Check files for malware: via API from your own systems
The SecTepe Malware Sandbox has its own REST API. Your systems use it to send suspicious files for a check. The verdict comes back on its own. For email and endpoints, there are ready-made connectors.
Request a demoHow to submit a file
A REST API is an interface that lets programs talk to each other. Every call carries an API key. Without a valid key, the sandbox accepts nothing. Submission takes two steps.
Step 1: register the file
Your system sends the file's name, size and SHA-256 hash. The hash is a unique fingerprint. If you like, you can choose the guest system, Windows or Linux. The sandbox replies with a job ID.
Step 2: upload the file
Next, your system uploads the file to that job ID. Now the analysis starts. It takes about 10 to 15 minutes.
Step 3: fetch the result
With the job ID you check the status, and later the report and screenshots. You can also get the verdict straight from the hash. An upload portal, for example, can check if a file is already known.
Ready-made connectors
Mail Security Gateway
The Mail Security Gateway sends suspicious attachments to the sandbox by itself. If the verdict comes in after delivery, it pulls the mail back from every mailbox.
EDR agent on Windows and Linux
The SecTepe EDR agent submits unknown programs. This is opt-in. It only sends executable files up to 32 MB, and each hash only once in 24 hours. The verdict then applies to that hash. In "enforce" mode, the agent blocks the next start of a malicious file.
Pre-check: only files with active content
Every run takes time, because the guest starts from scratch. So a static pre-check looks at mail attachments before they go to the sandbox. Static means it reads the file without running it.
- Always: programs, scripts, shortcuts, macro files and disk images.
- PDF: only with active content, such as JavaScript, embedded files or forms that send data.
- Office: only with macros, embedded objects or external templates.
- ZIP: the pre-check looks one level inside.
When in doubt, the file runs. Anything that cannot be read never slips through unchecked. A plain PDF invoice, on the other hand, does not need the sandbox. Links are checked by the URL check in the gateway.
Enrichment and archive
Matching with threat intelligence
Threat intelligence is knowledge about current attacks. The sandbox matches the addresses and hashes it finds against it. Hits name known attacker groups, malware families and techniques.
Archive of detected samples
You can store detected samples in the malware archive of theSecTepe.Core threat intelligence. That way you can find them again later.
To see how the analysis itself works, readVMI analysis and the postsectepe-vmi. For an overview, seeAutomated malware analysis.
FAQ: the malware sandbox API
- Do I need the Mail Security Gateway or the EDR agent?
- No. The REST API is enough. Any system that can hand over files via HTTP can connect. The gateway and the EDR agent are ready-made connectors, not requirements.
- How do I get a verdict without sending the file again?
- Use the SHA-256 hash. It is a unique fingerprint of the file. If the file was analyzed before, the API returns the verdict for that hash.
- Does the EDR agent slow down work on the computer?
- No. The agent only uploads a file after it has made its own decision. A slow sandbox therefore never delays a release. Submission is opt-in.
Let's plan your integration
We show you the API and discuss which of your systems should submit files.
Request a demoHow we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.