires an authorization bearer token.

```APIDOC
## GET /samples/{sampleID}/reports/static

### Description
Retrieves the generated static report for a sample.

### Method
GET

### Endpoint
/samples/{sampleID}/reports/static

### Parameters
#### Path Parameters
- **sampleID** (string) - Required - The unique identifier of the sample.

### Request Example
```
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    https://tria.ge/api/v0/samples/<SAMPLE_ID>/reports/static | jq
```

### Response
#### Success Response (200)
- The static report content.

#### Error Handling
- `404, "NOT_FOUND"` - if the sample does not exist.
- `404, "REPORT_NOT_AVAILABLE"` - if the status of the sample is before `"static_analysis"` or the status is `"failed"`.

```

--------------------------------

### GET /samples/{sampleID}/overview.json

Source: https://tria.ge/docs/cloud-api/samples

This endpoint retrieves the overview of a specific sample, including its analysis tasks, malware configuration, signatures, and scoring information.

```APIDOC
## GET /samples/{sampleID}/overview.json

### Description
Returns the overview of the sample and its analysis tasks. The overview contains a one-pager with all the high-level information related to the sample including malware configuration, signatures, scoring, etc.

### Method
GET

### Endpoint
/samples/{sampleID}/overview.json

### Parameters
#### Path Parameters
- **sampleID** (string) - Required - The unique identifier of the sample.

### Request Example
```
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    'https://tria.ge/api/v0/samples/<SAMPLE_ID>/overview.json'
```

### Response
#### Success Response (200)
- **version** (string) - The version of the overview report.
- **sample** (object) - Contains sample metadata: id, target, size, md5, sha1, sha256, sha512.
- **tasks** (object) - Map of task IDs to task details (kind, status, tags, score, target, backend, resource, platform, task_name, queue_id).
- **analysis** (object) - Contains the overall score.
- **targets** (array) - List of target objects with tasks, score, target, size, hashes, tags, family, signatures.
- **extracted** (array) - List of extracted artifacts with tasks, dumped_file, resource, config.

#### Response Example
```
{
  "version": "0.2.2",
  "sample": {
    "id": "200916-w52vg1yl1a",
    "target": "131.doc",
    "size": 547328,
    "md5": "3e241f5a1e7be77f25078560c8660351",
    "sha1": "ba25c371e75d1a52c1f41c163dc8840626423948",
    "sha256": "22d653dab4765e13c5fce0bf46a28a098d05582148fdf3101093f3687b42a5f1",
    "sha512": "4f031f6a3e44687ca65ceec847aacf3053feec0882bd5c07febef85ba1a7570ec1f4357446dfc84226448e1d8eb342066eeb3e6e7394d53caadd66223a2ff345"
  },
  "tasks": {
    "200916-w52vg1yl1a-behavioral1": {
      "kind": "behavioral",
      "status": "reported",
      "tags": ["spyware", "trojan", "banker", "family:trickbot"],
      "score": 10,
      "target": "131.doc",
      "backend": "fu1m1",
      "resource": "win10v200722",
      "platform": "windows10_x64",
      "task_name": "300 seconds - Win. 10",
      "queue_id": 1911088
    },
    "200916-w52vg1yl1a-static1": {
      "kind": "static",
      "status": "reported"
    }
  },
  "analysis": {
    "score": 10
  },
  "targets": [
    {
      "tasks": ["behavioral1"],
      "score": 10,
      "target": "131.doc",
      "size": 547328,
      "md5": "3e241f5a1e7be77f25078560c8660351",
      "sha1": "ba25c371e75d1a52c1f41c163dc8840626423948",
      "sha256": "22d653dab4765e13c5fce0bf46a28a098d05582148fdf3101093f3687b42a5f1",
      "sha512": "4f031f6a3e44687ca65ceec847aacf3053feec0882bd5c07febef85ba1a7570ec1f4357446dfc84226448e1d8eb342066eeb3e6e7394d53caadd66223a2ff345",
      "tags": ["spyware", "trojan", "banker", "family:trickbot"],
      "family": ["trickbot"],
      "signatures": [
        {
          "label": "trickbot",
          "name": "Trickbot",
          "score": 10,
          "tags": ["trojan", "banker", "family:trickbot"],
          "desc": "Developed in 2016, TrickBot is one of the more recent banking Trojans."
        }
      ]
    }
  ],
  "extracted": [
    {
      "tasks": ["behavioral1"],
      "dumped_file": "extracted/trickbot.payload-3",
      "resource": "behavioral1/memory/3212-19-0x0000000000A20000-0x0000000000A56000-memory.dmp",
      "config": {
        "family": "trickbot",
        "rule": "Trickbot2019",
        "c2": ["51.89.163.40:443", "89.223.126.186:443"],
        "version": "1000514",
        "botnet": "ono76",
        "keys": [
          {
            "kind": "ecc_pubkey.base64",
            "key": "ecc_pubkey",
            "value": "RUNTMzAAAADzIIbbIE3wcze1+xiwwK+Au/P78UrAO8YAHyPvHEwGVKOPphl8QVfrC7x/QaFYeXANw6E4HF7ietEp+7ZVQdWOx8c+HvO0Z2PTUPVbX9HAVrg4h9u1RNfhOHk+YysDLsg="
          }
        ],
        "attr": {
          "autorun": [
            {
              "name": "pwgrab",
              "control": ""
            }
          ]
        }
      }
    }
  ]
}
```

### Errors
- **404, NOT_FOUND** - If the sample does not exist.
```

--------------------------------

### GET /samples/{sampleID}/magic

Source: https://tria.ge/docs/cloud-api/samples

Retrieves the Magic Token associated with this sample. The token can be used to craft the final URL.

```bash
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    'https://tria.ge/api/v0/samples/{sampleID}/magic'
"<magictoken>"

# Sample URL including Magic Token would then be:
# https://private.tria.ge/{sampleID}/magic/{magictoken}

```

--------------------------------

### GET /samples/{sampleID}/{taskID}/logs/onemon.json

Source: https://tria.ge/docs/cloud-api/samples

Retrieves the output of the kernel monitor in JSON format for a specific sample and task.

```APIDOC
## GET /samples/{sampleID}/{taskID}/logs/onemon.json

### Description
Retrieves the output of the kernel monitor in JSON format.

### Method
GET

### Endpoint
/samples/{sampleID}/{taskID}/logs/onemon.json

### Path Parameters
- **sampleID** (string) - Required - The ID of the sample.
- **taskID** (string) - Required - The ID of the analysis task.

### Authentication
Requires an Authorization header with a Bearer token.

### Request Example
```
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    'https://tria.ge/api/v0/samples/{sampleID}/{taskID}/logs/onemon.json' \
    --output log.json
```

### Response
#### Success Response (200)
- **body** (file) - The kernel monitor log in JSON format.

#### Response Example
```
(file content)
```
```

--------------------------------

### Cryptocurrency wallet search example

Source: https://tria.ge/docs/cloud-api/search

Search based on cryptocurrency wallet addresses dumped by configuration extractors, e.g., from ransomnotes.

```text
wallet:398sW5eMDvyr93CJHKRD3eYE9vK5ELVrHP

```

--------------------------------

### GET /samples/{sampleID}

Source: https://tria.ge/docs/cloud-api/samples

Queries the sample with the specified ID. Returns sample details including status, kind, filename, and submission metadata.

```APIDOC
## GET /samples/{sampleID}

### Description
Queries the sample with the specified ID.

### Method
GET

### Endpoint
/samples/{sampleID}

### Parameters
#### Path Parameters
- **sampleID** (string) - Required - The ID of the sample to retrieve.

### Request Example
```
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    'https://tria.ge/api/v0/samples/<SAMPLE_ID>'
```

### Response
#### Success Response (200)
- **id** (string) - Sample ID
- **status** (string) - Sample status
- **kind** (string) - Sample kind
- **filename** (string) - Sample filename
- **private** (boolean) - Whether the sample is private
- **submitted** (string) - Submission timestamp
- **user_id** (string) - User ID of the submitter

#### Response Example
```
{
  "id": "190724-hakvlwz8cx",
  "status": "reported",
  "kind": "file",
  "filename": "evil.bat",
  "private": true,
  "submitted": "2019-07-24T13:32:07.253524Z",
  "user_id": "59b43c0d-3bbe-495b-a80c-349a4c058426"
}
```

### Errors
- **404, NOT_FOUND** - If the sample does not exist.
```

--------------------------------

### Fetch sample from URL (form and JSON)

Source: https://tria.ge/docs/cloud-api/submit

Two ways to fetch a sample from a URL: using form data or JSON. Both set kind to fetch and include the sample URL.

```bash
# As form:
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    -F kind=fetch \
    -F url=https://hostname.tld/sample.exe \
    https://tria.ge/api/v0/samples
```

```bash
# As JSON:
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    -H 'Content-Type: application/json' \
    -d '{"kind": "fetch", "url": "https://hostname.tld/sample.exe"}'
    https://tria.ge/api/v0/samples
```

--------------------------------

### GET /geolocations

Source: https://tria.ge/docs/cloud-api/geolocations

This snippet documents the GET /geolocations endpoint, which lists all available geolocations for network routing during behavioral analysis. It includes the endpoint URL, authentication method, and example curl commands.

```APIDOC
## GET /geolocations

### Description
List all geolocations available for network routing during behavioral analysis.

### Method
GET

### Endpoint
https://tria.ge/api/v0/geolocations

### Authentication
Bearer token (Authorization header)

### Request Example
```
curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    https://tria.ge/api/v0/geolocations
```

### Response
#### Success Response (200)
- **data** (array) - List of geolocation objects.
- **data[].geolocations** (array) - List of geolocation entries.
- **data[].geolocations[].tags** (array) - Tags associated with each geolocation.

#### Response Example
```
curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    https://tria.ge/api/v0/geolocations | jq '.data[].geolocations[].tags'
```

### Notes
For a quick overview of all available geolocation tags, use:
```
curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    https://tria.ge/api/v0/geolocations | jq '[.data[].geolocations[].tags] | unique'
```
```

--------------------------------

### Fetch sample overview with curl

Source: https://tria.ge/docs/cloud-api/samples

Use this curl command to retrieve the overview report for a sample. Replace <YOUR_ACCESS_KEY> with your API key and <SAMPLE_ID> with the sample identifier. The response is a JSON object containing sample metadata, analysis tasks, and extracted configuration.

```bash
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    'https://tria.ge/api/v0/samples/<SAMPLE_ID>/overview.json'

```

```json
// Response:
{
  "version": "0.2.2",
  "sample": {
    "id": "200916-w52vg1yl1a",
    "target": "131.doc",
    "size": 547328,
    "md5": "3e241f5a1e7be77f25078560c8660351",
    "sha1": "ba25c371e75d1a52c1f41c163dc8840626423948",
    "sha256": "22d653dab4765e13c5fce0bf46a28a098d05582148fdf3101093f3687b42a5f1",
    "sha512": "4f031f6a3e44687ca65ceec847aacf3053feec0882bd5c07febef85ba1a7570ec1f4357446dfc84226448e1d8eb342066eeb3e6e7394d53caadd66223a2ff345"
  },
  "tasks": {
    "200916-w52vg1yl1a-behavioral1": {
      "kind": "behavioral",
      "status": "reported",
      "tags": [
        "spyware",
        "trojan",
        "banker",
        "family:trickbot"
      ],
      "score": 10,
      "target": "131.doc",
      "backend": "fu1m1",
      "resource": "win10v200722",
      "platform": "windows10_x64",
      "task_name": "300 seconds - Win. 10",
      "queue_id": 1911088
    },
    "200916-w52vg1yl1a-static1": {
      "kind": "static",
      "status": "reported"
    }
  },
  "analysis": {
    "score": 10
  },
  "targets": [
    {
      "tasks": [
        "behavioral1"
      ],
      "score": 10,
      "target": "131.doc",
      "size": 547328,
      "md5": "3e241f5a1e7be77f25078560c8660351",
      "sha1": "ba25c371e75d1a52c1f41c163dc8840626423948",
      "sha256": "22d653dab4765e13c5fce0bf46a28a098d05582148fdf3101093f3687b42a5f1",
      "sha512": "4f031f6a3e44687ca65ceec847aacf3053feec0882bd5c07febef85ba1a7570ec1f4357446dfc84226448e1d8eb342066eeb3e6e7394d53caadd66223a2ff345",
      "tags": [
        "spyware",
        "trojan",
        "banker",
        "family:trickbot"
      ],
      "family": [
        "trickbot"
      ],
      "signatures": [
        {
          "label": "trickbot",
          "name": "Trickbot",
          "score": 10,
          "tags": [
            "trojan",
            "banker",
            "family:trickbot"
          ],
          "desc": "Developed in 2016, TrickBot is one of the more recent banking Trojans."
        },
        ...
      ]
    }
  ],
  "extracted": [
      ...
    {
      "tasks": [
        "behavioral1"
      ],
      "dumped_file": "extracted/trickbot.payload-3",
      "resource": "behavioral1/memory/3212-19-0x0000000000A20000-0x0000000000A56000-memory.dmp",
      "config": {
        "family": "trickbot",
        "rule": "Trickbot2019",
        "c2": [
          "51.89.163.40:443",
          "89.223.126.186:443",
          "45.67.231.68:443",
          "148.251.185.165:443",
          "194.87.110.144:443",
          "213.32.84.27:443",
          "185.234.72.35:443",
          "45.89.125.148:443",
          "195.123.240.104:443",
          "185.99.2.243:443",
          "5.182.211.223:443",
          "195.123.240.113:443",
          "85.204.116.173:443",
          "5.152.210.188:443",
          "103.36.48.103:449",
          "36.94.33.102:449",
          "36.91.87.227:449",
          "177.190.69.162:449",
          "103.76.169.213:449",
          "179.97.246.23:449",
          "200.24.67.161:449",
          "181.143.186.42:449",
          "190.99.97.42:449",
          "179.127.88.41:449",
          "117.252.214.138:449",
          "117.222.63.145:449",
          "45.224.213.234:449",
          "45.237.241.97:449",
          "125.165.20.104:449"
        ],
        "version": "1000514",
        "botnet": "ono76",
        "keys": [
          {
            "kind": "ecc_pubkey.base64",
            "key": "ecc_pubkey",
            "value": "RUNTMzAAAADzIIbbIE3wcze1+xiwwK+Au/P78UrAO8YAHyPvHEwGVKOPphl8QVfrC7x/QaFYeXANw6E4HF7ietEp+7ZVQdWOx8c+HvO0Z2PTUPVbX9HAVrg4h9u1RNfhOHk+YysDLsg="
          }
        ],
        "attr": {
          "autorun": [
            {
              "name": "pwgrab",
              "control": ""
            }
          ]
        }
      }
    }
  ]
}

```

--------------------------------

### Set profiles to start sandbox analysis

Source: https://tria.ge/docs/cloud-api/usage-examples

Continues an interactive submission by setting one or more profiles. The response is an empty JSON object '{}'. Select a profile created earlier via the profile API or web interface.

```bash
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    -X POST \
    --data-raw '{"profiles":[{"profile":"<PROFILE_ID>"}]}' \
    'https://tria.ge/api/v0/samples/<SAMPLE_ID>/profile'
# {}

```

--------------------------------

### GET /samples/{sampleID}/{taskID}/files/{fileName} - Retrieve dropped file

Source: https://tria.ge/docs/cloud-api/samples

Retrieves files dumped by the sample. The names can be found under the "dumped" section in the report_triage.json file. This example shows retrieving a dropped file.

```bash
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    'https://tria.ge/api/v0/samples/{sampleID}/{taskID}/files/{fileName}' \
    --output file.exe

```

--------------------------------

### GET /samples/{sampleID}/{taskID}/report_triage.json - curl example

Source: https://tria.ge/docs/cloud-api/samples

Retrieves the Triage™ Report for a single task. Requires an access key in the Authorization header. Returns a 404 NOT_FOUND error if the sample does not exist, or a 404 REPORT_NOT_AVAILABLE error if the task status is not "reported".

```bash
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    https://tria.ge/api/v0/samples/<SAMPLE_ID>/behavioral1/report_triage.json | jq

```

--------------------------------

### List all resources with curl

Source: https://tria.ge/docs/cloud-api/resources

Uses the GET /resources endpoint to fetch all available analysis resources. Requires an access key in the Authorization header. The output is the full JSON response.

```bash
curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    https://tria.ge/api/v0/resources

```

--------------------------------

### Submit archive and select files immediately

Source: https://tria.ge/docs/cloud-api/usage-examples

Uploads an archive and selects files to analyze by populating the 'profiles' field with 'pick' entries prefixed with 'unpack001/'. The response includes the sample ID and status.

```bash
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    -X POST \
    -F 'file=@<YOUR_SAMPLE_FILE_PATH>' \
    -F '_json={"kind":"file","profiles":[{"pick":"unpack001/evil.bat","profile":"<PROFILE_ID>"}]}' \
    'https://tria.ge/api/v0/samples'

```

```json
// Response:
{
  "id": "190724-hakvlwz8cx",
  "status": "pending",
  // ...
}

```

--------------------------------

### Logic operator usage examples

Source: https://tria.ge/docs/cloud-api/search

Example queries combining operators with the AND, OR, and NOT logic. Note the space before the colon in 'score: 10'.

```text
family:emotet OR family:trickbot
family:smokeloader AND family:zloader
score: 10 AND NOT family
NOT family:emotet

```

--------------------------------

### POST /profiles - Create Profile

Source: https://tria.ge/docs/cloud-api/profiles

Creates a new profile by sending a POST request with a profile object (ID omitted) as the request body. The example uses tags, timeout, and network settings. A 409 error with PROFILE_ALREADY_EXISTS is returned if the name is already taken.

```bash
curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    -X POST \
    -d '{"name":"foo","tags":["os:windows10-2004-x64","locale:en-us"],"timeout":120,"network":"internet"}' \
    https://tria.ge/api/v0/profiles
```

--------------------------------

### Get unique geolocation tags with jq

Source: https://tria.ge/docs/cloud-api/geolocations

Use this command to get a quick overview of all available geolocation tags by extracting and deduplicating them.

```bash
curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    https://tria.ge/api/v0/geolocations | jq '[.data[].geolocations[].tags] | unique'

```

--------------------------------

### GET /search

Source: https://tria.ge/docs/cloud-api/samples

Searches available analyses using filters and queries supported by the web interface. The search query is placed in the `query` GET parameter.

```APIDOC
## GET /search

### Description
The Search API endpoint supports all filters and queries which can be used through the web interface, and allows you to search available analyses for a range of IoCs or file characteristics.

### Method
GET

### Endpoint
/search

### Parameters
#### Query Parameters
- **query** (string) - Required - The search query, placed in the `query` GET parameter.

### Request Example
```
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    'https://tria.ge/api/v0/search?query=family:emotet'
```

### Response
#### Success Response (200)
- **data** (array) - List of matching samples
  - **id** (string) - Sample ID
  - **status** (string) - Sample status
  - **kind** (string) - Sample kind
  - **filename** (string) - Sample filename
  - **private** (boolean) - Whether the sample is private
  - **submitted** (string) - Submission timestamp
  - **completed** (string) - Completion timestamp
  - **user_id** (string) - User ID of the submitter
- **next** (string) - Pagination cursor for the next page of results

#### Response Example
```
{
  "data": [
    {
      "id": "201026-n8zz26cd4s",
      "status": "reported",
      "kind": "file",
      "filename": "888d012fd36d8fa86ab57e0d547eb429e68303fcdf76b08191942e9307a74f78",
      "private": false,
      "submitted": "2020-10-26T16:51:31Z",
      "completed": "2020-10-26T16:52:55Z",
      "user_id": "59b43c0d-3bbe-495b-a80c-349a4c058426"
    }
  ],
  "next": "2020-10-26T16:51:21.232458Z"
}
```
```

--------------------------------

### GET /samples/events - Stream sample state changes

Source: https://tria.ge/docs/cloud-api/samples

Opens a JSONL event stream that relays changes to the state of all samples the querying user can see. The format is the same as /samples/{sampleID}/events except that no initial state is sent.

```bash
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    'https://tria.ge/api/v0/samples/events'

```

--------------------------------

### POST /api/v0/samples

Source: https://tria.ge/docs/cloud-api/usage-examples

Submits a sample file for analysis, with optional interactive mode and profile selection.

```APIDOC
## POST /api/v0/samples

### Description
Submits a sample file for analysis. When `interactive` is set to `true`, the sample is paused at the `static_analysis` status, allowing inspection of the static report before proceeding with sandbox analysis.

### Method
POST

### Endpoint
https://tria.ge/api/v0/samples

### Parameters
#### Request Body (multipart/form-data)
- **file** (file) - Required - The sample file to be submitted.
- **_json** (string) - Required - JSON string with submission options. Supported fields: `kind` (string, e.g., "file"), `interactive` (boolean, optional), `profiles` (array, optional).

### Request Example
```
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    -X POST \
    -F 'file=@<YOUR_SAMPLE_FILE_PATH>' \
    -F '_json={"kind":"file","interactive":true}' \
    'https://tria.ge/api/v0/samples'
```

### Response
#### Success Response (200)
- **id** (string) - The sample ID.
- **status** (string) - The current status of the sample (e.g., "pending").

#### Response Example
```
{
  "id": "190724-hakvlwz8cx",
  "status": "pending",
  // ...
}
```
```

--------------------------------

### Error Response Example

Source: https://tria.ge/docs/cloud-api/conventions

Error responses return a single object with an error code and a human-readable message. The message field is not guaranteed to be present. This example shows a 404 error.

```json
// 404
{
  "error": "NOT_FOUND",
  "message": "No sample with ID `00000000-0000-0000-0000-000000000000`"
}
```

--------------------------------

### The Sample Object

Source: https://tria.ge/docs/cloud-api/samples

Describes the structure of the Sample Object returned by the API. Includes fields for id, status, kind, filename, url, private, submitted, completed, and user_id.

```json
{
  // The unique ID of this sample.
  "id": "190329-rerrjddcaj", // string

  // The current status of the analysis process. Can be any of the values
  // listed below:
  //
  // "pending"
  // A sample has been submitted and is queued for static analysis or the
  // static analysis is in progress.
  //
  // "static_analysis"
  // The static analysis report is ready. The sample will remain in this
  // status until a profile is selected.
  //
  // "scheduled"
  // All parameters for sandbox analysis have been selected. The sample is
  // scheduled for running on the sandbox.
  //
  // "running"
  // The sample is being run by the sandbox.
  //
  // "processing"
  // The sandbox has finished running the sample and the resulting metrics
  // are being processed into reports.
  //
  // "reported"
  // The sample has reports that can be retrieved. This status is terminal.
  //
  // "failed"
  // Analysis of the sample has failed. Any other status may transition into
  // this status. This status is terminal.
  "status": "reported", // string

  // The sample kind that was submitted. Either "file" or "url".
  "kind": "file", // string

  // If the sample kind is file, this is the name of the uploaded file.
  // Otherwise, this field is omitted.
  "filename": "evil.bat", // string

  // If the sample kind is url, this is the url that was submitted. Otherwise,
  // this field is omitted.
  "url": "http://example.com/evil.js", // string

  // If true, the sample can be viewed by only the requesting user or
  // organization the user belongs to. If false, the sample can be viewed by
  // anyone with a Recorded Future: Sandbox account.
  "private": false, // bool

  // The time this sample was submitted.
  "submitted": "2019-04-05T13:37:00Z", // timestamp string

  // The time the analysis has been completed and a behavioral report has been
  // generated. Only present if the status is equal to "reported".
  "completed": "2019-04-05T13:42:00Z", // timestamp string

  // The submitter's user ID. Will be omitted if the submitter's account no longer exists.
  "user_id": "59b43c0d-3bbe-495b-a80c-349a4c058426"

}

```

--------------------------------

### User Object JSON Example

Source: https://tria.ge/docs/cloud-api/users

Example of the User object returned by the API. Note that first_name and last_name are deprecated since September 9th, 2022 and will be removed in API version 1; use the name field instead.

```json
{
  // The unique ID of the user.
  "id": "8bbf3c1b-8d5a-4c75-996c-f3daa12c1b91",

  "company_id": "6f0fba3f-65dc-4d17-8a5d-98f9441ff150",

  // The email address of the user. Case sensitive.
  "email": "john-doe@example.com",

  "email_confirmed_at": "2019-07-11T13:42:00Z", // timestamp string

  "name": "John Doe",
  "first_name": "John", // Deprecated! will be removed soon
  "last_name": "Doe", // Deprecated! will be removed soon

  // The creation or registration time of the user.
  "created_at": "2019-07-11T13:42:00Z", // timestamp string

  "role": "org_basic"
}
```

--------------------------------

### Get sample summary with curl and JSON response

Source: https://tria.ge/docs/cloud-api/samples

Returns a short summary of the sample and its analysis tasks. The response includes sample metadata, status, score, and task details. A 404 NOT_FOUND error is returned if the sample does not exist.

```bash
$ curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    'https://tria.ge/api/v0/samples/<SAMPLE_ID>/summary'

```

```json
// Response:
{
  "sample": "200606-l5dz9871we",
  "status": "reported",
  "custom": "frontend:7de1d1a3-f39b-4dd6-8a8d-b9d6bc0e7c81",
  "owner": "shark2.ams5.hatching.io",
  "target": "05af0cf40590aef24b28fa04c6b4998b7ab3b7f26e60c507adb84f3d837778f2",
  "created": "2020-06-06T00:03:27Z",
  "completed": "2020-06-06T00:06:10Z",
  "score": 10,
  "sha256": "05af0cf40590aef24b28fa04c6b4998b7ab3b7f26e60c507adb84f3d837778f2",
  "tasks": {
    "200606-l5dz9871we-behavioral1": {
      "kind": "behavioral",
      "status": "reported",
      "tags": [
        "evasion",
        "trojan",
        "persistence",
        "ransomware"
      ],
      "score": 10,
      "target": "05af0cf40590aef24b28fa04c6b4998b7ab3b7f26e60c507adb84f3d837778f2.exe",
      "backend": "horse2",
      "resource": "win7v200430",
      "platform": "windows7_x64",
      "queue_id": 1353974
    },
    "200606-l5dz9871we-behavioral2": {
      "kind": "behavioral",
      "status": "reported",
      "tags": [
        "evasion",
        "trojan",
        "ransomware",
        "persistence"
      ],
      "score": 10,
      "target": "05af0cf40590aef24b28fa04c6b4998b7ab3b7f26e60c507adb84f3d837778f2.exe",
      "backend": "horse2",
      "resource": "win10v200430",
      "platform": "windows10_x64",
      "queue_id": 1353975
    },
    "200606-l5dz9871we-static1": {
      "kind": "static",
      "status": "reported"
    }
  }
}

```

--------------------------------

### POST /samples

Source: https://tria.ge/docs/cloud-api/submit

Documentation for the POST /samples endpoint, which allows submitting files or URLs for analysis.

```APIDOC
## [POST] /samples

### Description
Submits a sample for analysis. Supports both files and URLs, and can be used in automatic or interactive mode.

### Method
POST

### Endpoint
/samples

### Parameters
#### Request Body
- **kind** (String) - Required - One of: `file`, `url`, `fetch` or `import`
- **file** (File) - Optional - The uploaded file. Requires `kind` to be set to `"file"`
- **interactive** (Boolean) - Optional - Default: `false` - If set to true, the analysis profile must be chosen manually after static analysis has finished
- **password** (String) - Optional - A password that may be used to decrypt the provided file, usually an archive (zip/rar/etc)
- **profiles** (Array) - Optional - A mapping of one or more files to one or more (embedded) profiles
- **url** (String) - Optional - The URL to use as sample. Requires `kind` to be set to `"url"` or `"fetch"`
- **defaults.timeout** (Int) - Optional - The timeout in seconds for behavioral analysis (maximum 3600)
- **defaults.network** (String) - Optional - Default: `internet` - Controls internet connectivity type for behavioral analysis

### Request Example
```json
{
    // Optionally specify the kind of submission this is. If not defined, kind
    // is inferred from the other parameters. See below for examples of each
    // type of submission.
    "kind": "file" | "url" | "fetch" | "import",

    // Submit a URL to use as sample. If kind is "fetch", the URL is downloaded
    // as file instead of executed directly in a browser.
    "url": "http://example.com/malware.exe",

    // Optional: manually specify the filename of the sample. If not specified,
    // the filename of the attached file is used. Not applicable to "url"
    "target": "my-malware.exe",

    // Optional: defaults to false.  If set to true, the analysis profile must be
    // chosen manually after static analysis has finished.
    "interactive": false,

    // Optional: A password that may be used to decrypt the provided file,
    // usually an archive (zip/rar/etc).
    "password": "infected",

    // Optional: A mapping of one or more files to one or more (embedded) profiles.
    "profiles": [...],

    // Experimental: an optional array of user-defined strings that lets the
    // user mark a sample. The resulting tags will be embedded in the reports.
    // The total size cannot exceed 1kB and tags cannot be empty.
    "user_tags": ["id:123789", "source:smtp"],

    // The optional defaults object specifies base parameters to use for
    // automatic analysis.
    "defaults": {
        // Optional: Specify the timeout of the analysis (in seconds, maximum 3600).
        "timeout": 60,

        // Optional: defaults to "internet". Specify the type of network
        // routing to use in behavioral analysis.
        "network": "internet" | "drop" | "tor"
    }
}
```

### Response
#### Success Response (200)
No response schema is documented in the source.

#### Response Example
No response example is documented in the source.

### Error Handling
No error handling details are documented in the source.
```

--------------------------------

### GET /stats/user

Source: https://tria.ge/docs/cloud-api/stats

Retrieves usage statistics for the requesting user.

```APIDOC
## GET /stats/user

### Description
Returns usage statistics for the requesting user.

### Method
GET

### Endpoint
https://tria.ge/api/v0/stats/user

### Parameters
#### Headers
- **Authorization** (string) - Required - Bearer token for authentication.

### Request Example
```
curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    'https://tria.ge/api/v0/stats/user'
```

### Response
#### Success Response (200)
- **samples_submitted** (integer) - The total number of samples submitted.

#### Response Example
```
{
  "samples_submitted": 880
}
```
```
Tokens:
Raw