File Data - Sandfly Security

The file data contains all attributes about a file that was flagged by Sandfly Security or a user-defined sandfly for whatever reason. All attributes will be for the actual file, file link or device if found.

The data list holds the strings that a sandfly matched in the file's content, for sandflies that search file content. When the file is an ELF binary that Sandfly was able to parse, the analysis.binary object holds the results of the binary analysis: for example, the architecture and type of the binary, its hardening features and capabilities, suspicious properties, symbols, and strings, decoded strings, indicators of compromise (iocs), and the machine learning (ML) threat score (threat_score). For any other file, the analysis object is not included.

{
	"date": {
		"created": "",
		"created_minutes": 0,
		"modified": "",
		"modified_minutes": 0,
		"accessed": "",
		"accessed_minutes": 0
	},
	"nlink": 0,
	"mode": "",
	"uid": 0,
	"username": "",
	"gid": 0,
	"groupname": "",
	"size": 0,
	"size_mismatch": false,
	"path": "",
	"path_root": "",
	"name": "",
	"capabilities": {},
	"flags_list": null,
	"entropy": 0,
	"hash": {
		"md5": "",
		"sha1": "",
		"sha256": "",
		"sha512": ""
	},
	"magic_num": {
		"hex": "",
		"text": "",
		"type": "",
		"class": "",
		"expected_extensions": null
	},
	"mount": {
		"mountpoint": "",
		"device": "",
		"fs_type": ""
	},
	"container": {
		"id": "",
		"id_short": "",
		"rootdir": ""
	},
	"data": null,
	"analysis": {
		"binary": {
			"interpreter": "",
			"build_id": "",
			"comment": "",
			"architecture": "",
			"type": "",
			"hardening": null,
			"hardening_missing": null,
			"capabilities": null,
			"suspicious": null,
			"anomalies": null,
			"properties": null,
			"confirmed": null,
			"exec_targets": null,
			"decoded_strings": null,
			"decode_keys_xor": null,
			"counts": {
				"imported_symbols": 0,
				"static_symbols": 0,
				"exported_symbols": 0,
				"syscalls": 0,
				"imported_libs": 0
			},
			"suspicious_symbols": null,
			"suspicious_syscalls": null,
			"suspicious_strings": null,
			"suspicious_exported_symbols": null,
			"imports": null,
			"iocs": {
				"ips": null,
				"urls": null,
				"paths": null
			},
			"overlay": {
				"size": 0,
				"ratio": 0,
				"entropy": 0,
				"content_type": ""
			},
			"threat_score": 0,
			"threat_score_lr": 0,
			"threat_score_gbdt": 0,
			"score_path": ""
		}
	}
}