topic Advisories Result Blob in API / CLI Discussion

Advisories Result Blob

Ahmet_Sezgin_Du — Wed, 20 Jun 2018 14:21:30 GMT

Hello,

I'm using Threat Prevention API. I followed the API documentation which is shared here.

On the page 18, where Threat Emulation XML report structure is explained, there's a field called More which holds some Base64 like encoded data. It says that it is "Advisories result blob", yet I don't know how to decode it. It really looks like Base64 encoded, but I didn't get any meaningful data by decoding it.

How can I decode it? Any ideas?

Thanks.

Re: Advisories Result Blob

PhoneBoy — Wed, 20 Jun 2018 22:53:52 GMT

Moving this to the SandBlast API section.

I'll see if I can get some insight from the relevant parties in R&D.

Re: Advisories Result Blob

Gil_Geron — Thu, 21 Jun 2018 11:52:45 GMT

Hi,

The "more" section in the XML is used for internal engine data. some of the data is used for debugging, statistics, logs and other details on the internal engine operation. It is not decrypt-able on purpose since it does not hold data that represent the detonation of the file.

Regards,

Gil

Re: Advisories Result Blob

Ahmet_Sezgin_Du — Thu, 21 Jun 2018 12:14:01 GMT

Thanks for clarifying.