<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Malware Alert Analysis

## Threat Intelligence APIs

| Source | Endpoint | Purpose |
|---|---|---|
| VirusTotal | `GET /api/v3/files/{hash}` | File reputation |
| VirusTotal | `GET /api/v3/files/{hash}/behaviour_summary` | Sandbox results |
| MalwareBazaar | `POST /api/v1/query/get_info` | Malware sample info |
| ANY.RUN | `GET /api/v1/analysis/{id}` | Sandbox report |
| Hybrid Analysis | `GET /api/v2/search/hash` | File analysis |

## EDR APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| CrowdStrike | `GET /detects/entities/summaries/GET/v1` | Detection details |
| CrowdStrike | `POST /devices/entities/devices-actions/v2` | Isolate host |
| Defender | `GET /api/machines/{id}/alerts` | Machine alerts |
| Defender | `POST /api/machines/{id}/isolate` | Isolate machine |
| SentinelOne | `GET /threats` | List threats |
| SentinelOne | `POST /agents/{id}/actions/disconnect` | Isolate agent |

## Malware Severity Matrix

| Category | Urgency | Response SLA | Containment |
|---|---|---|---|
| Ransomware | Critical | 15 min | Immediate isolation |
| RAT/Backdoor | High | 30 min | Isolate + investigate |
| Infostealer | High | 30 min | Isolate + credential reset |
| Dropper/Loader | High | 30 min | Block hash + isolate |
| Coinminer | Medium | 1 hour | Remove + block |
| PUP/Adware | Low | 4 hours | Remove, tune rule |

## Agent Script

```bash
# List malware categories
node agent.js categories

# Analyze a file hash
node agent.js analyze --hash "a1b2c3d4e5f6..." \
  --name "svchost32.exe" --path "C:\\Users\\jdoe\\AppData\\Temp\\svchost32.exe"

# Generate IOC blocking actions
node agent.js block --hashes "a1b2c3d4..." "e5f6a7b8..." \
  --ips "203.0.113.50" --domains "evil-c2.example.com"
```
