rea-agents
Preparing search index...
application/ElectronEvidence
createElectronEvidence
Function createElectronEvidence
createElectronEvidence
(
operation
:
ElectronOperation
,
input
:
|
{
allowed_file_roots
:
string
[]
;
approved
:
true
;
cdp_endpoint
:
string
;
limit
:
number
;
offset
:
number
;
}
|
{
allowed_file_roots
:
string
[]
;
approved
:
true
;
cdp_endpoint
:
string
;
include_script_sources
:
boolean
;
limits
:
{
max_dom_nodes
:
number
;
max_frames
:
number
;
max_resources
:
number
;
max_script_source_bytes
:
number
;
max_scripts
:
number
;
max_total_script_source_bytes
:
number
;
max_workers
:
number
;
}
;
observation_ms
:
number
;
source_capture_approved
:
boolean
;
target_id
:
string
;
}
,
result
:
|
{
browser
:
{
js_version
:
string
;
product
:
string
;
protocol_version
:
string
;
revision
:
string
;
user_agent
:
string
;
}
;
excluded
:
{
non_page
:
number
;
outside_root
:
number
;
unsupported_url
:
number
;
}
;
limitations
:
string
[]
;
schema_version
:
1
;
targets
:
{
has_more
:
boolean
;
items
:
{
attached
:
boolean
;
file_path
:
string
;
target_id
:
string
;
title
:
string
;
type
:
string
;
}
[]
;
limit
:
number
;
next_offset
:
number
|
null
;
offset
:
number
;
total
:
number
;
}
;
}
|
{
browser
:
{
js_version
:
string
;
product
:
string
;
protocol_version
:
string
;
revision
:
string
;
user_agent
:
string
;
}
;
capture_window
:
{
ended_at
:
string
;
observation_ms
:
number
;
started_at
:
string
;
}
;
completeness
:
{
attach_limited_sections
:
(
|
"frames"
|
"websocket_connections"
|
"metadata"
|
"resources"
|
"storage"
|
"dom"
|
"accessibility"
|
"scripts"
|
"script_sources"
|
"network_requests"
|
"network_initiators"
|
"console_events"
|
"console_text"
|
"websocket_frames"
|
"websocket_shapes"
|
"json_body_shapes"
|
"workers"
|
"storage_keys"
|
"webmcp_tools"
|
"screenshot"
|
"source_maps"
|
"timeline"
)
[]
;
conditions
:
(
|
"truncated"
|
"complete_within_window"
|
"policy_filtered"
|
"attach_limited"
)
[]
;
dropped_events
:
{
console_events
:
number
;
network_requests
:
number
;
scripts
:
number
;
timeline_events
:
number
;
total
:
number
;
webmcp_tools
:
number
;
websocket_connections
:
number
;
websocket_frames
:
number
;
}
;
excluded
:
{
count
:
number
|
null
;
reason
:
|
"provider_unavailable"
|
"disallowed_origin"
|
"unsupported_url"
|
"unattributed_origin"
|
"not_approved"
|
"out_of_target_scope"
|
"invalid_protocol_value"
;
section
:
|
"frames"
|
"websocket_connections"
|
"metadata"
|
"resources"
|
"storage"
|
"dom"
|
"accessibility"
|
"scripts"
|
"script_sources"
|
"network_requests"
|
"network_initiators"
|
"console_events"
|
"console_text"
|
"websocket_frames"
|
"websocket_shapes"
|
"json_body_shapes"
|
"workers"
|
"storage_keys"
|
"webmcp_tools"
|
"screenshot"
|
"source_maps"
|
"timeline"
;
}
[]
;
policy_filtered_sections
:
(
|
"frames"
|
"websocket_connections"
|
"metadata"
|
"resources"
|
"storage"
|
"dom"
|
"accessibility"
|
"scripts"
|
"script_sources"
|
"network_requests"
|
"network_initiators"
|
"console_events"
|
"console_text"
|
"websocket_frames"
|
"websocket_shapes"
|
"json_body_shapes"
|
"workers"
|
"storage_keys"
|
"webmcp_tools"
|
"screenshot"
|
"source_maps"
|
"timeline"
)
[]
;
status
:
|
"truncated"
|
"complete_within_window"
|
"policy_filtered"
|
"attach_limited"
;
truncated_sections
:
(
|
"frames"
|
"websocket_connections"
|
"metadata"
|
"resources"
|
"storage"
|
"dom"
|
"accessibility"
|
"scripts"
|
"script_sources"
|
"network_requests"
|
"network_initiators"
|
"console_events"
|
"console_text"
|
"websocket_frames"
|
"websocket_shapes"
|
"json_body_shapes"
|
"workers"
|
"storage_keys"
|
"webmcp_tools"
|
"screenshot"
|
"source_maps"
|
"timeline"
)
[]
;
unavailable_sections
:
(
|
"frames"
|
"websocket_connections"
|
"metadata"
|
"resources"
|
"storage"
|
"dom"
|
"accessibility"
|
"scripts"
|
"script_sources"
|
"network_requests"
|
"network_initiators"
|
"console_events"
|
"console_text"
|
"websocket_frames"
|
"websocket_shapes"
|
"json_body_shapes"
|
"workers"
|
"storage_keys"
|
"webmcp_tools"
|
"screenshot"
|
"source_maps"
|
"timeline"
)
[]
;
}
;
dom
:
{
nodes
:
{
attribute_names
:
string
[]
;
index
:
number
;
node_name
:
string
;
node_type
:
number
;
node_value_length
:
number
;
parent_index
:
number
;
}
[]
;
total_nodes
:
number
;
}
;
frames
:
{
file_path
:
string
;
frame_id
:
string
;
parent_frame_id
:
string
|
null
;
}
[]
;
limitations
:
string
[]
;
resources
:
{
content_size
:
number
|
null
;
file_path
:
string
;
mime_type
:
string
;
resource_key
:
string
;
type
:
string
;
}
[]
;
schema_version
:
1
;
scripts
:
{
items
:
{
cdp_hash
:
string
;
file_path
:
string
;
frame_id
:
string
|
null
;
is_module
:
boolean
;
language
:
string
|
null
;
length
:
number
;
script_key
:
string
;
source
:
|
{
included
:
false
;
reason
:
string
}
|
{
artifact
:
{
bytes
:
number
;
charset
:
"utf-8"
;
media_type
:
string
;
sha256
:
string
;
text
:
string
;
uri
:
string
;
}
;
included
:
true
;
}
;
}
[]
;
total
:
number
;
}
;
target
:
{
attached
:
boolean
;
file_path
:
string
;
target_id
:
string
;
title
:
string
;
type
:
string
;
}
;
workers
:
{
attached
:
boolean
;
file_path
:
string
;
opener_target_id
:
string
|
null
;
parent_frame_id
:
string
|
null
;
target_id
:
string
;
type
:
string
;
}
[]
;
}
,
provider
:
ProviderIdentity
,
)
:
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
Create Evidence v2 for one root-confined Electron observation.
Parameters
operation
:
ElectronOperation
input
:
|
{
allowed_file_roots
:
string
[]
;
approved
:
true
;
cdp_endpoint
:
string
;
limit
:
number
;
offset
:
number
;
}
|
{
allowed_file_roots
:
string
[]
;
approved
:
true
;
cdp_endpoint
:
string
;
include_script_sources
:
boolean
;
limits
:
{
max_dom_nodes
:
number
;
max_frames
:
number
;
max_resources
:
number
;
max_script_source_bytes
:
number
;
max_scripts
:
number
;
max_total_script_source_bytes
:
number
;
max_workers
:
number
;
}
;
observation_ms
:
number
;
source_capture_approved
:
boolean
;
target_id
:
string
;
}
result
:
|
{
browser
:
{
js_version
:
string
;
product
:
string
;
protocol_version
:
string
;
revision
:
string
;
user_agent
:
string
;
}
;
excluded
:
{
non_page
:
number
;
outside_root
:
number
;
unsupported_url
:
number
;
}
;
limitations
:
string
[]
;
schema_version
:
1
;
targets
:
{
has_more
:
boolean
;
items
:
{
attached
:
boolean
;
file_path
:
string
;
target_id
:
string
;
title
:
string
;
type
:
string
;
}
[]
;
limit
:
number
;
next_offset
:
number
|
null
;
offset
:
number
;
total
:
number
;
}
;
}
|
{
browser
:
{
js_version
:
string
;
product
:
string
;
protocol_version
:
string
;
revision
:
string
;
user_agent
:
string
;
}
;
capture_window
:
{
ended_at
:
string
;
observation_ms
:
number
;
started_at
:
string
;
}
;
completeness
:
{
attach_limited_sections
:
(
|
"frames"
|
"websocket_connections"
|
"metadata"
|
"resources"
|
"storage"
|
"dom"
|
"accessibility"
|
"scripts"
|
"script_sources"
|
"network_requests"
|
"network_initiators"
|
"console_events"
|
"console_text"
|
"websocket_frames"
|
"websocket_shapes"
|
"json_body_shapes"
|
"workers"
|
"storage_keys"
|
"webmcp_tools"
|
"screenshot"
|
"source_maps"
|
"timeline"
)
[]
;
conditions
:
(
|
"truncated"
|
"complete_within_window"
|
"policy_filtered"
|
"attach_limited"
)
[]
;
dropped_events
:
{
console_events
:
number
;
network_requests
:
number
;
scripts
:
number
;
timeline_events
:
number
;
total
:
number
;
webmcp_tools
:
number
;
websocket_connections
:
number
;
websocket_frames
:
number
;
}
;
excluded
:
{
count
:
number
|
null
;
reason
:
|
"provider_unavailable"
|
"disallowed_origin"
|
"unsupported_url"
|
"unattributed_origin"
|
"not_approved"
|
"out_of_target_scope"
|
"invalid_protocol_value"
;
section
:
|
"frames"
|
"websocket_connections"
|
"metadata"
|
"resources"
|
"storage"
|
"dom"
|
"accessibility"
|
"scripts"
|
"script_sources"
|
"network_requests"
|
"network_initiators"
|
"console_events"
|
"console_text"
|
"websocket_frames"
|
"websocket_shapes"
|
"json_body_shapes"
|
"workers"
|
"storage_keys"
|
"webmcp_tools"
|
"screenshot"
|
"source_maps"
|
"timeline"
;
}
[]
;
policy_filtered_sections
:
(
|
"frames"
|
"websocket_connections"
|
"metadata"
|
"resources"
|
"storage"
|
"dom"
|
"accessibility"
|
"scripts"
|
"script_sources"
|
"network_requests"
|
"network_initiators"
|
"console_events"
|
"console_text"
|
"websocket_frames"
|
"websocket_shapes"
|
"json_body_shapes"
|
"workers"
|
"storage_keys"
|
"webmcp_tools"
|
"screenshot"
|
"source_maps"
|
"timeline"
)
[]
;
status
:
|
"truncated"
|
"complete_within_window"
|
"policy_filtered"
|
"attach_limited"
;
truncated_sections
:
(
|
"frames"
|
"websocket_connections"
|
"metadata"
|
"resources"
|
"storage"
|
"dom"
|
"accessibility"
|
"scripts"
|
"script_sources"
|
"network_requests"
|
"network_initiators"
|
"console_events"
|
"console_text"
|
"websocket_frames"
|
"websocket_shapes"
|
"json_body_shapes"
|
"workers"
|
"storage_keys"
|
"webmcp_tools"
|
"screenshot"
|
"source_maps"
|
"timeline"
)
[]
;
unavailable_sections
:
(
|
"frames"
|
"websocket_connections"
|
"metadata"
|
"resources"
|
"storage"
|
"dom"
|
"accessibility"
|
"scripts"
|
"script_sources"
|
"network_requests"
|
"network_initiators"
|
"console_events"
|
"console_text"
|
"websocket_frames"
|
"websocket_shapes"
|
"json_body_shapes"
|
"workers"
|
"storage_keys"
|
"webmcp_tools"
|
"screenshot"
|
"source_maps"
|
"timeline"
)
[]
;
}
;
dom
:
{
nodes
:
{
attribute_names
:
string
[]
;
index
:
number
;
node_name
:
string
;
node_type
:
number
;
node_value_length
:
number
;
parent_index
:
number
;
}
[]
;
total_nodes
:
number
;
}
;
frames
:
{
file_path
:
string
;
frame_id
:
string
;
parent_frame_id
:
string
|
null
;
}
[]
;
limitations
:
string
[]
;
resources
:
{
content_size
:
number
|
null
;
file_path
:
string
;
mime_type
:
string
;
resource_key
:
string
;
type
:
string
;
}
[]
;
schema_version
:
1
;
scripts
:
{
items
:
{
cdp_hash
:
string
;
file_path
:
string
;
frame_id
:
string
|
null
;
is_module
:
boolean
;
language
:
string
|
null
;
length
:
number
;
script_key
:
string
;
source
:
|
{
included
:
false
;
reason
:
string
}
|
{
artifact
:
{
bytes
:
number
;
charset
:
"utf-8"
;
media_type
:
string
;
sha256
:
string
;
text
:
string
;
uri
:
string
;
}
;
included
:
true
;
}
;
}
[]
;
total
:
number
;
}
;
target
:
{
attached
:
boolean
;
file_path
:
string
;
target_id
:
string
;
title
:
string
;
type
:
string
;
}
;
workers
:
{
attached
:
boolean
;
file_path
:
string
;
opener_target_id
:
string
|
null
;
parent_frame_id
:
string
|
null
;
target_id
:
string
;
type
:
string
;
}
[]
;
}
provider
:
ProviderIdentity
Returns
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
Settings
Member Visibility
Protected
Inherited
Theme
OS
Light
Dark
rea-agents
Loading...
Create Evidence v2 for one root-confined Electron observation.