<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Malware Alert Triage

## Reputation Lookup APIs

| Source | Endpoint | Rate Limit |
|---|---|---|
| VirusTotal | `GET /api/v3/files/{hash}` | 4 req/min (free) |
| MalwareBazaar | `POST /api/v1/` | Unlimited |
| Hybrid Analysis | `POST /api/v2/search/hash` | 5 req/min (free) |
| CAPE Sandbox | `GET /apiv2/tasks/search/sha256/{hash}` | Instance-dependent |

## EDR Investigation APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| CrowdStrike | `GET /detects/queries/detects/v1` | Query detections |
| CrowdStrike | `POST /real-time-response/combined/batch-command/v1` | Live response |
| Defender | `GET /api/machines/{id}/timeline` | Device timeline |
| Defender | `POST /api/machines/{id}/isolate` | Isolate host |
| SentinelOne | `POST /web/api/v2.1/dv/query-status` | Deep Visibility query |
| SentinelOne | `POST /web/api/v2.1/agents/actions/disconnect` | Network isolation |

## Sandbox Submission APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| Any.Run | `POST /v1/analysis` | Submit for analysis |
| Joe Sandbox | `POST /api/v2/analysis/submit` | Submit sample |
| Hybrid Analysis | `POST /api/v2/submit/file` | Upload for detonation |

## Agent Script

```bash
# List reputation sources and containment actions
node agent.js sources

# Triage a malware hash
node agent.js triage --hash "a1b2c3d4..." --vt-detections 42 --file-type "PE32" --category ransomware

# Assess infection scope
node agent.js scope --hash "a1b2c3d4..." --hosts 5 --users 3
```
