Uploading YARA file

Kaspersky Research Sandbox provides an API to upload the YARA file for the specified task.

Kaspersky Research Sandbox only supports YARA rule modules that are involved in static analysis of a file and its contents. It does not support behavioral characteristics. Specifically, the cuckoo and console modules are not supported.

The specified task may have already been completed. In this case, upon successful uploading or replacement of the YARA file, scanning (in line with YARA rules) of the uploaded file begins automatically.

Request

Request method: POST

Endpoint: https://<server name>/api/v1/sandbox/tasks/<task ID>/yara?file_name=<YARA file name>

Parameters

Uploading the YARA file parameters

Parameter

Data type

Occurrence

Description

task_id

string

Required

Object execution task ID (GUID).

file_name

string

Required

YARA file name.

cURL command sample:

$ curl --http1.1 --user <user name> --request POST --header "Content-Type:application/octet-stream" --data-binary '@<path to file>' 'https://<server name>/api/v1/sandbox/tasks/<task ID>/yara?file_name=<YARA file name>'

You will be asked to enter your password. The password is not displayed while you type it.

Responses

Endpoint uploads the YARA file.

200 OK

YARA file uploaded successfully.

200 OK response parameters

Parameter

Data type

Description

id

string

ID (GUID) of the newly created task.

200 OK response example:

{

"id": "5cf8cbb4-1d50-492c-986b-86d5c7596535"

}

400 Bad Request

Failed to upload the YARA file.

400 Bad Request response parameters

Parameter

Data type

Description

code

string

Error ID.

message

string

Description of the error.

meta

string

Additional information, if available.

Error examples:

Incorrect task_id parameter:

{"code":6,"message":"task not found"}

Incorrect task_id parameter format:

{"code":29,"message":"bad task id"}

Incorrect file_name parameter:

{"code":68,"message":"filename malformed"}

401 Unauthorized

Failed to upload the YARA file due to incorrect user credentials.

412 Precondition Failed

Failed to upload the YARA file as the task is still in progress. Wait for the task to complete and try again later.

500 Internal Server Error

Failed to upload the YARA file due to an internal server error.

Page top