Voltz bronze

Detonate a file

Run a file in an instrumented VM and report what it did. Returns a task you can poll or subscribe to; a full run takes minutes. The result carries a verdict with the evidence behind it, not a score alone. An ARCHIVE is not a program: send one and the task pauses at input-required with the file tree inside it, a recommended entry, and a note on any entry that would start nothing. Answer with the entries to run, in a message whose taskId names the task. An encrypted archive pauses at auth-required for its password. HOW a file is started can be set with the tech.foresee-security.voltz/launch_options metadata key on the message carrying it: {"exe":{"args":"--install /silent"}} for an executable, {"dll":{"export":"Run","args":"..."}} for a library. Omit it and the sandbox chooses, which is right for almost every sample; for a library that means reading its export table. On an archive, send it per entry id in the answering message's data part instead. The file travels INLINE, base64 in a file part, and may be as la

• Detonate this attachment and report its verdict.

Ask about a completed run

Answer a question about an analysis that has already finished, using its report, its ATT&CK matches, its decoded network activity, its YARA hits and the files it dropped. Name the task in referenceTaskIds, ONE per message; this reads a single analysis and refuses a message naming several rather than answering about one of them. Use it rather than reading the raw report yourself when the question is interpretive: 'why was this classed malicious', 'what would this have done on a domain-joined host'.

• Why was this classed malicious?
• What persistence did it establish?

Query a run's raw telemetry

Ask a question answered from one run's complete per-event trace: every process, file, registry and network event the sandbox recorded. For questions the fixed report sections cannot express: aggregations, time windows, joins, distributions. Say what you want counted, in a text part, and name the run in referenceTaskIds; the SQL is written and run on this side, against a read-only replica, and the answer states what it found. A result over 5000 rows is refused rather than truncated, so aggregate rather than listing.

• Which process wrote the most files in the first 30 seconds?

Get indicators of compromise

Return the domains, addresses and URLs a run actually contacted. Everything in this block was MEASURED from the capture: the sandbox's own endpoints and private ranges are excluded, and indicators asserted by a model rather than observed are deliberately not promoted into it.

• Give me the network indicators for this submission.

Look up a sample by hash

Report whether this deployment has analysed a SHA-256 before, and what it concluded. Answers from its own prior runs. Cheap: ask before detonating, since a file already analysed needs no second run.

• Have you seen 2eea097e689004e05f44f04ff22909c96d43d04fa7e5936f3709cf0d3a36c041 before?

What this deployment can analyse

Report the platforms, operating systems and base images available to run against, which of them currently have capacity, how many machines are warm and can start an analysis within seconds, and the calling organization's quota: its allowance for the current metering window, what is left of it, its per-sample size cap, and how many of its analyses are already queued or running. Ask this before planning a batch: it is what says whether the batch will be accepted, what it may target, and how quickly it will begin.