loading…
Analyze Suspicious File and Endpoint Behavior
/api/mcp/srv-malware-analysisMCP enable + token are only for calling from an external client — the playground below needs neither.
Update malware family classification, threat level, and analyst notes for reviewed samples
{
"type": "object",
"required": [
"sample_id"
],
"properties": {
"family": {
"type": "string"
},
"sample_id": {
"type": "string"
},
"threat_level": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"analyst_notes": {
"type": "string"
},
"false_positive": {
"type": "boolean",
"default": false
},
"confidence_score": {
"type": "number",
"maximum": 1,
"minimum": 0
}
}
}Extract and generate indicators of compromise from analyzed samples including file hashes, network indicators, and behavioral signatures
{
"type": "object",
"required": [],
"properties": {
"format": {
"enum": [
"stix",
"json",
"csv",
"yara"
],
"type": "string",
"default": "json"
},
"ioc_types": {
"type": "array",
"items": {
"enum": [
"file_hash",
"domain",
"ip",
"url",
"registry",
"mutex",
"service",
"process"
],
"type": "string"
}
},
"sample_id": {
"type": "string"
},
"sample_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"confidence_threshold": {
"type": "number",
"default": 0.7,
"maximum": 1,
"minimum": 0
}
}
}Retrieve detailed analysis results for a specific malware sample including static analysis, dynamic behavior, and YARA rule matches
{
"type": "object",
"required": [
"sample_id"
],
"properties": {
"sample_id": {
"type": "string"
},
"include_pcap": {
"type": "boolean",
"default": false
},
"include_memory_dumps": {
"type": "boolean",
"default": false
}
}
}Execute threat hunting queries across sample repository using YARA rules, behavioral patterns, or custom IOC signatures
{
"type": "object",
"required": [
"hunt_type"
],
"properties": {
"scope": {
"enum": [
"recent",
"all_samples",
"specific_timeframe"
],
"type": "string"
},
"ioc_list": {
"type": "array",
"items": {
"type": "string"
}
},
"hunt_type": {
"enum": [
"yara",
"behavioral",
"ioc",
"custom"
],
"type": "string"
},
"rule_content": {
"type": "string"
},
"timeframe_end": {
"type": "string",
"format": "date-time"
},
"timeframe_start": {
"type": "string",
"format": "date-time"
}
}
}List active malware campaigns with associated threat actor attribution, TTPs, and sample counts
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 25
},
"status": {
"enum": [
"active",
"dormant",
"closed"
],
"type": "string"
},
"sort_by": {
"enum": [
"first_seen",
"last_activity",
"sample_count"
],
"type": "string",
"default": "last_activity"
},
"threat_actor": {
"type": "string"
},
"first_seen_range": {
"enum": [
"last_week",
"last_month",
"last_quarter",
"last_year"
],
"type": "string"
}
}
}Retrieve malware detections from security tools with filtering by detection engine, confidence score, and triage status
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"triage_status": {
"enum": [
"new",
"in_progress",
"benign",
"malicious",
"needs_review"
],
"type": "string"
},
"confidence_min": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"analyst_assigned": {
"type": "string"
},
"detection_engine": {
"enum": [
"av",
"edr",
"sandbox",
"yara",
"ml_classifier"
],
"type": "string"
},
"detected_date_range": {
"enum": [
"last_hour",
"last_24h",
"last_week",
"last_month"
],
"type": "string"
}
}
}Search malware samples by hash, family, campaign, or behavioral indicators with optional filtering by file type and detection date
{
"type": "object",
"required": [
"query"
],
"properties": {
"limit": {
"type": "integer",
"default": 50,
"maximum": 1000
},
"query": {
"type": "string",
"description": "Search query supporting hash values, family names, or IOCs"
},
"family": {
"type": "string"
},
"campaign": {
"type": "string"
},
"file_type": {
"enum": [
"pe",
"elf",
"macho",
"office",
"pdf",
"script",
"archive",
"mobile"
],
"type": "string"
},
"detection_date_range": {
"enum": [
"last_24h",
"last_week",
"last_month",
"last_quarter"
],
"type": "string"
}
}
}Submit new malware sample for automated static and dynamic analysis with optional detonation environment preferences
{
"type": "object",
"required": [],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"file_url": {
"type": "string"
},
"file_hash": {
"type": "string"
},
"analysis_timeout": {
"type": "integer",
"default": 300,
"maximum": 1800
},
"analysis_priority": {
"enum": [
"low",
"normal",
"high",
"critical"
],
"type": "string",
"default": "normal"
},
"sandbox_environment": {
"enum": [
"windows_10",
"windows_7",
"ubuntu_20",
"macos_11",
"android_11"
],
"type": "string"
}
}
}Update triage status, analyst assignment, and disposition for malware detections requiring human review
{
"type": "object",
"required": [
"detection_id",
"triage_status"
],
"properties": {
"notes": {
"type": "string"
},
"escalate": {
"type": "boolean",
"default": false
},
"disposition": {
"enum": [
"true_positive",
"false_positive",
"benign_positive"
],
"type": "string"
},
"detection_id": {
"type": "string"
},
"triage_status": {
"enum": [
"in_progress",
"benign",
"malicious",
"needs_review"
],
"type": "string"
},
"analyst_assigned": {
"type": "string"
}
}
}