From 334bc1b064e5fa8a48ac62ff85e5a90b52b3b07d Mon Sep 17 00:00:00 2001 From: Pradeep Gowda Date: Wed, 15 Feb 2017 08:27:25 -0500 Subject: [PATCH 1/4] change docs to reflect the fact that API supports md5 & sha256 --- source/includes/_samples.md | 34 +++++++++++++++++++--------------- source/index.html.md | 10 +++++----- 2 files changed, 24 insertions(+), 20 deletions(-) diff --git a/source/includes/_samples.md b/source/includes/_samples.md index ed3bf1d..e7d9250 100644 --- a/source/includes/_samples.md +++ b/source/includes/_samples.md @@ -1,15 +1,19 @@ # Malware Samples +The API supports malware lookup by `MD5` and `SHA256`. + +In the examples below `{hash}` can be either `MD5` or `SHA256`. + ## Get sample details ```shell -curl "https://api.emergingthreats.net/v1/samples/{md5}" +curl "https://api.emergingthreats.net/v1/samples/{hash}" -H "Authorization: SECRETKEY" ``` ```python from urllib2 import Request, urlopen -request = Request("https://api.emergingthreats.net/v1/samples/{md5}") +request = Request("https://api.emergingthreats.net/v1/samples/{hash}") request.add_header("Authorization", "SECRETKEY") result = urlopen(request) print result.read() @@ -34,7 +38,7 @@ This endpoint retrieves metadata information for a single malware sample. ### HTTP Request -`GET https://api.emergingthreats.net/v1/samples/{md5}` +`GET https://api.emergingthreats.net/v1/samples/{hash}` ### Response Parameters @@ -49,13 +53,13 @@ sha256 | Yes | The SHA-256 hash of the binary. ## Get sample connections ```shell -curl "https://api.emergingthreats.net/v1/samples/{md5}/connections" +curl "https://api.emergingthreats.net/v1/samples/{hash}/connections" -H "Authorization: SECRETKEY" ``` ```python from urllib2 import Request, urlopen -request = Request("https://api.emergingthreats.net/v1/samples/{md5}/connections") +request = Request("https://api.emergingthreats.net/v1/samples/{hash}/connections") request.add_header("Authorization", "SECRETKEY") result = urlopen(request) print result.read() @@ -105,7 +109,7 @@ This endpoint retrieves the most recent connections an individual malware sample ### HTTP Request -`GET https://api.emergingthreats.net/v1/samples/{md5}/connections` +`GET https://api.emergingthreats.net/v1/samples/{hash}/connections` ### Response Parameters @@ -128,13 +132,13 @@ protocol | Yes | The communication protocol associated with this connection (e.g ## Get sample dns lookups ```shell -curl "https://api.emergingthreats.net/v1/samples/{md5}/dns" +curl "https://api.emergingthreats.net/v1/samples/{hash}/dns" -H "Authorization: SECRETKEY" ``` ```python from urllib2 import Request, urlopen -request = Request("https://api.emergingthreats.net/v1/samples/{md5}/dns") +request = Request("https://api.emergingthreats.net/v1/samples/{hash}/dns") request.add_header("Authorization", "SECRETKEY") result = urlopen(request) print result.read() @@ -168,7 +172,7 @@ This endpoint retrieves the most recent dns lookups an individual malware sample ### HTTP Request -`GET https://api.emergingthreats.net/v1/samples/{md5}/dns` +`GET https://api.emergingthreats.net/v1/samples/{hash}/dns` ### Response Parameters @@ -184,13 +188,13 @@ record_type | Yes | The DNS record type (e.g. A, CNAME, etc.) ## Get sample http requests ```shell -curl "https://api.emergingthreats.net/v1/samples/{md5}/http" +curl "https://api.emergingthreats.net/v1/samples/{hash}/http" -H "Authorization: SECRETKEY" ``` ```python from urllib2 import Request, urlopen -request = Request("https://api.emergingthreats.net/v1/samples/{md5}/http") +request = Request("https://api.emergingthreats.net/v1/samples/{hash}/http") request.add_header("Authorization", "SECRETKEY") result = urlopen(request) print result.read() @@ -234,7 +238,7 @@ This endpoint retrieves the most recent http requests an individual malware samp ### HTTP Request -`GET https://api.emergingthreats.net/v1/samples/{md5}/http` +`GET https://api.emergingthreats.net/v1/samples/{hash}/http` ### Response Parameters @@ -254,13 +258,13 @@ user_agent | Yes | The user agent string associated with the request. ## Get sample IDS events ```shell -curl "https://api.emergingthreats.net/v1/samples/{md5}/events" +curl "https://api.emergingthreats.net/v1/samples/{hash}/events" -H "Authorization: SECRETKEY" ``` ```python from urllib2 import Request, urlopen -request = Request("https://api.emergingthreats.net/v1/samples/{md5}/events") +request = Request("https://api.emergingthreats.net/v1/samples/{hash}/events") request.add_header("Authorization", "SECRETKEY") result = urlopen(request) print result.read() @@ -302,7 +306,7 @@ This endpoint retrieves the most recent IDS events an individual malware sample ### HTTP Request -`GET https://api.emergingthreats.net/v1/samples/{md5}/events` +`GET https://api.emergingthreats.net/v1/samples/{hash}/events` ### Response Parameters diff --git a/source/index.html.md b/source/index.html.md index 1bd528c..124308b 100644 --- a/source/index.html.md +++ b/source/index.html.md @@ -41,11 +41,11 @@ search: true /v1/ips/{ip}/samples /v1/ips/{ip}/urls -/v1/samples/{md5} -/v1/samples/{md5}/connections -/v1/samples/{md5}/dns -/v1/samples/{md5}/events -/v1/samples/{md5}/http +/v1/samples/{hash} +/v1/samples/{hash}/connections +/v1/samples/{hash}/dns +/v1/samples/{hash}/events +/v1/samples/{hash}/http /v1/sids/{sid} /v1/sids/{sid}/ips From 92da25b0b441142205dc923bb0652bf120d31daa Mon Sep 17 00:00:00 2001 From: Pradeep Gowda Date: Wed, 15 Feb 2017 08:37:16 -0500 Subject: [PATCH 2/4] Update _samples.md --- source/includes/_samples.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source/includes/_samples.md b/source/includes/_samples.md index e7d9250..2ca1adc 100644 --- a/source/includes/_samples.md +++ b/source/includes/_samples.md @@ -1,6 +1,6 @@ # Malware Samples -The API supports malware lookup by `MD5` and `SHA256`. +The API supports malware sample lookup by `MD5` and `SHA256`. In the examples below `{hash}` can be either `MD5` or `SHA256`. From 3ed35bc20e809479e18d6283329296e445509d1d Mon Sep 17 00:00:00 2001 From: Pradeep Gowda Date: Wed, 15 Feb 2017 10:10:15 -0500 Subject: [PATCH 3/4] SHA256 support is only for sample details. --- source/index.html.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/source/index.html.md b/source/index.html.md index 124308b..64eabef 100644 --- a/source/index.html.md +++ b/source/index.html.md @@ -42,10 +42,10 @@ search: true /v1/ips/{ip}/urls /v1/samples/{hash} -/v1/samples/{hash}/connections -/v1/samples/{hash}/dns -/v1/samples/{hash}/events -/v1/samples/{hash}/http +/v1/samples/{md5}/connections +/v1/samples/{md5}/dns +/v1/samples/{md5}/events +/v1/samples/{md5}/http /v1/sids/{sid} /v1/sids/{sid}/ips From 05a32314a6b1600c2ccf3af4caac981e53dfe336 Mon Sep 17 00:00:00 2001 From: Pradeep Gowda Date: Wed, 15 Feb 2017 10:12:49 -0500 Subject: [PATCH 4/4] SHA256 support is only for sample details. --- source/includes/_samples.md | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/source/includes/_samples.md b/source/includes/_samples.md index 2ca1adc..5dd0203 100644 --- a/source/includes/_samples.md +++ b/source/includes/_samples.md @@ -53,13 +53,13 @@ sha256 | Yes | The SHA-256 hash of the binary. ## Get sample connections ```shell -curl "https://api.emergingthreats.net/v1/samples/{hash}/connections" +curl "https://api.emergingthreats.net/v1/samples/{md5}/connections" -H "Authorization: SECRETKEY" ``` ```python from urllib2 import Request, urlopen -request = Request("https://api.emergingthreats.net/v1/samples/{hash}/connections") +request = Request("https://api.emergingthreats.net/v1/samples/{md5}/connections") request.add_header("Authorization", "SECRETKEY") result = urlopen(request) print result.read() @@ -109,7 +109,7 @@ This endpoint retrieves the most recent connections an individual malware sample ### HTTP Request -`GET https://api.emergingthreats.net/v1/samples/{hash}/connections` +`GET https://api.emergingthreats.net/v1/samples/{md5}/connections` ### Response Parameters @@ -132,13 +132,13 @@ protocol | Yes | The communication protocol associated with this connection (e.g ## Get sample dns lookups ```shell -curl "https://api.emergingthreats.net/v1/samples/{hash}/dns" +curl "https://api.emergingthreats.net/v1/samples/{md5}/dns" -H "Authorization: SECRETKEY" ``` ```python from urllib2 import Request, urlopen -request = Request("https://api.emergingthreats.net/v1/samples/{hash}/dns") +request = Request("https://api.emergingthreats.net/v1/samples/{md5}/dns") request.add_header("Authorization", "SECRETKEY") result = urlopen(request) print result.read() @@ -172,7 +172,7 @@ This endpoint retrieves the most recent dns lookups an individual malware sample ### HTTP Request -`GET https://api.emergingthreats.net/v1/samples/{hash}/dns` +`GET https://api.emergingthreats.net/v1/samples/{md5}/dns` ### Response Parameters @@ -188,13 +188,13 @@ record_type | Yes | The DNS record type (e.g. A, CNAME, etc.) ## Get sample http requests ```shell -curl "https://api.emergingthreats.net/v1/samples/{hash}/http" +curl "https://api.emergingthreats.net/v1/samples/{md5}/http" -H "Authorization: SECRETKEY" ``` ```python from urllib2 import Request, urlopen -request = Request("https://api.emergingthreats.net/v1/samples/{hash}/http") +request = Request("https://api.emergingthreats.net/v1/samples/{md5}/http") request.add_header("Authorization", "SECRETKEY") result = urlopen(request) print result.read() @@ -238,7 +238,7 @@ This endpoint retrieves the most recent http requests an individual malware samp ### HTTP Request -`GET https://api.emergingthreats.net/v1/samples/{hash}/http` +`GET https://api.emergingthreats.net/v1/samples/{md5}/http` ### Response Parameters @@ -258,13 +258,13 @@ user_agent | Yes | The user agent string associated with the request. ## Get sample IDS events ```shell -curl "https://api.emergingthreats.net/v1/samples/{hash}/events" +curl "https://api.emergingthreats.net/v1/samples/{md5}/events" -H "Authorization: SECRETKEY" ``` ```python from urllib2 import Request, urlopen -request = Request("https://api.emergingthreats.net/v1/samples/{hash}/events") +request = Request("https://api.emergingthreats.net/v1/samples/{md5}/events") request.add_header("Authorization", "SECRETKEY") result = urlopen(request) print result.read() @@ -306,7 +306,7 @@ This endpoint retrieves the most recent IDS events an individual malware sample ### HTTP Request -`GET https://api.emergingthreats.net/v1/samples/{hash}/events` +`GET https://api.emergingthreats.net/v1/samples/{md5}/events` ### Response Parameters