Application Programming Interface (API)
The Malware Analyzer G2 (MAG2) provides a powerful API which provides programmatic access to the solution’s functionality and facilitates task automation and integration into a customer’s existing security workflows. The API is the core interface underpinning the MAG2 solution, purpose-built to support numerous workflows and complex business processes.
The MAG2 API is more comprehensive than its UI, as more complex and conditional processing can be accomplished programmatically than can be achieved manually by a user exercising a console. High-volume tasks can be automated through the API and analysis results can be routed to different downstream processes or to different recipients for further action – spanning various departments or skill levels – depending on the analysis outcomes.
The API is RESTful, accessible via the HTTP protocol, and provides programmatic access to nearly every aspect of MAG2. This includes uploading files, creating tasks, and checking queue and disk levels, among others. The API is designed to match the usual malware analysis workflow, making it easy to upload samples, schedule various analysis tasks, check the status, and retrieve analysis results. It is open, versioned, and fully published, complete with examples of common programmatic workflow tasks, while ensuring full backward compatibility even as product capabilities continue to evolve.
Industry standard reports – MAG2 reports are accessible through the API in industry standard JSON format, while binary serialization is implemented using Google protocol buffers, another widely adopted industry standard.
Real-time notification of task state changes – The API supports logic to trigger events based on real-time state changes including when tasks are added to a queue, when they are processed, and when they are completed. Applications include creating dashboard views of local MAG2 status or larger SIEM-style statuses. Notifications can also be used to direct post-processing such as re-running any “dropped files” through the MAG2 analysis after the primary sample has been run.
VirusTotal counts – The MAG2 API can also be used to retrieve VirusTotal counts, along with the specifics concerning which anti-virus vendors have previously detected the sample and how each one has classified it.
PCAPs – MAG2 saves full packet captures (PCAPs) of all network transactions relating to each sample analysis. PCAP inspection can help security analysts to identify malware calls to command and control servers, login credentials or commands used by the malware, URL redirects to malicious websites, subsequent malware downloads, and data that has been exfiltrated from a victimized organization. PCAPS can also be post-processed through traditional IDS systems to add a layer of context.
Native resources – Accessible through the API are task resources including PCAPs, dropped files, screen shots, and any content that a plugin is designed to save.
