Submission results request

Returns a malware file analysis report in XML format.

Central Management System and Malware Analysis:

GET https://<address>/wsapis/[v1.2.0|v2.0.0]/submissions/results/[Submission_Key]

By default, the results will be in concise mode with just the basic information. If you want more details, use the info_level=normal or info_level=extended option:

GET https://<address>/wsapis/[v1.2.0|v2.0.0]/submissions/results/[Submission_Key]?info_level=normal

GET https://<address>/wsapis/[v1.2.0|v2.0.0]/submissions/results/[Submission_Key]?info_level=extended

Availability

This command is available on the following appliances:

Central Management System
Malware Analysis

Required headers:

X-FeApi-Token: [API-Token]
X-FeClient-Token: [Client-Token]

Options

address—The IP address of the appliance running the Web Services API.
Submission_Key—Provided by your appliance during the submission process, this key identifies the unique file submitted for analysis.
API-Token—This token authenticates the session. By default, the session times out after 15 minutes of inactivity.
Client-Token—(Optional) This client token is provided by Trellix. For more information about the client token, contact your sales representative.

Example request

Central Management System:

GET https://xxx.xxx.xxx.xxx:443/wsapis/v2.0.0/submissions/results/3831_5

Other appliances:

GET https://xxx.xxx.xxx.xxx:443/wsapis/v1.2.0/submissions/results/7709

Request headers:

X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
X-FeClient-Token: BigDataInc

Results response

After the submission results request is received, the appliance forwards the malware object data back to the remote server.

Note

If you make a results request before the analysis is complete, you will receive a response with no analysis data.

HTTP/1.1 [Response Code] [Response Message]
Date: [Date]

Body:

[Result Data]

Response fields

Response Code—A standard HTML response code.
- 200—Request successful.
- 401—Request unsuccessful due to incorrect session token.
- 404—Request unsuccessful due to incorrect submission key.
Response Message—A standard HTML response message.
- OK—Request successful.
- Unauthorized—Request unsuccessful due to incorrect session token.
- Not Found—Request unsuccessful due to incorrect submission key.
Date—Standard HTML date format.
Results Data—The analysis data of the submitted malware object.

Example

HTTP/1.1 200 OK
Date: Wed, 8 Aug 2018 03:39:00 GMT

Body—Central Management System:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<alerts appliance="CMS" version="CMS (CMS) 8.3.0.774206" msg="concise" xmlns="http://www.fireeye.com/alert/2014/AlertSchema">
  <alert appliance-id="00239085164A" id="19542" root-infection="11161" sensor-ip="172.16.xxx.50" name="web-infection" severity="majr" product="Web MPS" sensor="praveen-nx" vlan="0" malicious="yes">
    <explanation>
      <malware-detected>
        <malware name="Malware.Binary.url" original-infection-id="11161" original-infection-type="web-infection" original-infection-url="https://172.16.240.11/botnets/events_for_bot?ma_id=11161"/>
      </malware-detected>
    </explanation>
    <src>
      <ip>196.188.xxx.237</ip>
      <port>1174</port>
    </src>
    <alert-url>https://jijo-cms1.eng.fireeye.com/event_stream/events_for_bot?inc_id=19542</alert-url>
    <action>notified</action>
    <occurred>2018-07-26T22:27:56.899Z</occurred>
    <dst>
      <mac>00:00:00:00:00:00</mac>
      <port>80</port>
      <ip>79.182.xxx.188</ip>
    </dst>
  </alert>
</alerts>

Body—Malware Analysis:

<alerts appliance="MAS" version="MAS (MAS) 8.2.0.764951" msg="concise" xmlns="http://www.fireeye.com/alert/2014/AlertSchema">
  <alert appliance-id="0025904E22AC" id="481" name="malware-object" severity="majr" product="MAS" vlan="0" malicious="yes">
    <explanation>
      <malware-detected>
        <malware name="Pdf.Exploit.Dropped-78">
          <md5sum>7a4702a43e781846b74e1ea79b73e639</md5sum>
          <sha256>0a4bb590eaf23e959083ea9217272b2e39a85803239f6f0708647d4a271caad6</sha256>
        </malware>
      </malware-detected>
    </explanation>
  <src/>
  <alert-url>https://saturn-mas.eng.fireeye.com/malware_analysis/analyses?maid=481</alert-url>
  <action>notified</action>
  <occurred>2018-08-01T19:02:40.968Z</occurred>
  <dst>
    <mac></mac>
  </dst>
  </alert>
</alerts>

cURL code sample: submission results request

The following code sample can be copied and executed from any command-line interface that includes the cURL library. This sample builds on the authentication cURL code sample.

Note

In this sample, line breaks are added for readability. Remove these line breaks before you paste the code sample into your command-line tool.

Central Management System:

curl -qgsSkH "Content-Type: multipart/form-data" --no-progress-bar --header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" https://xxx.xxx.xxx.xxx:443/wsapis/v2.0.0/submissions/results/3831_5

Malware Analysis:

This cURL sample performs the following tasks:

-q—This option specifies that the curlrc config file is not read or used. Although this is an optional setting, Trellix recommends that you include this option.
-g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.
-s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.
-S—When used with the -s option, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.
-k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.
-H—This option allows you to specify a custom header with the --header switch.
Content-Type: multipart/form-data—This option encodes the data as a multipart form.
--no-progress-bar—This option suppresses the cURL download progress bar, which can interfere with the request.
--header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This custom header includes the API-Token that was returned by your appliance during the authentication request. In the authentication cURL code sample, this token was included in the auth.txt file. Replace the token in the sample with the token received in response to your authentication request.
https://xxx.xxx.xxx.xxx:443/wsapis/v2.0.0/submissions/results/3831_5—(Central Management System) The submission request URL. Replace the IP address xxx.xxx.xxx.xxx with the IP address of your appliance. Replace 415_75 with the submission key of interest.
https://xxx.xxx.xxx.xxx:443/wsapis/v2.0.0/submissions/results/415—(Malware Analysis) The submission request URL. Replace the IP address xxx.xxx.xxx.xxx with the IP address of your appliance. Replace 415 with the submission key of interest.
https://xxx.xxx.xxx.xxx:443/wsapis/mvx/v2.0.0/submissions/result/415—(Intelligent Virtual Execution - Server) The submission request URL. Replace the IP address xxx.xxx.xxx.xxx with the IP address of your appliance. Replace 415 with the submission key of interest.

By default, the results will be in concise mode with just the basic information. If you want more details, add the ?info_level=normal or ?info_level=extended option at the end of the URL.

Results

The requested submission returns an XML-formatted malware analysis report.