Get Inspected Files
Retrieves basic information about files inspected by the Malware Prevention Service (MPS),
including file hashes, verdict, and inspection time.
For detailed information about a specific file (e.g., number of affected workloads), use the
/inspected-files/details?sha256=
- LAST_INSPECTED_TIME (Default)
- THREAT_SCORE
Use this request param for specifying starting time of a timeline. Value has to be specified in milliseconds since epoch.
Use this request param for specifying ending time of a timeline. Value has to be specified in milliseconds since epoch.
Use this request param for specifying sha256 hash to filter. If this parameter is passed multiple times, OR condition will be assumed. If value passed is empty string, it will be considered as valid input for filtering.
Use this request param for specifying verdict to filter. If this parameter is passed multiple times, OR condition will be assumed. If value passed is empty string, it will be considered as valid input for filtering. Available values - BENIGN, TRUSTED, HIGHLY_TRUSTED, SUSPICIOUS, MALICIOUS, UNKNOWN, UNINSPECTED Filtering by any one of BENIGN, TRUSTED, or HIGHLY_TRUSTED will return all inspection results within the BENIGN score range (0-29), which includes files or processes with any of these three verdicts.
Used for specifying filter of exclusion files. By default, this parameter will be considered null and no filtering on exclusion will be applied.
Used for specifying malware family to filter. If this parameter is passed multiple times, OR condition will be assumed. Pass 'EMPTY' to explicitly retrieve records where the malware family field is blank or unassigned.
Used for specifying malware class to filter. If this parameter is passed multiple times, OR condition will be assumed. Pass 'EMPTY' to explicitly retrieve records where the malware class field is blank or unassigned.
Used for specifying filter of blocked files. By default, this parameter will be considered null and no filtering on is_blocked value will be applied.
Used for specifying file_type to filter. If this parameter is passed multiple times, OR condition will be assumed.
Used for specifying analysis type to filter. If this parameter is passed multiple times, OR condition will be assumed.
The parameter name on which to sort the list of records. Only top-level parameters in the returned list of records will be supported. If not provided, system will define the parameter by which results are sorted.
True, if the list of records returned need to be sorted in ascending order, false otherwise.
Offset pagination parameter used to exclude from a response the first N items of a resource collection. Combine the offset and the page_size options to request a particular set or page of items.
Number of records to be returned in the API request from the provided offset
Identifiers of the local managers or sites.
ID of the Virtual Machine.
Successful Operation
{
"total_result_count": 2,
"results": [
{
"sha256": "224c569874f0c88681f79e099d8113a6d03700e5d9a9f80ec53f7efb7c963520",
"file_size": 65630,
"last_inspected": 1772693414358,
"inspection_status": "COMPLETED",
"threat_score": 0,
"verdict": "BENIGN",
"is_excluded": {
"last_inspection_setting": false,
"current_setting": false
},
"malware_family": [],
"malware_class": [],
"is_blocked": false,
"file_type": "CsvDataFile",
"inspections_count": 2,
"last_inspected_site": {
"site_id": "2b9c5262-b1b1-48b7-97cf-144e3a2d104e"
}
},
{
"sha256": "35d639f99f2b9055db270cb36eb8621d278012ebd41564cb9684638acade7334",
"file_size": 5150,
"last_inspected": 1772693414277,
"inspection_status": "COMPLETED",
"threat_score": 0,
"verdict": "BENIGN",
"is_excluded": {
"last_inspection_setting": false,
"current_setting": false
},
"malware_family": [],
"malware_class": [],
"is_blocked": false,
"file_type": "XmlDocFile",
"inspections_count": 2,
"last_inspected_site": {
"site_id": "2b9c5262-b1b1-48b7-97cf-144e3a2d104e"
}
}
]
}Bad request.
{
"error_code": 0,
"module_name": "string",
"error_message": "string"
}HTTP Status or Application error code.
Module where the error happened.
Message describing the error.
Unauthorized
{
"error_code": 0,
"module_name": "string",
"error_message": "string"
}HTTP Status or Application error code.
Module where the error happened.
Message describing the error.
Forbidden
{
"error_code": 0,
"module_name": "string",
"error_message": "string"
}HTTP Status or Application error code.
Module where the error happened.
Message describing the error.
Precondition Failed
{
"error_code": 0,
"module_name": "string",
"error_message": "string"
}HTTP Status or Application error code.
Module where the error happened.
Message describing the error.
Precondition Required
{
"error_code": 0,
"module_name": "string",
"error_message": "string"
}HTTP Status or Application error code.
Module where the error happened.
Message describing the error.
Too Many Requests
{
"error_code": 0,
"module_name": "string",
"error_message": "string"
}HTTP Status or Application error code.
Module where the error happened.
Message describing the error.
curl -H 'Authorization: <value>' https://{api_host}/malware-prevention/inspected-files?start_time=value&end_time=v