Threat Intel Search

Here you can find a convenience Postman collection for the MetaDefender Cloud Threat Intelligence Search API, which is an integral part of MetaDefender Sandbox (previously known as OPSWAT Filescan Sandbox).

Store the following JSON file to disc and import it:

{ "info": { "_postman_id": "997685f7-d05a-403a-ad78-b5f9aaf3ccfc", "name": "ThreatIntel Search API", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "_exporter_id": "11461903" }, "item": [ { "name": "v4 Apikey - Get", "request": { "method": "GET", "header": [ { "key": "apikey", "value": "{{apikey}}", "description": "Gives rights to use the endpoint" } ], "url": { "raw": "https://api.metadefender.com/v4/apikey", "protocol": "https", "host": [ "api", "metadefender", "com" ], "path": [ "v4", "apikey" ] } }, "response": [ { "name": "Successful request", "originalRequest": { "method": "GET", "header": [ { "key": "apikey", "value": "{{apikey}}" } ], "url": { "raw": "https://api.metadefender.com/v4/apikey/", "protocol": "https", "host": [ "api", "metadefender", "com" ], "path": [ "v4", "apikey", "" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json; charset=utf-8" }, { "key": "X-Authenticated", "value": "by apikey" }, { "key": "X-Response-Time", "value": "expressed in milliseconds" } ], "cookie": [], "body": "{\n \"max_upload_file_size\": 140,\n \"max_archive_file_size\": 140,\n \"max_archive_file_number\": 50,\n \"limit_prevention\": 40,\n \"limit_reputation\": 4000,\n \"limit_sandbox\": 1,\n \"limit_feed\": 1000,\n \"qos_scan\": \"normal\",\n \"updated_at\": \"2019-02-21T09:12:36.275Z\",\n \"created_at\": \"2019-02-21T09:12:36.275Z\",\n \"portal_api_key\": \"1981b1387c84f2f1465ae14994b96c5c\",\n \"source\": \"mdcloud_fingerprint\",\n \"workflow_rule\": 0,\n \"votes\": [],\n \"vulnerability_submissions\": [],\n \"expiration_date\": \"1970-01-01T00:00:00.000Z\",\n \"time_interval\": \"daily\",\n \"nickname\": \"throbbing_band_caae\",\n \"paid_user\": 0\n}" }, { "name": "Failed request", "originalRequest": { "method": "GET", "header": [ { "key": "apikey", "value": "{{apikey}}" } ], "url": { "raw": "https://api.metadefender.com/v4/apikey/", "protocol": "https", "host": [ "api", "metadefender", "com" ], "path": [ "v4", "apikey", "" ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json; charset=utf-8" } ], "cookie": [], "body": "{\n \"success\": false,\n \"error\": {\n \"code\": 404008,\n \"messages\": [\n \"The apikey was not found\"\n ]\n }\n}" } ] }, { "name": "v5 Threat Intel Status", "request": { "method": "GET", "header": [ { "key": "apikey", "value": "{{apikey}}", "type": "text" } ], "url": { "raw": "https://api.metadefender.com/v5/threat-intel/status", "protocol": "https", "host": [ "api", "metadefender", "com" ], "path": [ "v5", "threat-intel", "status" ] } }, "response": [] }, { "name": "Search - Simple Threat Name", "event": [ { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript" } } ], "request": { "method": "POST", "header": [ { "description": "Gives rights to use the endpoint", "key": "apikey", "value": "{{apikey}}" }, { "description": "Specify the http content type", "key": "Content-Type", "value": "application/json" }, { "key": "includescandetails", "value": "1", "type": "text", "disabled": true } ], "body": { "mode": "raw", "raw": "{\n \"filters\": { \n \"standard_threat_name\": \"*.Trojan.*\" \n },\n \"limit\": 100\n}" }, "url": { "raw": "https://api.metadefender.com/v5/threat-intel/search/", "protocol": "https", "host": [ "api", "metadefender", "com" ], "path": [ "v5", "threat-intel", "search", "" ] } }, "response": [] }, { "name": "Search - Glob Patterns", "event": [ { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript" } } ], "request": { "method": "POST", "header": [ { "description": "Gives rights to use the endpoint", "key": "apikey", "value": "{{apikey}}" }, { "description": "Specify the http content type", "key": "Content-Type", "value": "application/json" }, { "key": "includescandetails", "value": "1", "type": "text", "disabled": true } ], "body": { "mode": "raw", "raw": "{\n \"filters\": {\n \"reputation\": \"mal*\",\n \"risk_level\": \"hi*\",\n \"platforms\": \"Win*\"\n },\n \"limit\": 100\n}" }, "url": { "raw": "https://api.metadefender.com/v5/threat-intel/search/", "protocol": "https", "host": [ "api", "metadefender", "com" ], "path": [ "v5", "threat-intel", "search", "" ] } }, "response": [] }, { "name": "Search - Text Arrays", "event": [ { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript" } } ], "request": { "method": "POST", "header": [ { "description": "Gives rights to use the endpoint", "key": "apikey", "value": "{{apikey}}" }, { "description": "Specify the http content type", "key": "Content-Type", "value": "application/json" }, { "key": "includescandetails", "value": "1", "type": "text", "disabled": true } ], "body": { "mode": "raw", "raw": "{\n \"filters\": {\n \"first_seen\": {\"gt\": \"2023-06-20T12:00:00.000Z\"},\n \"file_info.file_type_category\": \"E\",\n \"malware_types\": [\"trojan*\", \"*miner\"],\n \"malware_families\": [\"eldorado*\", \"kryptik\"],\n \"risk_level\": \"high\",\n \"standard_threat_name\": \"*\"\n },\n \"limit\": 100\n}" }, "url": { "raw": "https://api.metadefender.com/v5/threat-intel/search/", "protocol": "https", "host": [ "api", "metadefender", "com" ], "path": [ "v5", "threat-intel", "search", "" ] } }, "response": [] }, { "name": "Search - Numeric and date comparisons", "event": [ { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript" } } ], "request": { "method": "POST", "header": [ { "description": "Gives rights to use the endpoint", "key": "apikey", "value": "{{apikey}}" }, { "description": "Specify the http content type", "key": "Content-Type", "value": "application/json" }, { "key": "includescandetails", "value": "1", "type": "text", "disabled": true } ], "body": { "mode": "raw", "raw": "{\n \"filters\": {\n \"reputation_i\": [1, 2],\n \"first_seen\": {\"gt\": \"2023-06-20T18:26:40.000Z\"},\n \"av_detection_count\": {\"gte\": 5, \"lt\": 20},\n \"file_info.file_type_extension\": \"exe\",\n \"file_info.file_size\": {\"lte\": 100000},\n \"standard_threat_name\": \"*\"\n }, \n \"limit\": 10\n}" }, "url": { "raw": "https://api.metadefender.com/v5/threat-intel/search/", "protocol": "https", "host": [ "api", "metadefender", "com" ], "path": [ "v5", "threat-intel", "search", "" ] } }, "response": [] }, { "name": "Search - Benign executables", "event": [ { "listen": "prerequest", "script": { "exec": [ "" ], "type": "text/javascript" } } ], "request": { "method": "POST", "header": [ { "description": "Gives rights to use the endpoint", "key": "apikey", "value": "{{apikey}}" }, { "description": "Specify the http content type", "key": "Content-Type", "value": "application/json" }, { "key": "includescandetails", "value": "1", "type": "text", "disabled": true } ], "body": { "mode": "raw", "raw": "{\n \"filters\": {\n \"first_seen\": {\"gt\": \"2023-06-20T18:26:40.000Z\"},\n \"file_info.file_size\": {\n \"lt\": 1000000\n },\n \"file_info.file_type_extension\": \"EXE\",\n \"reputation\": \"benign\"\n },\n \"limit\": 10\n}" }, "url": { "raw": "https://api.metadefender.com/v5/threat-intel/search/", "protocol": "https", "host": [ "api", "metadefender", "com" ], "path": [ "v5", "threat-intel", "search", "" ] } }, "response": [] }, { "name": "Similarity Search - Hash Lookup #1", "request": { "method": "GET", "header": [ { "key": "apikey", "value": "{{apikey}}", "type": "text" }, { "key": "limit", "value": "5", "type": "text" } ], "url": { "raw": "https://api.metadefender.com/v5/threat-intel/similarity-search/bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb", "protocol": "https", "host": [ "api", "metadefender", "com" ], "path": [ "v5", "threat-intel", "similarity-search", "bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb" ] } }, "response": [] }, { "name": "Similarity Search - Hash Lookup #2", "request": { "method": "GET", "header": [ { "key": "apikey", "value": "{{apikey}}", "type": "text" }, { "key": "limit", "value": "5", "type": "text" }, { "key": "tags", "value": "installer", "type": "text" }, { "key": "verdict", "value": "MALICIOUS", "type": "text" } ], "url": { "raw": "https://api.metadefender.com/v5/threat-intel/similarity-search/d5c9ac7722bca76ff8e44ea7b8ebc8bfed23f09ebd39e94d1a042273801d8425", "protocol": "https", "host": [ "api", "metadefender", "com" ], "path": [ "v5", "threat-intel", "similarity-search", "d5c9ac7722bca76ff8e44ea7b8ebc8bfed23f09ebd39e94d1a042273801d8425" ] } }, "response": [] }, { "name": "Similarity Search - Hash Lookup #3", "request": { "method": "GET", "header": [ { "key": "apikey", "value": "{{apikey}}", "type": "text" }, { "key": "limit", "value": "5", "type": "text" } ], "url": { "raw": "https://api.metadefender.com/v5/threat-intel/similarity-search/2e8a440a90ff1b15c8cf93eaf47fbb8f95fc0d14e9fa665dd9f4a2596387bbbf", "protocol": "https", "host": [ "api", "metadefender", "com" ], "path": [ "v5", "threat-intel", "similarity-search", "2e8a440a90ff1b15c8cf93eaf47fbb8f95fc0d14e9fa665dd9f4a2596387bbbf" ] } }, "response": [] }, { "name": "Similarity Search - Hash Lookup #4", "request": { "method": "GET", "header": [ { "key": "apikey", "value": "{{apikey}}", "type": "text" }, { "key": "limit", "value": "5", "type": "text" } ], "url": { "raw": "https://api.metadefender.com/v5/threat-intel/similarity-search/f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37", "protocol": "https", "host": [ "api", "metadefender", "com" ], "path": [ "v5", "threat-intel", "similarity-search", "f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37" ] } }, "response": [] }, { "name": "Similarity Search - Hash Lookup #5", "request": { "method": "GET", "header": [ { "key": "apikey", "value": "{{apikey}}", "type": "text" }, { "key": "limit", "value": "5", "type": "text" } ], "url": { "raw": "https://api.metadefender.com/v5/threat-intel/similarity-search/414ed6f7183b0a53b29f31e960246a9f59c2e1949fd69b94d53f06dd27ec6869", "protocol": "https", "host": [ "api", "metadefender", "com" ], "path": [ "v5", "threat-intel", "similarity-search", "414ed6f7183b0a53b29f31e960246a9f59c2e1949fd69b94d53f06dd27ec6869" ] } }, "response": [] } ] }