7.2 False positives feed
Request |
Value |
Method |
GET |
URL |
https://api.metadefender.com/v4/feed/false-positives |
Summary
Newly discovered files which are considered possible false positives. An infected scan result is considered to be false positive if 2 or less engines detected the file as being infected. The feed is updated on a daily basis and contains files that are detected in the previous day. This feed contains data about all engines.
Data is paginated, each page returns 1000 entries.
This endpoint is only available to OPSWAT partners participating in the malware exchange program. If you are an antivirus vendor, or have a malware feed and want to participate in the program, please contact us at malware-sharing@opswat.com.
Request
Query Parameters
|
Description |
Required |
Default |
Example |
?page |
The page number. This is a number starting from 1 up to as many pages as there are samples in a day |
NO |
1 |
?page=1 |
Header Parameters
|
Description |
Allowed Values |
Required |
apikey |
Gives rights to use the endpoint (API Authentication Mechanisms) |
apikey |
YES |
Response
HTTP Status Codes
Please refer to Status Codes for more information.
Body
Example of a successful request:
{
"data"
: [
{
"data_id"
:
"WlRFNE1EY3hPRk5LWW5ONE1WUlJXQVN5bHgyekxtSUU"
,
"file_type_category"
:
"E"
,
"file_type_extension"
:
"exe"
,
"md5"
:
"FDB5440D03C08C6E34AFB9F6900DB337"
,
"sha1"
:
"C33CF5FA63F443BB5D4431679098C560D384E9DF"
,
"sha256"
:
"CC2117469A1B041755075F6914C603DF7CBB162B7E36C54FBF8280CDAC4A73AB"
,
"scan_all_result_a"
:
"Infected"
,
"scan_all_result_i"
:
1
,
"start_time"
:
"2019-02-26T23:58:27.095Z"
,
"detected_by"
: [
"AegisLab"
],
"download"
:
"https://api.metadefender.com/v3/file/CC2117469A1B041755075F6914C603DF7CBB162B7E36C54FBF8280CDAC4A73AB/download"
,
"link"
:
"https://metadefender.opswat.com/#!/results/file/WlRFNE1EY3hPRk5LWW5ONE1WUlJXQVN5bHgyekxtSUU/regular/analysis"
},
{
"data_id"
:
"bTE2MTIwN3Ixbnk2SHg4N2VTeUIwTG1uSlVF"
,
"file_type_category"
:
"E"
,
"file_type_extension"
:
"exe"
,
"md5"
:
"3FC40DDA406A05DC36B76B88CA04A217"
,
"sha1"
:
"08EB722BBAFC7F5D5E66EACE9A746CB7CE4C8A85"
,
"sha256"
:
"C5AE85FCE64684AEC7CFEC71C59450E6B38843CC1BE62AD9428D7614CE250AB7"
,
"scan_all_result_a"
:
"Infected"
,
"scan_all_result_i"
:
1
,
"start_time"
:
"2019-02-26T23:49:32.073Z"
,
"detected_by"
: [
"Zillya!"
,
"AegisLab"
],
"download"
:
"https://api.metadefender.com/v3/file/C5AE85FCE64684AEC7CFEC71C59450E6B38843CC1BE62AD9428D7614CE250AB7/download"
,
"link"
:
"https://metadefender.opswat.com/#!/results/file/bTE2MTIwN3Ixbnk2SHg4N2VTeUIwTG1uSlVF/regular/analysis"
},
...
]
}
Example of a failed request:
{
"error"
: {
"code"
:
401007
,
"messages"
: [
"You are not authorized"
]
}
}
Descriptions of responses:
file_type_category |
The category of the file, computed by OPSWAT. Possible values:
|
file_type_extension |
The extension of the file, computed by OPSWAT |
link |
The link to the scan results in the frontend |
md5 |
The md5 of the file |
sha1 |
The sha1 of the file |
sha256 |
The sha256 of the file |
scan_all_result_a |
Scan result description |
scan_all_result_i |
|
detected_by |
An array of engines who detected this file as being infected |
download |
The API endpoint from where to download the file |
start_time |
The start time of the scan |
Sample code (Node.js)
var http = require(
"https"
);
var options = {
"method"
:
"GET"
,
"hostname"
: [
"api"
,
"metadefender"
,
"com"
],
"path"
: [
"v4"
,
"feed"
,
"false-positives"
],
"headers"
: {
"apikey"
: process.env.APIKEY
}
};
var req = http.request(options, function (res) {
var chunks = [];
res.on(
"data"
, function (chunk) {
chunks.push(chunk);
});
res.on(
"end"
, function () {
var body = Buffer.concat(chunks);
console.log(body.toString());
});
});
req.end();
Sample code (cURL)
curl -X GET \
https:
//api.metadefender.com/v4/feed/false-positives \
-H
"apikey: ${APIKEY}"