diff --git a/specs/02-resources.md b/specs/02-resources.md index 1eb25abe..06e30c50 100644 --- a/specs/02-resources.md +++ b/specs/02-resources.md @@ -31,6 +31,7 @@ BaseResource # holds .api, ._content, .parse_result cla ├── Metadata # /search/metadata/query ├── MetadataFieldProperties # /search/metadata/properties ├── MetadataMapping # /search/metadata/mappings + ├── MetadataRawSearch # /search/metadata/raw ├── IOC # /ioc (known good / known bad / search) ├── LiveYaraRuleset # /hunt/rule/live ├── HistoricalHunt # /hunt/historical diff --git a/specs/03-endpoints.md b/specs/03-endpoints.md index fb20efab..e46353b5 100644 --- a/specs/03-endpoints.md +++ b/specs/03-endpoints.md @@ -35,6 +35,7 @@ The full catalogue of methods on the public client surface and which transport h | Method | Resource builder | |---|---| | `metadata_mapping()` | inline (GET) — parsed into `MetadataMapping` | +| `metadata_raw_search(body, community=None)` | `MetadataRawSearch.search` (POST). `body` is sent verbatim: it is an OpenSearch `_search` body, and the server owns the grammar it accepts. `community` rides the **query string**, not the body, because the server overlays the community filter itself. | | `metadata_field_properties_write(field_path, description, …)` | inline (POST) | | `metadata_field_properties_get(field_path)` | inline (GET) | | `metadata_field_properties_delete(field_path)` | inline (DELETE) | diff --git a/specs/04-testing.md b/specs/04-testing.md index be17cc90..5471b626 100644 --- a/specs/04-testing.md +++ b/specs/04-testing.md @@ -26,6 +26,7 @@ How the test suite is organised. Three layers: pure unit tests (no HTTP at all - `test/async_client_test.py` — async, VCR-backed integration tests (not yet on the parametrised harness — follow-up work). - `test/hunt_matched_strings_test.py` — pure-unit tests for the three-state `matched_strings` contract and its `matched_strings_dropped` sibling, across all four hunt-result classes. The endpoint behaviour they cannot see (that the detail route actually emits the keys and the list route sends `null`) is pinned live in `client_scan_test.py::test_live` / `async_client_test.py::test_async_live` — the e2e-first + pure-unit pairing invariant 1 asks for. - `test/known_good_test.py` — pure-unit tests for the known-good resource fields. +- `test/metadata_raw_search_test.py` — pure-unit request-shape and parse tests for `metadata_raw_search`: that the query body is sent verbatim and `community` rides the query string (invariant 7 — the builder is pure data, so the routing reads straight off the `PolyswarmRequest`'s `request_parameters`, with no httpx), plus the `partial` reason codes the server returns. The lifecycle is live, in `client_scan_test.py` / `async_client_test.py`. - `test/jmespath_test.py` — unit tests for `BaseJsonResource.jmespath`. - `test/vcr/*.vcr` — recorded cassettes. - `test/malicious` — fixture file for upload tests (`test/eicar.yara` was retired when the rules tests moved to per-test `uid_yara` bodies). diff --git a/src/polyswarm_api/aio/api.py b/src/polyswarm_api/aio/api.py index 9002ecd2..8e1dde5c 100644 --- a/src/polyswarm_api/aio/api.py +++ b/src/polyswarm_api/aio/api.py @@ -288,6 +288,51 @@ async def metadata_mapping(self): result_parser=resources.MetadataMapping, ) + async def metadata_raw_search(self, body, community=None): + """Run a raw OpenSearch query body against the metadata corpus. + + The server overlays the community filter itself and caps the work, so + ``body`` is a plain ``_search`` body and the community travels in the + query string rather than in it. The accepted grammar is closed: a + construct the server does not recognise is refused rather than passed + through, and so is a top-level ``community``/``communities`` key. + + Entitlement-gated and metered per query, including a query the server + refuses after running it. + + :param body: An OpenSearch ``_search`` body (``query``, ``aggs``, + ``size``, ``sort``, ``_source``, ...). Omitting ``size`` returns + **no documents**: the server defaults it to 0 so an aggregation + caller does not pay for hits they did not ask for. Ask for hits + by setting it. + :param community: Community to search; defaults to the client's. + :return: A ``MetadataRawSearch`` whose ``json`` carries the engine's + ``hits`` and ``aggregations``, plus ``partial`` when the server + could not establish that the answer is complete. + + ``partial`` is a **list to inspect, not a flag**. Its entries are + ``{'code': ..., 'message': ...}`` and they make different claims, + so branch on ``code`` - ``message`` is for a human and may be + reworded. The codes are a closed set: + + * ``timed_out`` / ``terminated_early`` - the search stopped early. + * ``shards_failed`` - a shard was lost; also carries ``failed``. + * ``buckets_clamped`` - a ``terms`` list dropped terms. + * ``composite_paged`` - a ``composite`` may have more pages; page + it with its ``after_key``. + * ``bucket_count_approximate`` - a ``terms`` count is approximate + rather than truncated. + * ``hit_total_capped`` - the hit counter stopped at + ``track_total_hits``. This is what *every* large query that asks + for hits returns, so on its own it says nothing about the + aggregations; the server omits it when the body asked for no + documents. ``hits.total.relation`` carries the same fact as the + engine's own field, ``eq`` exact and ``gte`` capped. + """ + logger.info('Running a raw metadata search') + return await self._single( + resources.MetadataRawSearch.search(self, body, community)) + async def metadata_field_properties_write(self, field_path, description, example=None, category=None, aliases=None): """Upsert a metadata field properties entry (the single write path). diff --git a/src/polyswarm_api/api.py b/src/polyswarm_api/api.py index 41fb5d5e..69dde0ef 100644 --- a/src/polyswarm_api/api.py +++ b/src/polyswarm_api/api.py @@ -303,6 +303,50 @@ def metadata_mapping(self): result_parser=resources.MetadataMapping, ) + def metadata_raw_search(self, body, community=None): + """Run a raw OpenSearch query body against the metadata corpus. + + The server overlays the community filter itself and caps the work, so + ``body`` is a plain ``_search`` body and the community travels in the + query string rather than in it. The accepted grammar is closed: a + construct the server does not recognise is refused rather than passed + through, and so is a top-level ``community``/``communities`` key. + + Entitlement-gated and metered per query, including a query the server + refuses after running it. + + :param body: An OpenSearch ``_search`` body (``query``, ``aggs``, + ``size``, ``sort``, ``_source``, ...). Omitting ``size`` returns + **no documents**: the server defaults it to 0 so an aggregation + caller does not pay for hits they did not ask for. Ask for hits + by setting it. + :param community: Community to search; defaults to the client's. + :return: A ``MetadataRawSearch`` whose ``json`` carries the engine's + ``hits`` and ``aggregations``, plus ``partial`` when the server + could not establish that the answer is complete. + + ``partial`` is a **list to inspect, not a flag**. Its entries are + ``{'code': ..., 'message': ...}`` and they make different claims, + so branch on ``code`` - ``message`` is for a human and may be + reworded. The codes are a closed set: + + * ``timed_out`` / ``terminated_early`` - the search stopped early. + * ``shards_failed`` - a shard was lost; also carries ``failed``. + * ``buckets_clamped`` - a ``terms`` list dropped terms. + * ``composite_paged`` - a ``composite`` may have more pages; page + it with its ``after_key``. + * ``bucket_count_approximate`` - a ``terms`` count is approximate + rather than truncated. + * ``hit_total_capped`` - the hit counter stopped at + ``track_total_hits``. This is what *every* large query that asks + for hits returns, so on its own it says nothing about the + aggregations; the server omits it when the body asked for no + documents. ``hits.total.relation`` carries the same fact as the + engine's own field, ``eq`` exact and ``gte`` capped. + """ + logger.info("Running a raw metadata search") + return self._single(resources.MetadataRawSearch.search(self, body, community)) + def metadata_field_properties_write( self, field_path, description, example=None, category=None, aliases=None ): diff --git a/src/polyswarm_api/resources.py b/src/polyswarm_api/resources.py index d75d9808..74cfe898 100644 --- a/src/polyswarm_api/resources.py +++ b/src/polyswarm_api/resources.py @@ -77,6 +77,25 @@ class MetadataMapping(core.BaseJsonResource): RESOURCE_ENDPOINT = '/search/metadata/mappings' +class MetadataRawSearch(core.BaseJsonResource): + RESOURCE_ENDPOINT = '/search/metadata/raw' + + @classmethod + def search(cls, api, body, community=None): + """``body`` is the caller's whole query and travels untouched. The + community is scope, not query, and the server reads it from the query + string - folding it into the body would pick scope with a key the + server's grammar then rejects.""" + return core.PolyswarmRequest( + api=api, + method='POST', + url=f'{api.uri}{cls.RESOURCE_ENDPOINT}', + params={'community': community or api.community}, + json=body, + result_parser=cls, + ) + + class MetadataFieldProperties(core.BaseJsonResource): RESOURCE_ENDPOINT = '/search/metadata/properties' RESOURCE_ID_KEYS = ['field_path'] diff --git a/test/async_client_test.py b/test/async_client_test.py index 9dd98348..ae0d6184 100644 --- a/test/async_client_test.py +++ b/test/async_client_test.py @@ -286,6 +286,34 @@ async def test_async_metadata_search(self, uid): lambda: api.search_by_metadata(f'artifact.sha256:{sha}'), tries=90) assert result and result[0].sha256 == sha + @vcr.use_cassette() + async def test_async_metadata_raw_search(self, uid): + # Async twin of the sync test_metadata_raw_search; own cassette, same + # exchange. See that test for what the two assertions are covering. + async with self._api() as api: + _, sha = await submit_and_scan(api, uid) + body = { + 'query': {'term': {'artifact.sha256': sha}}, + 'aggs': {'extensions': {'terms': {'field': 'extension', 'size': 5}}}, + 'size': 1, + } + + async def _hit_count(): + # A 404 is the route missing, not the index lagging - see + # _raw_hit_count in client_scan_test.py. + try: + result = await api.metadata_raw_search(body) + except exceptions.NotFoundException: + pytest.fail('POST /search/metadata/raw answered 404: the ' + 'route is not on this stack. The server change ' + 'merges first.') + return result.json['hits']['total']['value'] + + assert await poll_equals_async(_hit_count, 1, tries=90) == 1 + result = await api.metadata_raw_search(body) + assert result.json['aggregations']['extensions']['buckets'] + assert 'partial' not in result.json + # ── IOCs ────────────────────────────────────────────────────────────────── @vcr.use_cassette() diff --git a/test/client_scan_test.py b/test/client_scan_test.py index 26f6e6aa..78f63790 100644 --- a/test/client_scan_test.py +++ b/test/client_scan_test.py @@ -69,6 +69,29 @@ def rescan_and_scan(api, sha): vcr.use_cassette = lambda *_a, **_k: (lambda _fn: _fn) +def _raw_hit_count(api, body): + """A reader for ``poll_equals`` that tells a missing route from a missing + document. + + poll_equals treats NotFoundException as "the index has not caught up", which + is right for a document and wrong for an endpoint: a search that matches + nothing is a 200 with total 0, so a 404 here means the route is absent. + Absorbed as lag it costs 90 polls and then fails as ``assert None == 1``, + which names nothing. + + It fails rather than skips, and stays after the route ships: the e2e job + runs ``TESTS_VCR=off`` against a live stack, so a skip here would let a + renamed or withdrawn route report green and promote ``:latest``. + """ + def read(): + try: + return api.metadata_raw_search(body).json['hits']['total']['value'] + except exceptions.NotFoundException: + pytest.fail('POST /search/metadata/raw answered 404: the route is ' + 'not on this stack. The server change merges first.') + return read + + @contextmanager def temp_dir(files_dict): with tempfile.TemporaryDirectory() as tmp_dir: @@ -364,6 +387,26 @@ def test_metadata_search(self): lambda: api.search_by_metadata(f'artifact.sha256:{sha}'), tries=90) assert result and result[0].sha256 == sha + @vcr.use_cassette() + def test_metadata_raw_search(self): + api = PolyswarmAPI(self.test_api_key, uri=f'http://ai:9696/{self.api_version}', community='gamma') + # The raw endpoint runs the caller's own query body, so this covers the + # two halves the SDK owns: the body survives the trip intact enough to + # match a document we just created, and an aggregation comes back beside + # the hits. The metadata write lags the scan, so poll for the hit first. + _, sha = submit_and_scan(api, self._testMethodName) + body = { + 'query': {'term': {'artifact.sha256': sha}}, + 'aggs': {'extensions': {'terms': {'field': 'extension', 'size': 5}}}, + 'size': 1, + } + found = poll_equals(_raw_hit_count(api, body), 1, tries=90) + assert found == 1 + result = api.metadata_raw_search(body) + assert result.json['aggregations']['extensions']['buckets'] + # A complete answer carries no marker; a truncated one would say so. + assert 'partial' not in result.json + def test_resolve_engine_name(self): with respx.mock(assert_all_called=False) as router: ok_payload = {'results': [ diff --git a/test/metadata_raw_search_test.py b/test/metadata_raw_search_test.py new file mode 100644 index 00000000..d81a06ac --- /dev/null +++ b/test/metadata_raw_search_test.py @@ -0,0 +1,107 @@ +"""Pure-unit tests for the ``metadata_raw_search`` builder and its parse. + +Request-shape assertions belong in this tier rather than respx +(``specs/04-testing.md`` invariant 7): ``MetadataRawSearch.search`` is pure +data, so the body-vs-query routing reads straight off the ``PolyswarmRequest`` +with no httpx. The live lifecycle test is in ``client_scan_test.py`` / +``async_client_test.py``. + +The routing is load-bearing rather than stylistic: the server reads +``community``/``communities`` out of a POST body when it resolves scope, so a +client that folded the community into the body would pick its scope with a key +the server's own grammar then rejects. + +Both transports share this builder, so one assertion covers each of them. + +Assertions read ``request_parameters``, the projection of what is *sent*. +``PolyswarmRequest.json`` is reused for the parsed *response* and is None +until the call runs - see ``core_test`` for that trap. +""" +from polyswarm_api import resources +from polyswarm_api.core import parse_response + + +_EMPTY_HITS = {'total': {'value': 0, 'relation': 'eq'}, 'hits': []} + + +class _FakeApi: + uri = 'https://api.example.test' + community = 'gamma' + + +class _FakeResponse: + """Minimal stand-in for httpx.Response that ``parse_response`` reads.""" + + def __init__(self, status_code=200, body=None, headers=None): + self.status_code = status_code + self._body = body + self.headers = headers or {} + + def json(self): + return self._body + + +def _build(body, community=None): + return resources.MetadataRawSearch.search(_FakeApi(), body, community) + + +def _parsed(result): + req = _build({'query': {'match_all': {}}}) + parse_response(_FakeResponse(body={'status': 'OK', 'result': result}), req) + return req._result + + +# ── Request shape ──────────────────────────────────────────────────── + + +class TestMetadataRawSearchRequest: + def test_the_body_reaches_the_server_verbatim(self): + body = { + 'query': {'bool': {'must': [{'term': {'scan.mimetype': 'application/zip'}}]}}, + 'aggs': {'families': {'terms': {'field': 'polyunite.malware_family', 'size': 20}}}, + 'size': 0, + 'sort': [{'artifact.created': {'order': 'desc'}}], + } + assert _build(body).request_parameters['json'] == body + + def test_the_community_rides_the_query_string_not_the_body(self): + sent = _build({'query': {'match_all': {}}}).request_parameters + assert sent['params'] == {'community': 'gamma'} + assert 'community' not in sent['json'] + assert 'communities' not in sent['json'] + + def test_an_explicit_community_overrides_the_clients(self): + sent = _build({'query': {'match_all': {}}}, community='delta').request_parameters + assert sent['params']['community'] == 'delta' + + def test_it_posts_to_the_raw_search_endpoint(self): + sent = _build({'query': {'match_all': {}}}).request_parameters + assert sent['method'] == 'POST' + assert sent['url'] == 'https://api.example.test/search/metadata/raw' + + +# ── Parse ──────────────────────────────────────────────────────────── + + +class TestMetadataRawSearchParse: + def test_hits_and_aggregations_are_both_reachable(self): + parsed = _parsed({ + 'hits': {'total': {'value': 2, 'relation': 'eq'}, + 'hits': [{'_source': {'artifact': {'sha256': 'a' * 64}}}]}, + 'aggregations': {'families': {'buckets': [{'key': 'lockbit', 'doc_count': 2}]}}, + }) + assert parsed.json['hits']['total']['value'] == 2 + assert parsed.json['aggregations']['families']['buckets'][0]['key'] == 'lockbit' + + def test_a_partial_answer_keeps_its_reasons(self): + # A truncated answer is still a 200, so this list is the only thing + # separating it from a complete one. Dropping it in the parse layer + # would turn "we could not establish this is complete" into a number. + reasons = [{'code': 'terminated_early', + 'message': 'the search stopped at terminate_after'}] + parsed = _parsed({'hits': _EMPTY_HITS, 'partial': reasons}) + assert parsed.json['partial'] == reasons + assert parsed.json['partial'][0]['code'] == 'terminated_early' + + def test_a_complete_answer_carries_no_marker(self): + assert 'partial' not in _parsed({'hits': _EMPTY_HITS}).json diff --git a/test/vcr/test_async_metadata_raw_search.vcr b/test/vcr/test_async_metadata_raw_search.vcr new file mode 100644 index 00000000..f975407e --- /dev/null +++ b/test/vcr/test_async_metadata_raw_search.vcr @@ -0,0 +1,616 @@ +interactions: +- request: + body: '{"artifact_name":"artifact","artifact_type":"FILE","community":"gamma"}' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + content-length: + - '71' + content-type: + - application/json + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: POST + uri: http://ai:9696/v3/instance + response: + body: + string: '{"result":{"artifact_id":"26342380388629077","assertions":[],"bounty_state":0,"community":"gamma","country":"","created":"2026-10-16T19:12:08.544796+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":null,"failed":false,"filename":"artifact","first_seen":"2026-10-16T19:12:08.544796+00:00","id":"26342380388629077","known_good":null,"last_scanned":null,"last_seen":null,"md5":null,"metadata":[],"mimetype":null,"permalink":"https://polyswarm.network/scan/results/file/None/26342380388629077","polyscore":null,"result":null,"sha1":null,"sha256":null,"size":null,"state":"CREATED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/b5/a4/ea/b5a4ea70-7ad2-4e1a-ab30-99e95a055177?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191208Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=540618b13a3137a78d4054e5f4b812a50c01f835059c1934fa0912934d0f4900","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '1044' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:08 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* + + test_async_metadata_raw_search' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + connection: + - keep-alive + content-length: + - '99' + host: + - minio:9000 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: PUT + uri: http://minio:9000/artifact-index/instances/b5/a4/ea/b5a4ea70-7ad2-4e1a-ab30-99e95a055177?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191208Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=540618b13a3137a78d4054e5f4b812a50c01f835059c1934fa0912934d0f4900 + response: + body: + string: '' + headers: + Accept-Ranges: + - bytes + Content-Length: + - '0' + Date: + - Fri, 16 Oct 2026 19:12:08 GMT + ETag: + - '"b7353f3b103f99087768deeac1a73302"' + Server: + - MinIO + Strict-Transport-Security: + - max-age=31536000; includeSubDomains + Vary: + - Origin + - Accept-Encoding + X-Amz-Id-2: + - dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8 + X-Amz-Request-Id: + - 18DF1854A59952F5 + X-Content-Type-Options: + - nosniff + X-Ratelimit-Limit: + - '9189' + X-Ratelimit-Remaining: + - '9189' + X-Xss-Protection: + - 1; mode=block + x-amz-expiration: + - expiry-date="Sun, 18 Oct 2026 00:00:00 GMT", rule-id="expiration-artifact-index_0-instances" + status: + code: 200 + message: OK +- request: + body: '{"community":"gamma"}' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + content-length: + - '21' + content-type: + - application/json + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: PUT + uri: http://ai:9696/v3/instance?id=26342380388629077 + response: + body: + string: '{"result":{"artifact_id":"26342380388629077","assertions":[],"bounty_state":0,"community":"gamma","country":"","created":"2026-10-16T19:12:08.544796+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":null,"failed":false,"filename":"artifact","first_seen":"2026-10-16T19:12:08.544796+00:00","id":"26342380388629077","known_good":null,"last_scanned":null,"last_seen":null,"md5":null,"metadata":[],"mimetype":null,"permalink":"https://polyswarm.network/scan/results/file/None/26342380388629077","polyscore":null,"result":null,"sha1":null,"sha256":null,"size":null,"state":"CREATED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/b5/a4/ea/b5a4ea70-7ad2-4e1a-ab30-99e95a055177?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191208Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=540618b13a3137a78d4054e5f4b812a50c01f835059c1934fa0912934d0f4900","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '1044' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:08 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: GET + uri: http://ai:9696/v3/consumer/submission/gamma/26342380388629077 + response: + body: + string: '{"result":{"artifact_id":"26342380388629077","assertions":[],"bounty_state":0,"community":"gamma","country":"","created":"2026-10-16T19:12:08.544796+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":null,"failed":false,"filename":"artifact","first_seen":"2026-10-16T19:12:08.544796+00:00","id":"26342380388629077","known_good":null,"last_scanned":null,"last_seen":null,"md5":null,"metadata":[],"mimetype":null,"permalink":"https://polyswarm.network/scan/results/file/None/26342380388629077","polyscore":null,"result":null,"sha1":null,"sha256":null,"size":null,"state":"CREATED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/b5/a4/ea/b5a4ea70-7ad2-4e1a-ab30-99e95a055177?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191208Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=540618b13a3137a78d4054e5f4b812a50c01f835059c1934fa0912934d0f4900","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '1044' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:08 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: GET + uri: http://ai:9696/v3/consumer/submission/gamma/26342380388629077 + response: + body: + string: '{"result":{"artifact_id":"26342380388629077","assertions":[{"author":"917202772827143","author_name":"engine-eicar","bid":"1000000000000000000","engine":{"description":"webhook-microengine-description","name":"engine-eicar"},"mask":true,"metadata":{"malware_family":"EICAR","product":"eicar","scanner":{"environment":{"architecture":"x86_64","operating_system":"Linux"}}},"verdict":true}],"bounty_state":2,"community":"gamma","country":"","created":"2026-10-16T19:12:08.544796+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":"EICAR + virus test files","failed":false,"filename":"artifact","first_seen":"2026-10-16T19:00:05.919385+00:00","id":"26342380388629077","known_good":null,"last_scanned":null,"last_seen":null,"md5":"b7353f3b103f99087768deeac1a73302","metadata":[{"created":"2026-10-16T19:12:08.663786+00:00","tool":"exiftool","tool_metadata":{"directory":"/tmp","exiftoolversion":12.76,"fileaccessdate":"2026:10:16 + 19:12:08+00:00","fileinodechangedate":"2026:10:16 19:12:08+00:00","filemodifydate":"2026:10:16 + 19:12:08+00:00","filename":"tmpzbmnd_d1","filepermissions":"-rw-r--r--","filesize":"99 + bytes","filetype":"TXT","filetypeextension":"txt","linecount":2,"mimeencoding":"us-ascii","mimetype":"text/plain","newlines":"Unix + LF","sourcefile":"/tmp/tmpzbmnd_d1","wordcount":2},"updated":"2026-10-16T19:12:08.663786+00:00"},{"created":"2026-10-16T19:12:08.613583+00:00","tool":"hash","tool_metadata":{"md5":"b7353f3b103f99087768deeac1a73302","sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","sha3_256":"a7330cdc95aa94bdcea7e10e95d52733a2fdbb4d8fa223bde33bcacc192a7746","sha3_512":"8f8fd035fea2b2fe1b07d0b6700241d2941d2e58c2659e92ed0c71edc61060d0fa74c3c161ec6372d32fb3c43e918feb57c97702cf5711436da5302010d67533","sha512":"75e71c8dffe7ab52300f15d0ad4a5af1517b2315a821c9bac09738531017874c9aa019132cfea82af754a154a85e33c8cf542a0614e60133fab309b6127b63dd","ssdeep":"3:a+JraNvsgzsVqSwHqDY9ARoERgJz:tJuOgzskTj4gJz","tlsh":"a6b012003a1feb5f552730210071f5641904511a1cd04628525420b4993208406dc554"},"updated":"2026-10-16T19:12:08.613583+00:00"}],"mimetype":"text/plain","permalink":"https://polyswarm.network/scan/results/file/02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f/26342380388629077","polyscore":null,"result":null,"sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","size":99,"state":"SUBMITTED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/b5/a4/ea/b5a4ea70-7ad2-4e1a-ab30-99e95a055177?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191208Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=540618b13a3137a78d4054e5f4b812a50c01f835059c1934fa0912934d0f4900","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '2940' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:09 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: GET + uri: http://ai:9696/v3/consumer/submission/gamma/26342380388629077 + response: + body: + string: '{"result":{"artifact_id":"26342380388629077","assertions":[{"author":"917202772827143","author_name":"engine-eicar","bid":"1000000000000000000","engine":{"description":"webhook-microengine-description","name":"engine-eicar"},"mask":true,"metadata":{"malware_family":"EICAR","product":"eicar","scanner":{"environment":{"architecture":"x86_64","operating_system":"Linux"}}},"verdict":true}],"bounty_state":2,"community":"gamma","country":"","created":"2026-10-16T19:12:08.544796+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":"EICAR + virus test files","failed":false,"filename":"artifact","first_seen":"2026-10-16T19:00:05.919385+00:00","id":"26342380388629077","known_good":null,"last_scanned":null,"last_seen":null,"md5":"b7353f3b103f99087768deeac1a73302","metadata":[{"created":"2026-10-16T19:12:08.663786+00:00","tool":"exiftool","tool_metadata":{"directory":"/tmp","exiftoolversion":12.76,"fileaccessdate":"2026:10:16 + 19:12:08+00:00","fileinodechangedate":"2026:10:16 19:12:08+00:00","filemodifydate":"2026:10:16 + 19:12:08+00:00","filename":"tmpzbmnd_d1","filepermissions":"-rw-r--r--","filesize":"99 + bytes","filetype":"TXT","filetypeextension":"txt","linecount":2,"mimeencoding":"us-ascii","mimetype":"text/plain","newlines":"Unix + LF","sourcefile":"/tmp/tmpzbmnd_d1","wordcount":2},"updated":"2026-10-16T19:12:08.663786+00:00"},{"created":"2026-10-16T19:12:08.613583+00:00","tool":"hash","tool_metadata":{"md5":"b7353f3b103f99087768deeac1a73302","sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","sha3_256":"a7330cdc95aa94bdcea7e10e95d52733a2fdbb4d8fa223bde33bcacc192a7746","sha3_512":"8f8fd035fea2b2fe1b07d0b6700241d2941d2e58c2659e92ed0c71edc61060d0fa74c3c161ec6372d32fb3c43e918feb57c97702cf5711436da5302010d67533","sha512":"75e71c8dffe7ab52300f15d0ad4a5af1517b2315a821c9bac09738531017874c9aa019132cfea82af754a154a85e33c8cf542a0614e60133fab309b6127b63dd","ssdeep":"3:a+JraNvsgzsVqSwHqDY9ARoERgJz:tJuOgzskTj4gJz","tlsh":"a6b012003a1feb5f552730210071f5641904511a1cd04628525420b4993208406dc554"},"updated":"2026-10-16T19:12:08.613583+00:00"}],"mimetype":"text/plain","permalink":"https://polyswarm.network/scan/results/file/02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f/26342380388629077","polyscore":null,"result":null,"sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","size":99,"state":"SUBMITTED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/b5/a4/ea/b5a4ea70-7ad2-4e1a-ab30-99e95a055177?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191208Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=540618b13a3137a78d4054e5f4b812a50c01f835059c1934fa0912934d0f4900","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '2940' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:10 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: GET + uri: http://ai:9696/v3/consumer/submission/gamma/26342380388629077 + response: + body: + string: '{"result":{"artifact_id":"26342380388629077","assertions":[{"author":"917202772827143","author_name":"engine-eicar","bid":"1000000000000000000","engine":{"description":"webhook-microengine-description","name":"engine-eicar"},"mask":true,"metadata":{"malware_family":"EICAR","product":"eicar","scanner":{"environment":{"architecture":"x86_64","operating_system":"Linux"}}},"verdict":true}],"bounty_state":2,"community":"gamma","country":"","created":"2026-10-16T19:12:08.544796+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":"EICAR + virus test files","failed":false,"filename":"artifact","first_seen":"2026-10-16T19:00:05.919385+00:00","id":"26342380388629077","known_good":null,"last_scanned":null,"last_seen":null,"md5":"b7353f3b103f99087768deeac1a73302","metadata":[{"created":"2026-10-16T19:12:08.663786+00:00","tool":"exiftool","tool_metadata":{"directory":"/tmp","exiftoolversion":12.76,"fileaccessdate":"2026:10:16 + 19:12:08+00:00","fileinodechangedate":"2026:10:16 19:12:08+00:00","filemodifydate":"2026:10:16 + 19:12:08+00:00","filename":"tmpzbmnd_d1","filepermissions":"-rw-r--r--","filesize":"99 + bytes","filetype":"TXT","filetypeextension":"txt","linecount":2,"mimeencoding":"us-ascii","mimetype":"text/plain","newlines":"Unix + LF","sourcefile":"/tmp/tmpzbmnd_d1","wordcount":2},"updated":"2026-10-16T19:12:08.663786+00:00"},{"created":"2026-10-16T19:12:08.613583+00:00","tool":"hash","tool_metadata":{"md5":"b7353f3b103f99087768deeac1a73302","sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","sha3_256":"a7330cdc95aa94bdcea7e10e95d52733a2fdbb4d8fa223bde33bcacc192a7746","sha3_512":"8f8fd035fea2b2fe1b07d0b6700241d2941d2e58c2659e92ed0c71edc61060d0fa74c3c161ec6372d32fb3c43e918feb57c97702cf5711436da5302010d67533","sha512":"75e71c8dffe7ab52300f15d0ad4a5af1517b2315a821c9bac09738531017874c9aa019132cfea82af754a154a85e33c8cf542a0614e60133fab309b6127b63dd","ssdeep":"3:a+JraNvsgzsVqSwHqDY9ARoERgJz:tJuOgzskTj4gJz","tlsh":"a6b012003a1feb5f552730210071f5641904511a1cd04628525420b4993208406dc554"},"updated":"2026-10-16T19:12:08.613583+00:00"}],"mimetype":"text/plain","permalink":"https://polyswarm.network/scan/results/file/02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f/26342380388629077","polyscore":null,"result":null,"sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","size":99,"state":"SUBMITTED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/b5/a4/ea/b5a4ea70-7ad2-4e1a-ab30-99e95a055177?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191208Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=540618b13a3137a78d4054e5f4b812a50c01f835059c1934fa0912934d0f4900","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '2940' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:11 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: GET + uri: http://ai:9696/v3/consumer/submission/gamma/26342380388629077 + response: + body: + string: '{"result":{"artifact_id":"26342380388629077","assertions":[{"author":"917202772827143","author_name":"engine-eicar","bid":"1000000000000000000","engine":{"description":"webhook-microengine-description","name":"engine-eicar"},"mask":true,"metadata":{"malware_family":"EICAR","product":"eicar","scanner":{"environment":{"architecture":"x86_64","operating_system":"Linux"}}},"verdict":true}],"bounty_state":2,"community":"gamma","country":"","created":"2026-10-16T19:12:08.544796+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":"EICAR + virus test files","failed":false,"filename":"artifact","first_seen":"2026-10-16T19:00:05.919385+00:00","id":"26342380388629077","known_good":null,"last_scanned":null,"last_seen":null,"md5":"b7353f3b103f99087768deeac1a73302","metadata":[{"created":"2026-10-16T19:12:08.663786+00:00","tool":"exiftool","tool_metadata":{"directory":"/tmp","exiftoolversion":12.76,"fileaccessdate":"2026:10:16 + 19:12:08+00:00","fileinodechangedate":"2026:10:16 19:12:08+00:00","filemodifydate":"2026:10:16 + 19:12:08+00:00","filename":"tmpzbmnd_d1","filepermissions":"-rw-r--r--","filesize":"99 + bytes","filetype":"TXT","filetypeextension":"txt","linecount":2,"mimeencoding":"us-ascii","mimetype":"text/plain","newlines":"Unix + LF","sourcefile":"/tmp/tmpzbmnd_d1","wordcount":2},"updated":"2026-10-16T19:12:08.663786+00:00"},{"created":"2026-10-16T19:12:08.613583+00:00","tool":"hash","tool_metadata":{"md5":"b7353f3b103f99087768deeac1a73302","sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","sha3_256":"a7330cdc95aa94bdcea7e10e95d52733a2fdbb4d8fa223bde33bcacc192a7746","sha3_512":"8f8fd035fea2b2fe1b07d0b6700241d2941d2e58c2659e92ed0c71edc61060d0fa74c3c161ec6372d32fb3c43e918feb57c97702cf5711436da5302010d67533","sha512":"75e71c8dffe7ab52300f15d0ad4a5af1517b2315a821c9bac09738531017874c9aa019132cfea82af754a154a85e33c8cf542a0614e60133fab309b6127b63dd","ssdeep":"3:a+JraNvsgzsVqSwHqDY9ARoERgJz:tJuOgzskTj4gJz","tlsh":"a6b012003a1feb5f552730210071f5641904511a1cd04628525420b4993208406dc554"},"updated":"2026-10-16T19:12:08.613583+00:00"}],"mimetype":"text/plain","permalink":"https://polyswarm.network/scan/results/file/02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f/26342380388629077","polyscore":null,"result":null,"sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","size":99,"state":"SUBMITTED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/b5/a4/ea/b5a4ea70-7ad2-4e1a-ab30-99e95a055177?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191208Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=540618b13a3137a78d4054e5f4b812a50c01f835059c1934fa0912934d0f4900","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '2940' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:12 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: GET + uri: http://ai:9696/v3/consumer/submission/gamma/26342380388629077 + response: + body: + string: '{"result":{"artifact_id":"26342380388629077","assertions":[{"author":"917202772827143","author_name":"engine-eicar","bid":"1000000000000000000","engine":{"description":"webhook-microengine-description","name":"engine-eicar"},"mask":true,"metadata":{"malware_family":"EICAR","product":"eicar","scanner":{"environment":{"architecture":"x86_64","operating_system":"Linux"}}},"verdict":true}],"bounty_state":2,"community":"gamma","country":"","created":"2026-10-16T19:12:08.544796+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":"EICAR + virus test files","failed":false,"filename":"artifact","first_seen":"2026-10-16T19:00:05.919385+00:00","id":"26342380388629077","known_good":null,"last_scanned":null,"last_seen":null,"md5":"b7353f3b103f99087768deeac1a73302","metadata":[{"created":"2026-10-16T19:12:08.663786+00:00","tool":"exiftool","tool_metadata":{"directory":"/tmp","exiftoolversion":12.76,"fileaccessdate":"2026:10:16 + 19:12:08+00:00","fileinodechangedate":"2026:10:16 19:12:08+00:00","filemodifydate":"2026:10:16 + 19:12:08+00:00","filename":"tmpzbmnd_d1","filepermissions":"-rw-r--r--","filesize":"99 + bytes","filetype":"TXT","filetypeextension":"txt","linecount":2,"mimeencoding":"us-ascii","mimetype":"text/plain","newlines":"Unix + LF","sourcefile":"/tmp/tmpzbmnd_d1","wordcount":2},"updated":"2026-10-16T19:12:08.663786+00:00"},{"created":"2026-10-16T19:12:08.613583+00:00","tool":"hash","tool_metadata":{"md5":"b7353f3b103f99087768deeac1a73302","sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","sha3_256":"a7330cdc95aa94bdcea7e10e95d52733a2fdbb4d8fa223bde33bcacc192a7746","sha3_512":"8f8fd035fea2b2fe1b07d0b6700241d2941d2e58c2659e92ed0c71edc61060d0fa74c3c161ec6372d32fb3c43e918feb57c97702cf5711436da5302010d67533","sha512":"75e71c8dffe7ab52300f15d0ad4a5af1517b2315a821c9bac09738531017874c9aa019132cfea82af754a154a85e33c8cf542a0614e60133fab309b6127b63dd","ssdeep":"3:a+JraNvsgzsVqSwHqDY9ARoERgJz:tJuOgzskTj4gJz","tlsh":"a6b012003a1feb5f552730210071f5641904511a1cd04628525420b4993208406dc554"},"updated":"2026-10-16T19:12:08.613583+00:00"}],"mimetype":"text/plain","permalink":"https://polyswarm.network/scan/results/file/02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f/26342380388629077","polyscore":null,"result":null,"sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","size":99,"state":"SUBMITTED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/b5/a4/ea/b5a4ea70-7ad2-4e1a-ab30-99e95a055177?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191208Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=540618b13a3137a78d4054e5f4b812a50c01f835059c1934fa0912934d0f4900","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '2940' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:13 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: GET + uri: http://ai:9696/v3/consumer/submission/gamma/26342380388629077 + response: + body: + string: '{"result":{"artifact_id":"26342380388629077","assertions":[{"author":"917202772827143","author_name":"engine-eicar","bid":"1000000000000000000","engine":{"description":"webhook-microengine-description","name":"engine-eicar"},"mask":true,"metadata":{"malware_family":"EICAR","product":"eicar","scanner":{"environment":{"architecture":"x86_64","operating_system":"Linux"}}},"verdict":true}],"bounty_state":2,"community":"gamma","country":"","created":"2026-10-16T19:12:08.544796+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":"EICAR + virus test files","failed":false,"filename":"artifact","first_seen":"2026-10-16T19:00:05.919385+00:00","id":"26342380388629077","known_good":null,"last_scanned":null,"last_seen":null,"md5":"b7353f3b103f99087768deeac1a73302","metadata":[{"created":"2026-10-16T19:12:08.663786+00:00","tool":"exiftool","tool_metadata":{"directory":"/tmp","exiftoolversion":12.76,"fileaccessdate":"2026:10:16 + 19:12:08+00:00","fileinodechangedate":"2026:10:16 19:12:08+00:00","filemodifydate":"2026:10:16 + 19:12:08+00:00","filename":"tmpzbmnd_d1","filepermissions":"-rw-r--r--","filesize":"99 + bytes","filetype":"TXT","filetypeextension":"txt","linecount":2,"mimeencoding":"us-ascii","mimetype":"text/plain","newlines":"Unix + LF","sourcefile":"/tmp/tmpzbmnd_d1","wordcount":2},"updated":"2026-10-16T19:12:08.663786+00:00"},{"created":"2026-10-16T19:12:08.613583+00:00","tool":"hash","tool_metadata":{"md5":"b7353f3b103f99087768deeac1a73302","sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","sha3_256":"a7330cdc95aa94bdcea7e10e95d52733a2fdbb4d8fa223bde33bcacc192a7746","sha3_512":"8f8fd035fea2b2fe1b07d0b6700241d2941d2e58c2659e92ed0c71edc61060d0fa74c3c161ec6372d32fb3c43e918feb57c97702cf5711436da5302010d67533","sha512":"75e71c8dffe7ab52300f15d0ad4a5af1517b2315a821c9bac09738531017874c9aa019132cfea82af754a154a85e33c8cf542a0614e60133fab309b6127b63dd","ssdeep":"3:a+JraNvsgzsVqSwHqDY9ARoERgJz:tJuOgzskTj4gJz","tlsh":"a6b012003a1feb5f552730210071f5641904511a1cd04628525420b4993208406dc554"},"updated":"2026-10-16T19:12:08.613583+00:00"}],"mimetype":"text/plain","permalink":"https://polyswarm.network/scan/results/file/02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f/26342380388629077","polyscore":null,"result":null,"sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","size":99,"state":"SUBMITTED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/b5/a4/ea/b5a4ea70-7ad2-4e1a-ab30-99e95a055177?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191208Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=540618b13a3137a78d4054e5f4b812a50c01f835059c1934fa0912934d0f4900","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '2940' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:14 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: GET + uri: http://ai:9696/v3/consumer/submission/gamma/26342380388629077 + response: + body: + string: '{"result":{"artifact_id":"26342380388629077","assertions":[{"author":"917202772827143","author_name":"engine-eicar","bid":"1000000000000000000","engine":{"description":"webhook-microengine-description","name":"engine-eicar"},"mask":true,"metadata":{"malware_family":"EICAR","product":"eicar","scanner":{"environment":{"architecture":"x86_64","operating_system":"Linux"}}},"verdict":true}],"bounty_state":3,"community":"gamma","country":"","created":"2026-10-16T19:12:08.544796+00:00","detections":{"benign":0,"malicious":1,"total":1},"expiration_window":null,"expire_at":null,"extended_type":"EICAR + virus test files","failed":false,"filename":"artifact","first_seen":"2026-10-16T19:00:05.919385+00:00","id":"26342380388629077","known_good":null,"last_scanned":"2026-10-16T19:12:08.544796+00:00","last_seen":"2026-10-16T19:12:08.544796+00:00","md5":"b7353f3b103f99087768deeac1a73302","metadata":[{"created":"2026-10-16T19:12:15.629021+00:00","tool":"polyunite","tool_metadata":{"labels":["nonmalware"],"malware_family":"EICAR","operating_system":[]},"updated":"2026-10-16T19:12:15.629021+00:00"},{"created":"2026-10-16T19:12:08.663786+00:00","tool":"exiftool","tool_metadata":{"directory":"/tmp","exiftoolversion":12.76,"fileaccessdate":"2026:10:16 + 19:12:08+00:00","fileinodechangedate":"2026:10:16 19:12:08+00:00","filemodifydate":"2026:10:16 + 19:12:08+00:00","filename":"tmpzbmnd_d1","filepermissions":"-rw-r--r--","filesize":"99 + bytes","filetype":"TXT","filetypeextension":"txt","linecount":2,"mimeencoding":"us-ascii","mimetype":"text/plain","newlines":"Unix + LF","sourcefile":"/tmp/tmpzbmnd_d1","wordcount":2},"updated":"2026-10-16T19:12:08.663786+00:00"},{"created":"2026-10-16T19:12:08.613583+00:00","tool":"hash","tool_metadata":{"md5":"b7353f3b103f99087768deeac1a73302","sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","sha3_256":"a7330cdc95aa94bdcea7e10e95d52733a2fdbb4d8fa223bde33bcacc192a7746","sha3_512":"8f8fd035fea2b2fe1b07d0b6700241d2941d2e58c2659e92ed0c71edc61060d0fa74c3c161ec6372d32fb3c43e918feb57c97702cf5711436da5302010d67533","sha512":"75e71c8dffe7ab52300f15d0ad4a5af1517b2315a821c9bac09738531017874c9aa019132cfea82af754a154a85e33c8cf542a0614e60133fab309b6127b63dd","ssdeep":"3:a+JraNvsgzsVqSwHqDY9ARoERgJz:tJuOgzskTj4gJz","tlsh":"a6b012003a1feb5f552730210071f5641904511a1cd04628525420b4993208406dc554"},"updated":"2026-10-16T19:12:08.613583+00:00"}],"mimetype":"text/plain","permalink":"https://polyswarm.network/scan/results/file/02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f/26342380388629077","polyscore":null,"result":null,"sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","size":99,"state":"AWAITING_ARBITRATION","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/b5/a4/ea/b5a4ea70-7ad2-4e1a-ab30-99e95a055177?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191208Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=540618b13a3137a78d4054e5f4b812a50c01f835059c1934fa0912934d0f4900","votes":[],"window_closed":true},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '3242' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:15 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '{"query":{"term":{"artifact.sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f"}},"aggs":{"extensions":{"terms":{"field":"extension","size":5}}},"size":1}' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + content-length: + - '177' + content-type: + - application/json + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: POST + uri: http://ai:9696/v3/search/metadata/raw?community=gamma + response: + body: + string: '{"result":{"aggregations":{"extensions":{"buckets":[{"doc_count":1,"key":"txt"}],"doc_count_error_upper_bound":0,"sum_other_doc_count":0}},"hits":{"hits":[{"_id":"20521297859705876","_index":"metadata-2963","_score":1.1451323,"_source":{"artifact":{"created":"2026-10-16T19:00:05.919385+00:00","id":"20521297859705876","md5":"b7353f3b103f99087768deeac1a73302","sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","size":99},"exiftool":{"filesize":"99 + bytes","filetype":"TXT","filetypeextension":"txt","mimetype":"text/plain"},"extension":"txt","hash":{"md5":"b7353f3b103f99087768deeac1a73302","sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","sha3_256":"a7330cdc95aa94bdcea7e10e95d52733a2fdbb4d8fa223bde33bcacc192a7746","sha3_512":"8f8fd035fea2b2fe1b07d0b6700241d2941d2e58c2659e92ed0c71edc61060d0fa74c3c161ec6372d32fb3c43e918feb57c97702cf5711436da5302010d67533","sha512":"75e71c8dffe7ab52300f15d0ad4a5af1517b2315a821c9bac09738531017874c9aa019132cfea82af754a154a85e33c8cf542a0614e60133fab309b6127b63dd","ssdeep":"3:a+JraNvsgzsVqSwHqDY9ARoERgJz:tJuOgzskTj4gJz","tlsh":"a6b012003a1feb5f552730210071f5641904511a1cd04628525420b4993208406dc554"},"meta_community":"_public","modified":"2026-10-16T19:10:36.705430+00:00","polyunite":{"labels":["nonmalware"],"malware_family":"EICAR"},"scan":{"detections":{"benign":0,"malicious":1,"total":1},"filename":["artifact"],"first_scan":{"artifact_instance_id":"76137403510278611","assertions":{"engine-eicar":{"assertion":"malicious","metadata":{"malware_family":"EICAR"}}},"created":"2026-10-16T19:00:05.919385+00:00","detections":{"benign":0,"malicious":1,"total":1},"filename":"artifact","votes":{}},"first_seen":"2026-10-16T19:00:05.919385+00:00","last_seen":"2026-10-16T19:10:29.621757+00:00","latest_scan":{"artifact_instance_id":"10385075083158560","assertions":{"engine-eicar":{"assertion":"malicious","metadata":{"malware_family":"EICAR"}}},"created":"2026-10-16T19:10:29.621757+00:00","detections":{"benign":0,"malicious":1,"total":1},"filename":"artifact","votes":{}},"mimetype":{"extended":"EICAR + virus test files","mime":"text/plain"}},"updated":{"exiftool":"2026-10-16T19:10:29.740999+00:00","hash":"2026-10-16T19:10:29.691749+00:00","polyunite":"2026-10-16T19:10:36.705430+00:00"}}}],"max_score":1.1451323,"total":{"relation":"eq","value":1}}},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '2459' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:15 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '{"query":{"term":{"artifact.sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f"}},"aggs":{"extensions":{"terms":{"field":"extension","size":5}}},"size":1}' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + content-length: + - '177' + content-type: + - application/json + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: POST + uri: http://ai:9696/v3/search/metadata/raw?community=gamma + response: + body: + string: '{"result":{"aggregations":{"extensions":{"buckets":[{"doc_count":1,"key":"txt"}],"doc_count_error_upper_bound":0,"sum_other_doc_count":0}},"hits":{"hits":[{"_id":"20521297859705876","_index":"metadata-2963","_score":1.1451323,"_source":{"artifact":{"created":"2026-10-16T19:00:05.919385+00:00","id":"20521297859705876","md5":"b7353f3b103f99087768deeac1a73302","sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","size":99},"exiftool":{"filesize":"99 + bytes","filetype":"TXT","filetypeextension":"txt","mimetype":"text/plain"},"extension":"txt","hash":{"md5":"b7353f3b103f99087768deeac1a73302","sha1":"4bd92be69056d4709d4d7cf621712e058a4cafed","sha256":"02d34dcceb9491e8e03c9229df4c99106c349ab76aeee790d295218fc8c9aa7f","sha3_256":"a7330cdc95aa94bdcea7e10e95d52733a2fdbb4d8fa223bde33bcacc192a7746","sha3_512":"8f8fd035fea2b2fe1b07d0b6700241d2941d2e58c2659e92ed0c71edc61060d0fa74c3c161ec6372d32fb3c43e918feb57c97702cf5711436da5302010d67533","sha512":"75e71c8dffe7ab52300f15d0ad4a5af1517b2315a821c9bac09738531017874c9aa019132cfea82af754a154a85e33c8cf542a0614e60133fab309b6127b63dd","ssdeep":"3:a+JraNvsgzsVqSwHqDY9ARoERgJz:tJuOgzskTj4gJz","tlsh":"a6b012003a1feb5f552730210071f5641904511a1cd04628525420b4993208406dc554"},"meta_community":"_public","modified":"2026-10-16T19:10:36.705430+00:00","polyunite":{"labels":["nonmalware"],"malware_family":"EICAR"},"scan":{"detections":{"benign":0,"malicious":1,"total":1},"filename":["artifact"],"first_scan":{"artifact_instance_id":"76137403510278611","assertions":{"engine-eicar":{"assertion":"malicious","metadata":{"malware_family":"EICAR"}}},"created":"2026-10-16T19:00:05.919385+00:00","detections":{"benign":0,"malicious":1,"total":1},"filename":"artifact","votes":{}},"first_seen":"2026-10-16T19:00:05.919385+00:00","last_seen":"2026-10-16T19:10:29.621757+00:00","latest_scan":{"artifact_instance_id":"10385075083158560","assertions":{"engine-eicar":{"assertion":"malicious","metadata":{"malware_family":"EICAR"}}},"created":"2026-10-16T19:10:29.621757+00:00","detections":{"benign":0,"malicious":1,"total":1},"filename":"artifact","votes":{}},"mimetype":{"extended":"EICAR + virus test files","mime":"text/plain"}},"updated":{"exiftool":"2026-10-16T19:10:29.740999+00:00","hash":"2026-10-16T19:10:29.691749+00:00","polyunite":"2026-10-16T19:10:36.705430+00:00"}}}],"max_score":1.1451323,"total":{"relation":"eq","value":1}}},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '2459' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:15 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +version: 1 diff --git a/test/vcr/test_metadata_raw_search.vcr b/test/vcr/test_metadata_raw_search.vcr new file mode 100644 index 00000000..895b0d11 --- /dev/null +++ b/test/vcr/test_metadata_raw_search.vcr @@ -0,0 +1,616 @@ +interactions: +- request: + body: '{"artifact_name":"artifact","artifact_type":"FILE","community":"gamma"}' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + content-length: + - '71' + content-type: + - application/json + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: POST + uri: http://ai:9696/v3/instance + response: + body: + string: '{"result":{"artifact_id":"39027402148512388","assertions":[],"bounty_state":0,"community":"gamma","country":"","created":"2026-10-16T19:12:00.979459+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":null,"failed":false,"filename":"artifact","first_seen":"2026-10-16T19:12:00.979459+00:00","id":"39027402148512388","known_good":null,"last_scanned":null,"last_seen":null,"md5":null,"metadata":[],"mimetype":null,"permalink":"https://polyswarm.network/scan/results/file/None/39027402148512388","polyscore":null,"result":null,"sha1":null,"sha256":null,"size":null,"state":"CREATED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/16/3c/7e/163c7e58-4656-4362-a3bc-5ac4283eb044?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191200Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=26b7e10592c0bfbc1070cdd1b4576cd752a4c9e43de694f9c83d8f24c7f7db58","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '1044' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:00 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* + + test_metadata_raw_search' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + connection: + - keep-alive + content-length: + - '93' + host: + - minio:9000 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: PUT + uri: http://minio:9000/artifact-index/instances/16/3c/7e/163c7e58-4656-4362-a3bc-5ac4283eb044?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191200Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=26b7e10592c0bfbc1070cdd1b4576cd752a4c9e43de694f9c83d8f24c7f7db58 + response: + body: + string: '' + headers: + Accept-Ranges: + - bytes + Content-Length: + - '0' + Date: + - Fri, 16 Oct 2026 19:12:00 GMT + ETag: + - '"41e0052928de2071fbd1ba679a270cd6"' + Server: + - MinIO + Strict-Transport-Security: + - max-age=31536000; includeSubDomains + Vary: + - Origin + - Accept-Encoding + X-Amz-Id-2: + - dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8 + X-Amz-Request-Id: + - 18DF1852E2A007B9 + X-Content-Type-Options: + - nosniff + X-Ratelimit-Limit: + - '9189' + X-Ratelimit-Remaining: + - '9189' + X-Xss-Protection: + - 1; mode=block + x-amz-expiration: + - expiry-date="Sun, 18 Oct 2026 00:00:00 GMT", rule-id="expiration-artifact-index_0-instances" + status: + code: 200 + message: OK +- request: + body: '{"community":"gamma"}' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + content-length: + - '21' + content-type: + - application/json + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: PUT + uri: http://ai:9696/v3/instance?id=39027402148512388 + response: + body: + string: '{"result":{"artifact_id":"39027402148512388","assertions":[],"bounty_state":0,"community":"gamma","country":"","created":"2026-10-16T19:12:00.979459+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":null,"failed":false,"filename":"artifact","first_seen":"2026-10-16T19:12:00.979459+00:00","id":"39027402148512388","known_good":null,"last_scanned":null,"last_seen":null,"md5":null,"metadata":[],"mimetype":null,"permalink":"https://polyswarm.network/scan/results/file/None/39027402148512388","polyscore":null,"result":null,"sha1":null,"sha256":null,"size":null,"state":"CREATED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/16/3c/7e/163c7e58-4656-4362-a3bc-5ac4283eb044?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191200Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=26b7e10592c0bfbc1070cdd1b4576cd752a4c9e43de694f9c83d8f24c7f7db58","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '1044' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:01 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: GET + uri: http://ai:9696/v3/consumer/submission/gamma/39027402148512388 + response: + body: + string: '{"result":{"artifact_id":"39027402148512388","assertions":[],"bounty_state":0,"community":"gamma","country":"","created":"2026-10-16T19:12:00.979459+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":null,"failed":false,"filename":"artifact","first_seen":"2026-10-16T19:12:00.979459+00:00","id":"39027402148512388","known_good":null,"last_scanned":null,"last_seen":null,"md5":null,"metadata":[],"mimetype":null,"permalink":"https://polyswarm.network/scan/results/file/None/39027402148512388","polyscore":null,"result":null,"sha1":null,"sha256":null,"size":null,"state":"CREATED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/16/3c/7e/163c7e58-4656-4362-a3bc-5ac4283eb044?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191200Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=26b7e10592c0bfbc1070cdd1b4576cd752a4c9e43de694f9c83d8f24c7f7db58","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '1044' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:01 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: GET + uri: http://ai:9696/v3/consumer/submission/gamma/39027402148512388 + response: + body: + string: '{"result":{"artifact_id":"39027402148512388","assertions":[{"author":"917202772827143","author_name":"engine-eicar","bid":"1000000000000000000","engine":{"description":"webhook-microengine-description","name":"engine-eicar"},"mask":true,"metadata":{"malware_family":"EICAR","product":"eicar","scanner":{"environment":{"architecture":"x86_64","operating_system":"Linux"}}},"verdict":true}],"bounty_state":2,"community":"gamma","country":"","created":"2026-10-16T19:12:00.979459+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":"EICAR + virus test files","failed":false,"filename":"artifact","first_seen":"2026-10-16T19:00:49.830485+00:00","id":"39027402148512388","known_good":null,"last_scanned":null,"last_seen":null,"md5":"41e0052928de2071fbd1ba679a270cd6","metadata":[{"created":"2026-10-16T19:12:01.115418+00:00","tool":"exiftool","tool_metadata":{"directory":"/tmp","exiftoolversion":12.76,"fileaccessdate":"2026:10:16 + 19:12:01+00:00","fileinodechangedate":"2026:10:16 19:12:01+00:00","filemodifydate":"2026:10:16 + 19:12:01+00:00","filename":"tmp9iq2nb1e","filepermissions":"-rw-r--r--","filesize":"93 + bytes","filetype":"TXT","filetypeextension":"txt","linecount":2,"mimeencoding":"us-ascii","mimetype":"text/plain","newlines":"Unix + LF","sourcefile":"/tmp/tmp9iq2nb1e","wordcount":2},"updated":"2026-10-16T19:12:01.115418+00:00"},{"created":"2026-10-16T19:12:01.066743+00:00","tool":"hash","tool_metadata":{"md5":"41e0052928de2071fbd1ba679a270cd6","sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","sha3_256":"62df3d6496ebbfc23e53ba86037a49890bf1047d9282c355ac0d213df694d5b3","sha3_512":"9ee53d77492d6e3f5a55e666fc6e0dc477f6104edbe7bd9a3968149446c128d180efb55f3f87b486726a5eb58626325ce0428b86793446d53aebccbeac4f50ee","sha512":"3471c2e3c1ad204dd512d30cbb94235c60b079151d6b333e754ad34fa916c718856cdab48ed3ec49f5bfda288db81736357567a2c656eacf050443e44e4a2ab7","ssdeep":"3:a+JraNvsgzsVqSwHqDY1RgJz:tJuOgzsk5gJz","tlsh":"4bb01200360feb6f512724111075f6641904510a1cd00628515010b4893208402dc154"},"updated":"2026-10-16T19:12:01.066743+00:00"}],"mimetype":"text/plain","permalink":"https://polyswarm.network/scan/results/file/6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4/39027402148512388","polyscore":null,"result":null,"sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","size":93,"state":"SUBMITTED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/16/3c/7e/163c7e58-4656-4362-a3bc-5ac4283eb044?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191200Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=26b7e10592c0bfbc1070cdd1b4576cd752a4c9e43de694f9c83d8f24c7f7db58","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '2934' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:02 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: GET + uri: http://ai:9696/v3/consumer/submission/gamma/39027402148512388 + response: + body: + string: '{"result":{"artifact_id":"39027402148512388","assertions":[{"author":"917202772827143","author_name":"engine-eicar","bid":"1000000000000000000","engine":{"description":"webhook-microengine-description","name":"engine-eicar"},"mask":true,"metadata":{"malware_family":"EICAR","product":"eicar","scanner":{"environment":{"architecture":"x86_64","operating_system":"Linux"}}},"verdict":true}],"bounty_state":2,"community":"gamma","country":"","created":"2026-10-16T19:12:00.979459+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":"EICAR + virus test files","failed":false,"filename":"artifact","first_seen":"2026-10-16T19:00:49.830485+00:00","id":"39027402148512388","known_good":null,"last_scanned":null,"last_seen":null,"md5":"41e0052928de2071fbd1ba679a270cd6","metadata":[{"created":"2026-10-16T19:12:01.115418+00:00","tool":"exiftool","tool_metadata":{"directory":"/tmp","exiftoolversion":12.76,"fileaccessdate":"2026:10:16 + 19:12:01+00:00","fileinodechangedate":"2026:10:16 19:12:01+00:00","filemodifydate":"2026:10:16 + 19:12:01+00:00","filename":"tmp9iq2nb1e","filepermissions":"-rw-r--r--","filesize":"93 + bytes","filetype":"TXT","filetypeextension":"txt","linecount":2,"mimeencoding":"us-ascii","mimetype":"text/plain","newlines":"Unix + LF","sourcefile":"/tmp/tmp9iq2nb1e","wordcount":2},"updated":"2026-10-16T19:12:01.115418+00:00"},{"created":"2026-10-16T19:12:01.066743+00:00","tool":"hash","tool_metadata":{"md5":"41e0052928de2071fbd1ba679a270cd6","sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","sha3_256":"62df3d6496ebbfc23e53ba86037a49890bf1047d9282c355ac0d213df694d5b3","sha3_512":"9ee53d77492d6e3f5a55e666fc6e0dc477f6104edbe7bd9a3968149446c128d180efb55f3f87b486726a5eb58626325ce0428b86793446d53aebccbeac4f50ee","sha512":"3471c2e3c1ad204dd512d30cbb94235c60b079151d6b333e754ad34fa916c718856cdab48ed3ec49f5bfda288db81736357567a2c656eacf050443e44e4a2ab7","ssdeep":"3:a+JraNvsgzsVqSwHqDY1RgJz:tJuOgzsk5gJz","tlsh":"4bb01200360feb6f512724111075f6641904510a1cd00628515010b4893208402dc154"},"updated":"2026-10-16T19:12:01.066743+00:00"}],"mimetype":"text/plain","permalink":"https://polyswarm.network/scan/results/file/6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4/39027402148512388","polyscore":null,"result":null,"sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","size":93,"state":"SUBMITTED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/16/3c/7e/163c7e58-4656-4362-a3bc-5ac4283eb044?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191200Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=26b7e10592c0bfbc1070cdd1b4576cd752a4c9e43de694f9c83d8f24c7f7db58","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '2934' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:03 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: GET + uri: http://ai:9696/v3/consumer/submission/gamma/39027402148512388 + response: + body: + string: '{"result":{"artifact_id":"39027402148512388","assertions":[{"author":"917202772827143","author_name":"engine-eicar","bid":"1000000000000000000","engine":{"description":"webhook-microengine-description","name":"engine-eicar"},"mask":true,"metadata":{"malware_family":"EICAR","product":"eicar","scanner":{"environment":{"architecture":"x86_64","operating_system":"Linux"}}},"verdict":true}],"bounty_state":2,"community":"gamma","country":"","created":"2026-10-16T19:12:00.979459+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":"EICAR + virus test files","failed":false,"filename":"artifact","first_seen":"2026-10-16T19:00:49.830485+00:00","id":"39027402148512388","known_good":null,"last_scanned":null,"last_seen":null,"md5":"41e0052928de2071fbd1ba679a270cd6","metadata":[{"created":"2026-10-16T19:12:01.115418+00:00","tool":"exiftool","tool_metadata":{"directory":"/tmp","exiftoolversion":12.76,"fileaccessdate":"2026:10:16 + 19:12:01+00:00","fileinodechangedate":"2026:10:16 19:12:01+00:00","filemodifydate":"2026:10:16 + 19:12:01+00:00","filename":"tmp9iq2nb1e","filepermissions":"-rw-r--r--","filesize":"93 + bytes","filetype":"TXT","filetypeextension":"txt","linecount":2,"mimeencoding":"us-ascii","mimetype":"text/plain","newlines":"Unix + LF","sourcefile":"/tmp/tmp9iq2nb1e","wordcount":2},"updated":"2026-10-16T19:12:01.115418+00:00"},{"created":"2026-10-16T19:12:01.066743+00:00","tool":"hash","tool_metadata":{"md5":"41e0052928de2071fbd1ba679a270cd6","sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","sha3_256":"62df3d6496ebbfc23e53ba86037a49890bf1047d9282c355ac0d213df694d5b3","sha3_512":"9ee53d77492d6e3f5a55e666fc6e0dc477f6104edbe7bd9a3968149446c128d180efb55f3f87b486726a5eb58626325ce0428b86793446d53aebccbeac4f50ee","sha512":"3471c2e3c1ad204dd512d30cbb94235c60b079151d6b333e754ad34fa916c718856cdab48ed3ec49f5bfda288db81736357567a2c656eacf050443e44e4a2ab7","ssdeep":"3:a+JraNvsgzsVqSwHqDY1RgJz:tJuOgzsk5gJz","tlsh":"4bb01200360feb6f512724111075f6641904510a1cd00628515010b4893208402dc154"},"updated":"2026-10-16T19:12:01.066743+00:00"}],"mimetype":"text/plain","permalink":"https://polyswarm.network/scan/results/file/6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4/39027402148512388","polyscore":null,"result":null,"sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","size":93,"state":"SUBMITTED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/16/3c/7e/163c7e58-4656-4362-a3bc-5ac4283eb044?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191200Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=26b7e10592c0bfbc1070cdd1b4576cd752a4c9e43de694f9c83d8f24c7f7db58","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '2934' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:04 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: GET + uri: http://ai:9696/v3/consumer/submission/gamma/39027402148512388 + response: + body: + string: '{"result":{"artifact_id":"39027402148512388","assertions":[{"author":"917202772827143","author_name":"engine-eicar","bid":"1000000000000000000","engine":{"description":"webhook-microengine-description","name":"engine-eicar"},"mask":true,"metadata":{"malware_family":"EICAR","product":"eicar","scanner":{"environment":{"architecture":"x86_64","operating_system":"Linux"}}},"verdict":true}],"bounty_state":2,"community":"gamma","country":"","created":"2026-10-16T19:12:00.979459+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":"EICAR + virus test files","failed":false,"filename":"artifact","first_seen":"2026-10-16T19:00:49.830485+00:00","id":"39027402148512388","known_good":null,"last_scanned":null,"last_seen":null,"md5":"41e0052928de2071fbd1ba679a270cd6","metadata":[{"created":"2026-10-16T19:12:01.115418+00:00","tool":"exiftool","tool_metadata":{"directory":"/tmp","exiftoolversion":12.76,"fileaccessdate":"2026:10:16 + 19:12:01+00:00","fileinodechangedate":"2026:10:16 19:12:01+00:00","filemodifydate":"2026:10:16 + 19:12:01+00:00","filename":"tmp9iq2nb1e","filepermissions":"-rw-r--r--","filesize":"93 + bytes","filetype":"TXT","filetypeextension":"txt","linecount":2,"mimeencoding":"us-ascii","mimetype":"text/plain","newlines":"Unix + LF","sourcefile":"/tmp/tmp9iq2nb1e","wordcount":2},"updated":"2026-10-16T19:12:01.115418+00:00"},{"created":"2026-10-16T19:12:01.066743+00:00","tool":"hash","tool_metadata":{"md5":"41e0052928de2071fbd1ba679a270cd6","sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","sha3_256":"62df3d6496ebbfc23e53ba86037a49890bf1047d9282c355ac0d213df694d5b3","sha3_512":"9ee53d77492d6e3f5a55e666fc6e0dc477f6104edbe7bd9a3968149446c128d180efb55f3f87b486726a5eb58626325ce0428b86793446d53aebccbeac4f50ee","sha512":"3471c2e3c1ad204dd512d30cbb94235c60b079151d6b333e754ad34fa916c718856cdab48ed3ec49f5bfda288db81736357567a2c656eacf050443e44e4a2ab7","ssdeep":"3:a+JraNvsgzsVqSwHqDY1RgJz:tJuOgzsk5gJz","tlsh":"4bb01200360feb6f512724111075f6641904510a1cd00628515010b4893208402dc154"},"updated":"2026-10-16T19:12:01.066743+00:00"}],"mimetype":"text/plain","permalink":"https://polyswarm.network/scan/results/file/6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4/39027402148512388","polyscore":null,"result":null,"sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","size":93,"state":"SUBMITTED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/16/3c/7e/163c7e58-4656-4362-a3bc-5ac4283eb044?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191200Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=26b7e10592c0bfbc1070cdd1b4576cd752a4c9e43de694f9c83d8f24c7f7db58","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '2934' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:05 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: GET + uri: http://ai:9696/v3/consumer/submission/gamma/39027402148512388 + response: + body: + string: '{"result":{"artifact_id":"39027402148512388","assertions":[{"author":"917202772827143","author_name":"engine-eicar","bid":"1000000000000000000","engine":{"description":"webhook-microengine-description","name":"engine-eicar"},"mask":true,"metadata":{"malware_family":"EICAR","product":"eicar","scanner":{"environment":{"architecture":"x86_64","operating_system":"Linux"}}},"verdict":true}],"bounty_state":2,"community":"gamma","country":"","created":"2026-10-16T19:12:00.979459+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":"EICAR + virus test files","failed":false,"filename":"artifact","first_seen":"2026-10-16T19:00:49.830485+00:00","id":"39027402148512388","known_good":null,"last_scanned":null,"last_seen":null,"md5":"41e0052928de2071fbd1ba679a270cd6","metadata":[{"created":"2026-10-16T19:12:01.115418+00:00","tool":"exiftool","tool_metadata":{"directory":"/tmp","exiftoolversion":12.76,"fileaccessdate":"2026:10:16 + 19:12:01+00:00","fileinodechangedate":"2026:10:16 19:12:01+00:00","filemodifydate":"2026:10:16 + 19:12:01+00:00","filename":"tmp9iq2nb1e","filepermissions":"-rw-r--r--","filesize":"93 + bytes","filetype":"TXT","filetypeextension":"txt","linecount":2,"mimeencoding":"us-ascii","mimetype":"text/plain","newlines":"Unix + LF","sourcefile":"/tmp/tmp9iq2nb1e","wordcount":2},"updated":"2026-10-16T19:12:01.115418+00:00"},{"created":"2026-10-16T19:12:01.066743+00:00","tool":"hash","tool_metadata":{"md5":"41e0052928de2071fbd1ba679a270cd6","sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","sha3_256":"62df3d6496ebbfc23e53ba86037a49890bf1047d9282c355ac0d213df694d5b3","sha3_512":"9ee53d77492d6e3f5a55e666fc6e0dc477f6104edbe7bd9a3968149446c128d180efb55f3f87b486726a5eb58626325ce0428b86793446d53aebccbeac4f50ee","sha512":"3471c2e3c1ad204dd512d30cbb94235c60b079151d6b333e754ad34fa916c718856cdab48ed3ec49f5bfda288db81736357567a2c656eacf050443e44e4a2ab7","ssdeep":"3:a+JraNvsgzsVqSwHqDY1RgJz:tJuOgzsk5gJz","tlsh":"4bb01200360feb6f512724111075f6641904510a1cd00628515010b4893208402dc154"},"updated":"2026-10-16T19:12:01.066743+00:00"}],"mimetype":"text/plain","permalink":"https://polyswarm.network/scan/results/file/6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4/39027402148512388","polyscore":null,"result":null,"sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","size":93,"state":"SUBMITTED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/16/3c/7e/163c7e58-4656-4362-a3bc-5ac4283eb044?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191200Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=26b7e10592c0bfbc1070cdd1b4576cd752a4c9e43de694f9c83d8f24c7f7db58","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '2934' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:06 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: GET + uri: http://ai:9696/v3/consumer/submission/gamma/39027402148512388 + response: + body: + string: '{"result":{"artifact_id":"39027402148512388","assertions":[{"author":"917202772827143","author_name":"engine-eicar","bid":"1000000000000000000","engine":{"description":"webhook-microengine-description","name":"engine-eicar"},"mask":true,"metadata":{"malware_family":"EICAR","product":"eicar","scanner":{"environment":{"architecture":"x86_64","operating_system":"Linux"}}},"verdict":true}],"bounty_state":2,"community":"gamma","country":"","created":"2026-10-16T19:12:00.979459+00:00","detections":null,"expiration_window":null,"expire_at":null,"extended_type":"EICAR + virus test files","failed":false,"filename":"artifact","first_seen":"2026-10-16T19:00:49.830485+00:00","id":"39027402148512388","known_good":null,"last_scanned":null,"last_seen":null,"md5":"41e0052928de2071fbd1ba679a270cd6","metadata":[{"created":"2026-10-16T19:12:01.115418+00:00","tool":"exiftool","tool_metadata":{"directory":"/tmp","exiftoolversion":12.76,"fileaccessdate":"2026:10:16 + 19:12:01+00:00","fileinodechangedate":"2026:10:16 19:12:01+00:00","filemodifydate":"2026:10:16 + 19:12:01+00:00","filename":"tmp9iq2nb1e","filepermissions":"-rw-r--r--","filesize":"93 + bytes","filetype":"TXT","filetypeextension":"txt","linecount":2,"mimeencoding":"us-ascii","mimetype":"text/plain","newlines":"Unix + LF","sourcefile":"/tmp/tmp9iq2nb1e","wordcount":2},"updated":"2026-10-16T19:12:01.115418+00:00"},{"created":"2026-10-16T19:12:01.066743+00:00","tool":"hash","tool_metadata":{"md5":"41e0052928de2071fbd1ba679a270cd6","sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","sha3_256":"62df3d6496ebbfc23e53ba86037a49890bf1047d9282c355ac0d213df694d5b3","sha3_512":"9ee53d77492d6e3f5a55e666fc6e0dc477f6104edbe7bd9a3968149446c128d180efb55f3f87b486726a5eb58626325ce0428b86793446d53aebccbeac4f50ee","sha512":"3471c2e3c1ad204dd512d30cbb94235c60b079151d6b333e754ad34fa916c718856cdab48ed3ec49f5bfda288db81736357567a2c656eacf050443e44e4a2ab7","ssdeep":"3:a+JraNvsgzsVqSwHqDY1RgJz:tJuOgzsk5gJz","tlsh":"4bb01200360feb6f512724111075f6641904510a1cd00628515010b4893208402dc154"},"updated":"2026-10-16T19:12:01.066743+00:00"}],"mimetype":"text/plain","permalink":"https://polyswarm.network/scan/results/file/6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4/39027402148512388","polyscore":null,"result":null,"sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","size":93,"state":"SUBMITTED","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/16/3c/7e/163c7e58-4656-4362-a3bc-5ac4283eb044?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191200Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=26b7e10592c0bfbc1070cdd1b4576cd752a4c9e43de694f9c83d8f24c7f7db58","votes":[],"window_closed":false},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '2934' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:07 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: GET + uri: http://ai:9696/v3/consumer/submission/gamma/39027402148512388 + response: + body: + string: '{"result":{"artifact_id":"39027402148512388","assertions":[{"author":"917202772827143","author_name":"engine-eicar","bid":"1000000000000000000","engine":{"description":"webhook-microengine-description","name":"engine-eicar"},"mask":true,"metadata":{"malware_family":"EICAR","product":"eicar","scanner":{"environment":{"architecture":"x86_64","operating_system":"Linux"}}},"verdict":true}],"bounty_state":3,"community":"gamma","country":"","created":"2026-10-16T19:12:00.979459+00:00","detections":{"benign":0,"malicious":1,"total":1},"expiration_window":null,"expire_at":null,"extended_type":"EICAR + virus test files","failed":false,"filename":"artifact","first_seen":"2026-10-16T19:00:49.830485+00:00","id":"39027402148512388","known_good":null,"last_scanned":"2026-10-16T19:12:00.979459+00:00","last_seen":"2026-10-16T19:12:00.979459+00:00","md5":"41e0052928de2071fbd1ba679a270cd6","metadata":[{"created":"2026-10-16T19:12:08.073833+00:00","tool":"polyunite","tool_metadata":{"labels":["nonmalware"],"malware_family":"EICAR","operating_system":[]},"updated":"2026-10-16T19:12:08.073833+00:00"},{"created":"2026-10-16T19:12:01.115418+00:00","tool":"exiftool","tool_metadata":{"directory":"/tmp","exiftoolversion":12.76,"fileaccessdate":"2026:10:16 + 19:12:01+00:00","fileinodechangedate":"2026:10:16 19:12:01+00:00","filemodifydate":"2026:10:16 + 19:12:01+00:00","filename":"tmp9iq2nb1e","filepermissions":"-rw-r--r--","filesize":"93 + bytes","filetype":"TXT","filetypeextension":"txt","linecount":2,"mimeencoding":"us-ascii","mimetype":"text/plain","newlines":"Unix + LF","sourcefile":"/tmp/tmp9iq2nb1e","wordcount":2},"updated":"2026-10-16T19:12:01.115418+00:00"},{"created":"2026-10-16T19:12:01.066743+00:00","tool":"hash","tool_metadata":{"md5":"41e0052928de2071fbd1ba679a270cd6","sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","sha3_256":"62df3d6496ebbfc23e53ba86037a49890bf1047d9282c355ac0d213df694d5b3","sha3_512":"9ee53d77492d6e3f5a55e666fc6e0dc477f6104edbe7bd9a3968149446c128d180efb55f3f87b486726a5eb58626325ce0428b86793446d53aebccbeac4f50ee","sha512":"3471c2e3c1ad204dd512d30cbb94235c60b079151d6b333e754ad34fa916c718856cdab48ed3ec49f5bfda288db81736357567a2c656eacf050443e44e4a2ab7","ssdeep":"3:a+JraNvsgzsVqSwHqDY1RgJz:tJuOgzsk5gJz","tlsh":"4bb01200360feb6f512724111075f6641904510a1cd00628515010b4893208402dc154"},"updated":"2026-10-16T19:12:01.066743+00:00"}],"mimetype":"text/plain","permalink":"https://polyswarm.network/scan/results/file/6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4/39027402148512388","polyscore":null,"result":null,"sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","size":93,"state":"AWAITING_ARBITRATION","type":"FILE","upload_url":"http://minio:9000/artifact-index/instances/16/3c/7e/163c7e58-4656-4362-a3bc-5ac4283eb044?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T191200Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=26b7e10592c0bfbc1070cdd1b4576cd752a4c9e43de694f9c83d8f24c7f7db58","votes":[],"window_closed":true},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '3236' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:08 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '{"query":{"term":{"artifact.sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4"}},"aggs":{"extensions":{"terms":{"field":"extension","size":5}}},"size":1}' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + content-length: + - '177' + content-type: + - application/json + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: POST + uri: http://ai:9696/v3/search/metadata/raw?community=gamma + response: + body: + string: '{"result":{"aggregations":{"extensions":{"buckets":[{"doc_count":1,"key":"txt"}],"doc_count_error_upper_bound":0,"sum_other_doc_count":0}},"hits":{"hits":[{"_id":"48910585090325105","_index":"metadata-2963","_score":0.8938179,"_source":{"artifact":{"created":"2026-10-16T19:00:49.830485+00:00","id":"48910585090325105","md5":"41e0052928de2071fbd1ba679a270cd6","sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","size":93},"exiftool":{"filesize":"93 + bytes","filetype":"TXT","filetypeextension":"txt","mimetype":"text/plain"},"extension":"txt","hash":{"md5":"41e0052928de2071fbd1ba679a270cd6","sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","sha3_256":"62df3d6496ebbfc23e53ba86037a49890bf1047d9282c355ac0d213df694d5b3","sha3_512":"9ee53d77492d6e3f5a55e666fc6e0dc477f6104edbe7bd9a3968149446c128d180efb55f3f87b486726a5eb58626325ce0428b86793446d53aebccbeac4f50ee","sha512":"3471c2e3c1ad204dd512d30cbb94235c60b079151d6b333e754ad34fa916c718856cdab48ed3ec49f5bfda288db81736357567a2c656eacf050443e44e4a2ab7","ssdeep":"3:a+JraNvsgzsVqSwHqDY1RgJz:tJuOgzsk5gJz","tlsh":"4bb01200360feb6f512724111075f6641904510a1cd00628515010b4893208402dc154"},"meta_community":"_public","modified":"2026-10-16T19:11:03.128969+00:00","polyunite":{"labels":["nonmalware"],"malware_family":"EICAR"},"scan":{"detections":{"benign":0,"malicious":1,"total":1},"filename":["artifact"],"first_scan":{"artifact_instance_id":"31484117870144315","assertions":{"engine-eicar":{"assertion":"malicious","metadata":{"malware_family":"EICAR"}}},"created":"2026-10-16T19:00:49.830485+00:00","detections":{"benign":0,"malicious":1,"total":1},"filename":"artifact","votes":{}},"first_seen":"2026-10-16T19:00:49.830485+00:00","last_seen":"2026-10-16T19:10:56.036870+00:00","latest_scan":{"artifact_instance_id":"45873202982231538","assertions":{"engine-eicar":{"assertion":"malicious","metadata":{"malware_family":"EICAR"}}},"created":"2026-10-16T19:10:56.036870+00:00","detections":{"benign":0,"malicious":1,"total":1},"filename":"artifact","votes":{}},"mimetype":{"extended":"EICAR + virus test files","mime":"text/plain"}},"updated":{"exiftool":"2026-10-16T19:10:56.167945+00:00","hash":"2026-10-16T19:10:56.114851+00:00","polyunite":"2026-10-16T19:11:03.128969+00:00"}}}],"max_score":0.8938179,"total":{"relation":"eq","value":1}}},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '2453' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:08 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +- request: + body: '{"query":{"term":{"artifact.sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4"}},"aggs":{"extensions":{"terms":{"field":"extension","size":5}}},"size":1}' + headers: + accept: + - '*/*' + accept-encoding: + - gzip, deflate + authorization: + - '11111111111111111111111111111111' + connection: + - keep-alive + content-length: + - '177' + content-type: + - application/json + host: + - ai:9696 + user-agent: + - polyswarm_api/4.7.0 (x86_64-Linux-CPython-3.12.13) + method: POST + uri: http://ai:9696/v3/search/metadata/raw?community=gamma + response: + body: + string: '{"result":{"aggregations":{"extensions":{"buckets":[{"doc_count":1,"key":"txt"}],"doc_count_error_upper_bound":0,"sum_other_doc_count":0}},"hits":{"hits":[{"_id":"48910585090325105","_index":"metadata-2963","_score":0.8938179,"_source":{"artifact":{"created":"2026-10-16T19:00:49.830485+00:00","id":"48910585090325105","md5":"41e0052928de2071fbd1ba679a270cd6","sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","size":93},"exiftool":{"filesize":"93 + bytes","filetype":"TXT","filetypeextension":"txt","mimetype":"text/plain"},"extension":"txt","hash":{"md5":"41e0052928de2071fbd1ba679a270cd6","sha1":"13aa5ea0daab56572ca33eabb896559f5f69f865","sha256":"6955694202ef2ae2a29ba488473e5a78032024cd2213d250db7ef6f6736495e4","sha3_256":"62df3d6496ebbfc23e53ba86037a49890bf1047d9282c355ac0d213df694d5b3","sha3_512":"9ee53d77492d6e3f5a55e666fc6e0dc477f6104edbe7bd9a3968149446c128d180efb55f3f87b486726a5eb58626325ce0428b86793446d53aebccbeac4f50ee","sha512":"3471c2e3c1ad204dd512d30cbb94235c60b079151d6b333e754ad34fa916c718856cdab48ed3ec49f5bfda288db81736357567a2c656eacf050443e44e4a2ab7","ssdeep":"3:a+JraNvsgzsVqSwHqDY1RgJz:tJuOgzsk5gJz","tlsh":"4bb01200360feb6f512724111075f6641904510a1cd00628515010b4893208402dc154"},"meta_community":"_public","modified":"2026-10-16T19:11:03.128969+00:00","polyunite":{"labels":["nonmalware"],"malware_family":"EICAR"},"scan":{"detections":{"benign":0,"malicious":1,"total":1},"filename":["artifact"],"first_scan":{"artifact_instance_id":"31484117870144315","assertions":{"engine-eicar":{"assertion":"malicious","metadata":{"malware_family":"EICAR"}}},"created":"2026-10-16T19:00:49.830485+00:00","detections":{"benign":0,"malicious":1,"total":1},"filename":"artifact","votes":{}},"first_seen":"2026-10-16T19:00:49.830485+00:00","last_seen":"2026-10-16T19:10:56.036870+00:00","latest_scan":{"artifact_instance_id":"45873202982231538","assertions":{"engine-eicar":{"assertion":"malicious","metadata":{"malware_family":"EICAR"}}},"created":"2026-10-16T19:10:56.036870+00:00","detections":{"benign":0,"malicious":1,"total":1},"filename":"artifact","votes":{}},"mimetype":{"extended":"EICAR + virus test files","mime":"text/plain"}},"updated":{"exiftool":"2026-10-16T19:10:56.167945+00:00","hash":"2026-10-16T19:10:56.114851+00:00","polyunite":"2026-10-16T19:11:03.128969+00:00"}}}],"max_score":0.8938179,"total":{"relation":"eq","value":1}}},"status":"OK"} + + ' + headers: + Access-Control-Allow-Origin: + - '*' + Access-Control-Expose-Headers: + - Authorization + Connection: + - keep-alive + Content-Length: + - '2453' + Content-Type: + - application/json + Date: + - Fri, 16 Oct 2026 19:12:08 GMT + Server: + - gunicorn + X-Billing-ID: + - '111' + status: + code: 200 + message: OK +version: 1