The API enhancement for submission filtering provides users with the capability to filter submissions based on specific criteria, such as verdict type (malicious or riskware) and submitter name. This provides a more flexible and efficient way to manage and review submissions. This is supported from version 10.0.3 and later.
Filtering based on username and verdict type (malicious and riskware)
GET https://<host>/wsapis/[v2.0.0]/submissions/status?start_time=XX&end_time=YY&submitter_name={submittername}&verdict={value}Sample curl request:
curl -gsk -H "$c" "https://<host>/wsapis/mvx/v2.0.0/submissions/status?start_time=2021-03-23T18:51:00.000-00:00&end_time=2021-03-23T19:51:00.000-00:00&submitter_name=admin&verdict=malicious"
Parameters:
verdict (optional): Specifies the verdict type to filter by (e.g., malicious, riskware).
submitter_name (optional): Specifies the submitter name to filter by.
start_time (optional): Specifies the start of the time range for filtering (format:
yyyy-mm-dd'T'hh:mm:ss.SSSXXX(Example: 2021-03-23T18:51:00.000-00:00).end_time (optional): Specifies the end of the time range for filtering (format:
yyyy-mm-dd'T'hh:mm:ss.SSSXXX(Example: 2021-03-23T19:51:00.000-00:00).
Note
User should pass both start_time and end_time. The verdict and submitter_name parameters are optional, but at least one must be provided for filtering.
Required Headers:
X-FeApi-Token:Your API token for authentication.
Response Format:
This returns a JSON array, where each objectrepresents a submission and contains the following fields:
uuid: The unique identifier of the submission.
verdict: The verdict of the submission (e.g., malicious).
done_time: The timestamp when the submission was processed.
Filter by Verdict only without Start and End time
Retrieve submissions with a malicious verdict within the last 24 hours.
Request:
curl -gsk -H "X-FeApi-Token: IDScyw3fShofa+HiwxORPJThSLvuYV/UjJeTVzGCK0lYAAI=" "https://10.128.36.67/wsapis/mvx/v2.0.0/submissions/cluster/done?verdict=malicious" | jq
Response:
[
{“verdict": "malicious",
"uuid": "a4d377b4-9b95-4acb-b5a1-673ffc90bb12",
"done_time": "2024-04-23T08:26:12+0000"
},
{“verdict": "malicious",
"uuid": "4d00cd54-36b7-47ea-9beb-dbf16edacf29",
"done_time": "2024-04-23T09:03:52+0000”}
]
Filter by Submitter Name only without Start and End time
Retrieve submissions from the submitter named "admin" within the last 24 hours.
Request:
curl -gsk -H "X-FeApi-Token: IDScyw3fShofa+HiwxORPJThSLvuYV/UjJeTVzGCK0lYAAI=" "https://10.128.36.67/wsapis/mvx/v2.0.0/submissions/cluster/done?submitter_name=admin" | jq
Response:
[
{"verdict": "malicious",
"uuid": "4d00cd54-36b7-47ea-9beb-dbf16edacf29",
"done_time": "2024-04-23T09:03:52+0000”}
]
Filter by both Verdict and Submitter Name without Start and End time
Retrieve submissions with a malicious verdict submitted by "admin" within the last 24 hours.
Request:
curl -gsk -H "X-FeApi-Token: IDScyw3fShofa+HiwxORPJThSLvuYV/UjJeTVzGCK0lYAAI=" "https://10.128.36.67/wsapis/mvx/v2.0.0/submissions/cluster/done?submitter_name=admin&verdict=malicious" | jq
Response:
[
{“verdict": "malicious",
"uuid": "4d00cd54-36b7-47ea-9beb-dbf16edacf29",
"done_time": "2024-04-23T09:03:52+0000”}
]
Filter by both Verdict and Submitter Name with Start and End time
Retrieve submissions with a malicious verdict submitted by "admin" within a specific time range.
Request:
curl -gsk -H "X-FeApi-Token: IDScyw3fShofa+HiwxORPJThSLvuYV/UjJeTVzGCK0lYAAI=" "https://10.128.36.67/wsapis/mvx/v2.0.0/submissions/cluster/done?start_time=2024-04-22T18:59:00.000-00:00&end_time=2024-04-23T09:01:00.000-00:00&submitter_name=admin&verdict=malicious"
Response:
[
{"verdict": "malicious",
"uuid": "a4d377b4-9b95-4acb-b5a1-673ffc90bb12",
"done_time": "2024-04-23T08:26:12+0000" }
]
Filter by Verdict only with Start and End time
Retrieve submissions with a malicious verdict within a specific time range.
Request:
curl -gsk -H "X-FeApi-Token: IDScyw3fShofa+HiwxORPJThSLvuYV/UjJeTVzGCK0lYAAI=" "https://10.128.36.67/wsapis/mvx/v2.0.0/submissions/cluster/done?start_time=2024-04-22T18:59:00.000-00:00&end_time=2024-04-23T09:01:00.000-00:00&verdict=malicious" | jq
Response:
[
{“verdict": "malicious",
"uuid": "4d00cd54-36b7-47ea-9beb-dbf16edacf29",
"done_time": "2024-04-23T09:03:52+0000”}
]
Filter by Submitter Name only with Start and End time
Retrieve submissions from the submitter named "admin" within a specific time range.
Request:
curl -gsk -H "X-FeApi-Token: IDScyw3fShofa+HiwxORPJThSLvuYV/UjJeTVzGCK0lYAAI=" "https://10.128.36.67/wsapis/mvx/v2.0.0/submissions/cluster/done?start_time=2024-04-22T18:59:00.000-00:00&end_time=2024-04-23T09:01:00.000-00:00&submitter_name=admin"
Response:
[
{“verdict": "malicious",
"uuid": "4d00cd54-36b7-47ea-9beb-dbf16edacf29",
"done_time": "2024-04-23T09:03:52+0000”}
]