Get the List of Top Malwares

This URL retrieves the list of top malwares.

Resource URL

GET /domain/<domain_id>/threatexplorer/alerts/TopN/<count>/direction/<direction>/duration/<duration>/malware?includeChildDomain=<includeChildDomain>&&action=<action>&&value=<value>

Request Parameters

URL Parameters:

Field Name	Description	Data Type	Mandatory
`domainId`	Domain id	Number	Yes
`count`	Number of top attacks to display. Values allowed are: 5,10,15,20 or 25	Boolean	No
`direction`	Direction of the attack. Values allowed are: ANY, INBOUND & OUTBOUND	String	No
`duration`	Duration can be: LAST_5_MINUTES LAST_1_HOUR LAST_6_HOURS LAST_12_HOURS LAST_24_HOURS LAST_48_HOURS LAST_7_DAYS LAST_14_DAYS	String	Yes
`includeChildDomain`	Include the child domains. Default is true	Boolean	No
`action`	Should the data be filtered or grouped. Values allowed are: Group(default) Filter	String	No
`value`	If action is group, the values allowed are: fileHash (default) malwareConfidence fileSize If the action is filter, we can give multiple filters separated by ":::". The format of value will be <filter_name1>=<filter_value>::: <filter_name2>=<filter_value> . The filter_name's and filter_values allowed are: attack -> value should be a valid attack name. severity -> value can be High, Low, Medium & Informational (all are case sensitive). category -> value should be a valid category. subCategory -> value should be a valid sub category. attackerIp -> value should be a valid IP. dnsName -> value should be a string. country -> value should be a valid country name. user -> value should be a valid user name/unknown. victimIp -> value should be a valid IP. victimDnsName -> value should be a string. victimCountry -> value should be a valid country name. victimUser -> value should be a valid user name/unknown. applicationName -> value should be a valid application name. applicationRisk -> value can be high, low & medium. applicationCategory -> value should be a valid application category. fileHash -> value should be a string. executableHash -> value should be a string. malwareConfidence -> value should be a valid malware confidence. fileSize -> value should be a number. executableConfidence -> value can be clean, high, low, medium, unknown, veryhigh & verylow. executableClassification -> value can be block, none, unclassified, and allow. executableName	String	No

Response Parameters

Following fields are returned.

Field Name	Description	Data Type
`TETopMalware`	List of top malwares. It contains TE top malware downloads list.	Object

Details of fields in TETopMalwareDownloadsList:

Field Name	Description	Data Type
`malwareFileHash`	Malware hash value	String
`malwareConfidence`	Confidence level of malware	String
`malwareFileSizeInBytes`	Size of malware file	String
`attackCount`	Numbers of the attack	Number

Example

Request

GET https://<NSM_IP>/sdkapi/domain/0/threatexplorer/alerts/TopN/10/direction/ANY/duration/LAST_12_HOURS/malware?action=filter&&value=malwareConfidence=Very High:::country=Thailand

Response

    {
       "TETopMalwareDownloadsList":
       [
           {
               "malwareFileHash": "f70664bb0d45665e79ba9113c5e4d0f4",
               "malwareConfidence": "Very High",
               "malwareFileSizeInBytes": "314445",
               "attackCount": 4
           }
       ]
    }

Error Information

Following error codes are returned by this URL:

No	HTTP Error Code	SDK API errorId	SDK API errorMessage
1	404	1105	Invalid domain
2	400	3707	Top count should be 5,10,15,20 or 25
3	400	3702	Invalid action
4	400	3701	Invalid "GroupBy" string specified
5	400	3704	Invalid filters specified
6	400	3703	Invalid direction
7	400	3601	Invalid duration