topic Re: Query API with Feature extraction sends response with extract_result CP_EXTRACT_RESULT_NOT_SCRUB in API / CLI Discussion

Query API with Feature extraction sends response with extract_result CP_EXTRACT_RESULT_NOT_SCRUBBED

snagadiya — Thu, 30 Jan 2020 14:42:50 GMT

Hi Experts,

I am always getting extract result "CP_EXTRACT_RESULT_NOT_SCRUBBED" from query api. Please find my request below.

Request#1

Upload API request:

{\"request\":{\"file_name\":\"DOCX.docx\",\"file_type\": \"docx\",\"features\":[\"extraction\"],\"extraction\":{\"method\":\"clean\"}}}

Upload API Response:

{

"response": {

"status": {

"code": 1002,

"label": "UPLOAD_SUCCESS",

"message": "The file was uploaded successfully."

"sha1": "8064ff3d851f273df43376cfcb9c2ebd47131c8b",

"md5": "f78a90963ca8a382da6611eb5cdbe2e3",

"sha256": "056c1f0d31faa557cdac687b0fcc5103cc4aa0dbf8027499303e182754c981b8",

"file_type": "docx",

"file_name": "DOCX.docx",

"features": [

"extraction"

"extraction": {

"method": "clean",

"tex_product": false,

"status": {

"code": 1002,

"label": "UPLOAD_SUCCESS",

"message": "The file was uploaded successfully."

}

Request#2

Query API Request:

{
"request": [
{
"sha1": "8064ff3d851f273df43376cfcb9c2ebd47131c8b",
"file_name": "DOCX.docx",
"file_type": "docx",
"features": ["extraction"],
"extraction": {"method": "clean"}
}
]
}

Query API Response:

{

"response": [

{

"status": {

"code": 1001,

"label": "FOUND",

"message": "The request has been fully answered."

"sha1": "8064ff3d851f273df43376cfcb9c2ebd47131c8b",

"file_type": "docx",

"file_name": "DOCX.docx",

"features": [

"extraction"

"extraction": {

"method": "clean",

"extract_result": "CP_EXTRACT_RESULT_NOT_SCRUBBED",

"output_file_name": "DOCX.docx",

"extraction_data": {

"input_extension": "docx",

"input_real_extension": "docx",

"message": "Skipped",

"output_file_name": "",

"protection_name": "Potential malicious content extracted",

"protection_type": "Content Removal",

"protocol_version": "1.0",

"risk": 0.0,

"scrub_activity": "The file doesn't include cleanable parts",

"scrub_method": "Clean Document",

"scrub_result": 4.0,

"scrub_time": "0.04",

"scrubbed_content": ""

"tex_product": false,

"status": {

"code": 1001,

"label": "FOUND",

"message": "The request has been fully answered."

}

]

}

Can someone please help me what mistake am I doing here ? why query api response is not sending download file id ?

Re: Query API with Feature extraction sends response with extract_result CP_EXTRACT_RESULT_NOT_SCRUB

PhoneBoy — Sat, 01 Feb 2020 00:14:29 GMT

The reason it's not providing a fileid is most likely because the response is "The file doesn't include cleanable parts."
Which would suggest the file you provided doesn't need to be cleaned at all.

Re: Query API with Feature extraction sends response with extract_result CP_EXTRACT_RESULT_NOT_SCRUB

snagadiya — Mon, 03 Feb 2020 10:14:45 GMT

Hi,

Shall I consider that extract_result "CP_EXTRACT_RESULT_NOT_SCRUBBED" is success without fileid ?

In my case, we need to send file to check point api and download clean file from check point. So, if query API response is "CP_EXTRACT_RESULT_NOT_SCRUBBED" then I can use original file as clean file. Is my understanding correct ?

Re: Query API with Feature extraction sends response with extract_result CP_EXTRACT_RESULT_NOT_SCRUB

PhoneBoy — Mon, 03 Feb 2020 17:03:37 GMT

At least that's how I understand it.

Re: Query API with Feature extraction sends response with extract_result CP_EXTRACT_RESULT_NOT_SCRUB

snagadiya — Thu, 06 Feb 2020 04:29:48 GMT

Hi, For some of DOCX files, I am getting "CP_EXTRACT_RESULT_UNSUPPORTED_FILE" status in query response. What are the files type which are not supported for extraction method clean ? It would be more helpful if you can give me details or document which says about each extract_result in detail. Thanks in advance.

Re: Query API with Feature extraction sends response with extract_result CP_EXTRACT_RESULT_NOT_SCRUB

PhoneBoy — Wed, 12 Feb 2020 00:41:40 GMT

Not aware of any specific limitations with respect to DOCX files.
Only limit I am aware of is size-related.
I believe it's 15mb by default, can be configured to 100mb max.
A sample file that's giving this error might be helpful.

Re: Query API with Feature extraction sends response with extract_result CP_EXTRACT_RESULT_NOT_SCRUB

snagadiya — Sat, 15 Feb 2020 06:31:11 GMT

Hi,

Please find file in attachment.

Re: Query API with Feature extraction sends response with extract_result CP_EXTRACT_RESULT_NOT_SCRUB

PhoneBoy — Sun, 16 Feb 2020 01:31:51 GMT

I uploaded the file here and emulated it: https://threatpoint.checkpoint.com/ThreatPortal/emulation
Seems to be a clean file with noting potentially malicious to extract from it.
Which suggests, for that file, the response you got from the API was correct.

When I upload a different file to the above site, I eventually get a link to download the scrubbed file.
Which suggests that if you try a different more complex file (I used a PPT in my test), you might get a different result than with that more simple file.

Re: Query API with Feature extraction sends response with extract_result CP_EXTRACT_RESULT_NOT_SCRUB

snagadiya — Sun, 16 Feb 2020 06:54:36 GMT

Thank you. @PhoneBoy

So, we will consider CP_EXTRACT_RESULT_NOT_SCRUBBED as positive result with no need to download and continue to use original file only.