rea-agents
Preparing search index...
domain/managedRuntimeCorrelation
planManagedRuntimeCorrelation
Function planManagedRuntimeCorrelation
planManagedRuntimeCorrelation
(
input
:
{
bounds
:
{
allow_network
:
false
;
allow_ui
:
false
;
max_output_bytes
:
number
;
max_threads
:
number
;
timeout_ms
:
number
;
}
;
host
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
;
clr_family
:
"unknown"
|
"dotnet-framework"
|
"dotnet"
|
"mono"
;
os
:
"linux"
|
"macos"
|
"windows"
;
}
;
method
:
{
normalized_il_sha256
:
string
|
null
;
signature_sha256
:
string
;
token
:
string
;
}
;
requested_effect
:
|
"attach"
|
"load"
|
"debugger"
|
"reflection"
|
"instrumentation"
;
static_members
:
{
analysis_profile
?:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
;
unknown_registry_approved
?:
true
;
}
,
executablePath
:
string
,
permissionGrantId
:
string
,
)
:
{
authority_model
:
{
capability
:
"managed_runtime"
;
default_enabled
:
false
;
per_call_approval_required
:
true
;
permission_grant_id
:
string
;
}
;
bounds
:
{
allow_network
:
false
;
allow_ui
:
false
;
max_output_bytes
:
number
;
max_threads
:
number
;
timeout_ms
:
number
;
}
;
correlation_id
:
string
;
effect_taxonomy
:
{
attaches_process
:
boolean
;
instruments_code
:
boolean
;
invokes_target_code
:
false
;
loads_target
:
boolean
;
uses_debugger
:
boolean
;
uses_reflection
:
boolean
;
}
;
evidence_links
:
string
[]
;
executed
:
false
;
limitations
:
string
[]
;
method_lock
:
{
body_sha256
:
string
|
null
;
body_status
:
"too-large"
|
"partial"
|
"malformed"
|
"present"
|
"absent"
;
declaring_type
:
string
|
null
;
exact_build_required
:
true
;
il_size
:
number
;
name
:
string
;
normalized_il_sha256
:
string
|
null
;
signature_sha256
:
string
;
token
:
string
;
}
;
phase
:
"admission-plan"
;
requested_runtime
:
{
effect
:
|
"attach"
|
"load"
|
"debugger"
|
"reflection"
|
"instrumentation"
;
executable_path
:
string
;
filesystem
:
"owned-artifacts-only"
;
host
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
;
clr_family
:
"unknown"
|
"dotnet-framework"
|
"dotnet"
|
"mono"
;
os
:
"linux"
|
"macos"
|
"windows"
;
}
;
network
:
"none"
;
}
;
schema_version
:
1
;
static_observation
:
{
artifact_path
:
string
;
artifact_sha256
:
string
;
byte_length
:
number
;
evidence_id
:
string
;
metadata_status
:
"complete"
|
"partial"
|
"malformed"
|
"absent"
;
module_name
:
string
|
null
;
mvid
:
string
|
null
;
}
;
unsupported_until_executor_exists
:
true
;
}
Authenticate static managed Evidence and build a non-executing runtime plan.
Parameters
input
:
{
bounds
:
{
allow_network
:
false
;
allow_ui
:
false
;
max_output_bytes
:
number
;
max_threads
:
number
;
timeout_ms
:
number
;
}
;
host
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
;
clr_family
:
"unknown"
|
"dotnet-framework"
|
"dotnet"
|
"mono"
;
os
:
"linux"
|
"macos"
|
"windows"
;
}
;
method
:
{
normalized_il_sha256
:
string
|
null
;
signature_sha256
:
string
;
token
:
string
;
}
;
requested_effect
:
|
"attach"
|
"load"
|
"debugger"
|
"reflection"
|
"instrumentation"
;
static_members
:
{
analysis_profile
?:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
;
unknown_registry_approved
?:
true
;
}
executablePath
:
string
permissionGrantId
:
string
Returns
{
authority_model
:
{
capability
:
"managed_runtime"
;
default_enabled
:
false
;
per_call_approval_required
:
true
;
permission_grant_id
:
string
;
}
;
bounds
:
{
allow_network
:
false
;
allow_ui
:
false
;
max_output_bytes
:
number
;
max_threads
:
number
;
timeout_ms
:
number
;
}
;
correlation_id
:
string
;
effect_taxonomy
:
{
attaches_process
:
boolean
;
instruments_code
:
boolean
;
invokes_target_code
:
false
;
loads_target
:
boolean
;
uses_debugger
:
boolean
;
uses_reflection
:
boolean
;
}
;
evidence_links
:
string
[]
;
executed
:
false
;
limitations
:
string
[]
;
method_lock
:
{
body_sha256
:
string
|
null
;
body_status
:
"too-large"
|
"partial"
|
"malformed"
|
"present"
|
"absent"
;
declaring_type
:
string
|
null
;
exact_build_required
:
true
;
il_size
:
number
;
name
:
string
;
normalized_il_sha256
:
string
|
null
;
signature_sha256
:
string
;
token
:
string
;
}
;
phase
:
"admission-plan"
;
requested_runtime
:
{
effect
:
|
"attach"
|
"load"
|
"debugger"
|
"reflection"
|
"instrumentation"
;
executable_path
:
string
;
filesystem
:
"owned-artifacts-only"
;
host
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
;
clr_family
:
"unknown"
|
"dotnet-framework"
|
"dotnet"
|
"mono"
;
os
:
"linux"
|
"macos"
|
"windows"
;
}
;
network
:
"none"
;
}
;
schema_version
:
1
;
static_observation
:
{
artifact_path
:
string
;
artifact_sha256
:
string
;
byte_length
:
number
;
evidence_id
:
string
;
metadata_status
:
"complete"
|
"partial"
|
"malformed"
|
"absent"
;
module_name
:
string
|
null
;
mvid
:
string
|
null
;
}
;
unsupported_until_executor_exists
:
true
;
}
Settings
Member Visibility
Protected
Inherited
Theme
OS
Light
Dark
rea-agents
Loading...
Authenticate static managed Evidence and build a non-executing runtime plan.