InspectedFile
Basic information about an inspected file. Full details can be obtained from InspectedFileDetails.
{
"sha256": "string",
"sha1": "string",
"md5": "string",
"file_size": 0,
"last_inspected": 0,
"inspection_status": "string",
"threat_score": 0,
"verdict": "string",
"error_message": "string",
"error_code": "string",
"allow_listed": {
"last_inspection_setting": false,
"current_setting": false
},
"malware_family": [
"string"
],
"malware_class": [
"string"
],
"is_blocked": false,
"file_type": "string",
"inspections_count": 0
}SHA256 hash of the file.
SHA1 hash of the file.
MD5 hash of the file.
Size of the file in bytes.
Threat score in the range of 0 to 100. A score of 100 is considered high potential threat.
This property describes the behavior of the file at runtime. Meanings are described below BENIGN: This is a benign file with no malicious code TRUSTED: This is a TRUSTED file based on the behaviour of the file HIGHLY_TRUSTED: This is a file from a highly trusted source like for e.g microsft published the file SUSPICIOUS: This file contains suspicious code and on execution can turn out to be malware MALICIOUS: This file is a malicious file containing malware or bad code that can harm the system UNKNOWN: This file is not known and hence its behavior is UNKNOWN at this point in time. UNINSPECTED: This file is marked as allowlisted and hence the verdict is UNINSPECTED.
Error message corresponding to last inspection of this file. This field will be populated only when there is some error in the last inspection.
Error code corresponding to last inspection of this file. This field will be populated only when there is some error in the last inspection.
Conveys user specified allow-list settting for this file at different time instances using /allow-list API.
Family of the malware.
Class of the malware.
Conveys if the file is blocked by malware prevention service.
Type of the file.
Number of times this file is inspected.