/** * File Upload Options */ export interface FileUploadOptions { /** Set to true for private upload (file won't be shared with external services) */ private?: boolean; } /** * File Upload Response */ export interface FileUploadResult { sha256: string; sha1: string; md5: string; uploadType: 'PRIVATE' | 'UPLOAD_PRIVATE_REJECTED_SWITCHED_TO_PUBLIC' | 'PUBLIC'; transactionId: string; requestedPrivate: boolean; } /** * File Download Options */ export interface FileDownloadOptions { /** Password for encrypted download */ password?: string; } /** * File Download Result */ export interface FileDownloadResult { /** File binary content */ data: Buffer; /** File hash used for download */ hash: string; } /** * MITRE ATT&CK Technique */ export interface AttackTechnique { techniqueId: string; techniqueName: string; tactic: string; url: string; } /** * File Report Result */ export interface FileReportResult { /** First seen date */ firstSeen: string; /** Last seen date */ lastSeen: string; /** File hashes */ hash: { sha256: string; md5: string; sha1: string; }; /** File size in bytes */ fileSize: number; /** File type */ fileType: string; /** File tags */ tags: string[]; /** Detection name (malware) or 'normal' */ detect: string; /** File names */ fileNames: string[]; /** SSDeep hash */ ssdeep?: string; /** CVE IDs */ cve: string[]; /** Threat types */ threatTypes: string[]; /** MITRE ATT&CK techniques */ attackTechniques: AttackTechnique[]; } /** * Raw API Response - File Report */ export interface CTXFileReportApiResponse { request: { ctx_api_version: string; request_time: string; request_parameter: string; ctx_transaction_id: string; response_time: string; }; ctx_result: { result_code: number; result_msg: string; }; ctx_data: { first_seen: string; last_seen: string; hash: { sha256: string; md5: string; sha1: string; }; file_size: number; file_type: string; tags: string[]; detect: string; file_names: string[]; ssdeep?: string; cve: string[]; threat_types: string[]; attack_techniques: { technique_id: string; technique_name: string; tactic: string; url: string; }[]; }; } export interface ThreatActor { name: string; aliases: string[]; countryCode: string; } export interface ThreatFamily { name: string; } export interface VictimCountry { country: string; percentage: number; } export interface VictimIndustry { industry: string; percentage: number; } export interface Victims { countries: VictimCountry[]; industries: VictimIndustry[]; } export interface IndicatorFile { hash: { sha256: string; md5: string; sha1: string; }; detect: string; fileSize: number; fileType: string; tags: string[]; firstSeen: string; lastSeen: string; threatTypes: string[]; } export interface IndicatorIP { ipv4: string; detect: string; countryCode: string; firstSeen: string; lastSeen: string; } export interface IndicatorDomain { domain: string; detect: string; firstSeen: string; lastSeen: string; } export interface IndicatorURL { url: string; firstSeen: string; lastSeen: string; } export interface CampaignIndicators { statistics: { files: number; ips: number; domains: number; urls: number; }; files: IndicatorFile[]; ips: IndicatorIP[]; domains: IndicatorDomain[]; urls: IndicatorURL[]; } export interface Campaign { ctxId: string; threatActors: ThreatActor[]; threatFamilies: ThreatFamily[]; timestamp: string; discovered: string; tags: string[]; victims: Victims; indicators: CampaignIndicators; } export interface APTIoCIndicator { files: string[]; domains: string[]; ips: string[]; urls: string[]; } export interface APTCampaignStatistics { campaignCount: number; threatActorCount: number; files: number; ips: number; domains: number; urls: number; campaignCountTotal: number; } export interface ThreatActorWithCampaigns { name: string; aliases: string[]; countryCode: string; campaigns: Campaign[]; } export interface IPReportResult { firstSeen: string; lastSeen: string; ipv4: string; detect: string; countryCode: string; countryName: string; whois: string; reverseDns: string[]; urls: string[]; aptIocIndicator: APTIoCIndicator; aptThreatActors: ThreatActorWithCampaigns[]; aptCampaignStatistics: APTCampaignStatistics; associatedCampaignLink: string; aptCampaigns: Campaign[]; } export interface DomainReportResult { firstSeen: string; lastSeen: string; domain: string; detect: string; whois: string; hostIps: string[]; urls: string[]; aptIocIndicator: APTIoCIndicator; aptThreatActors: ThreatActorWithCampaigns[]; aptCampaignStatistics: APTCampaignStatistics; associatedCampaignLink: string; aptCampaigns: Campaign[]; } export interface SimilarFile { hash: { sha256: string; md5: string; sha1: string; }; fileSize: number; fileType: string; detect: string; } export type FileSimilarityResult = SimilarFile[]; export interface AssociatedFile { hash: { sha256: string; md5: string; sha1: string; }; fileSize: number; fileType: string; detect: string; } export interface AssociatedIP { ipv4: string; firstSeen: string; lastSeen: string; countryCode: string; detect: string; } export interface AssociatedDomain { domain: string; firstSeen: string; lastSeen: string; detect: string; } export interface AssociatedURL { url: string; firstSeen: string; lastSeen: string; } export interface FileAssociatedIoCsResult { droppedFiles: AssociatedFile[]; downloadedFiles: AssociatedFile[]; modifiedFiles: AssociatedFile[]; contactedIPs: AssociatedIP[]; contactedDomains: AssociatedDomain[]; contactedURLs: AssociatedURL[]; } export interface IPAssociatedIoCsResult { communicatingFiles: AssociatedFile[]; downloadedFiles: AssociatedFile[]; } export interface DomainAssociatedIoCsResult { communicatingFiles: AssociatedFile[]; downloadedFiles: AssociatedFile[]; resolvedIPs: AssociatedIP[]; } export interface TagSearchOptions { /** Maximum number of results (default: 300, max: 1000) */ limit?: number; /** Start date for search range (ISO 8601 format) */ start?: string; /** End date for search range (ISO 8601 format) */ end?: string; } export interface TagSearchFile { hash: { sha256: string; md5: string; sha1: string; }; tags: string[]; fileSize: number; fileType: string; detect: string; } export type TagSearchResult = TagSearchFile[]; /** * Raw API Response structures */ export interface CTXFileUploadApiResponse { request: { ctx_api_version: string; request_time: string; request_parameter: string; request_private: boolean; ctx_transaction_id: string; response_time: string; }; ctx_result: { result_code: number; result_msg: string; }; ctx_data: { sha256: string; sha1: string; md5: string; uploadType: 'PRIVATE' | 'UPLOAD_PRIVATE_REJECTED_SWITCHED_TO_PUBLIC' | 'PUBLIC'; }; } //# sourceMappingURL=types.d.ts.map