rea-agents - v2.1.0
Preparing search index...
application/BinarySessionPort
BinarySessionPort
Interface BinarySessionPort
Target lifecycle used by CLI and MCP without exposing a concrete provider.
interface
BinarySessionPort
{
activeTarget
()
:
BinaryTarget
|
undefined
;
analysisProfile
(
operation
?:
AnalysisOperation
,
)
:
|
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
|
undefined
;
close
()
:
Promise
<
Result
<
null
,
AnalysisError
>
>
;
evidenceById
(
evidenceId
:
string
,
)
:
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
undefined
;
execute
(
operation
:
AnalysisOperation
,
parameters
:
Readonly
<
Record
<
string
,
JsonValue
>
>
,
options
?:
ExecutionOptions
,
)
:
Promise
<
Result
<
AnalysisExecution
,
AnalysisError
>
>
;
exportAnalysisSnapshot
()
:
Result
<
{
binding
:
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
}
;
entries
:
{
execution
:
{
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
raw_result
:
JSONType
;
result
:
JSONType
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
path
:
string
;
sha256
:
string
;
}
|
null
;
}
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
query_id
:
string
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
|
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
snapshot_version
:
2
;
target
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"javascript"
|
"source-map"
|
"plist"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"mach-o"
|
"elf"
|
"pe"
|
"analysis-database"
|
"ipa"
|
"apk"
;
kind
:
"executable"
|
"database"
|
"archive"
|
"artifact"
;
sha256
:
string
;
}
;
}
,
AnalysisError
,
>
;
exportEvidenceBundle
()
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
hasEvidence
(
evidenceId
:
string
)
:
boolean
;
importAnalysisSnapshot
(
snapshot
:
{
binding
:
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
}
;
entries
:
{
execution
:
{
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
raw_result
:
JSONType
;
result
:
JSONType
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
path
:
string
;
sha256
:
string
;
}
|
null
;
}
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
query_id
:
string
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
|
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
snapshot_version
:
2
;
target
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"javascript"
|
"source-map"
|
"plist"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"mach-o"
|
"elf"
|
"pe"
|
"analysis-database"
|
"ipa"
|
"apk"
;
kind
:
"executable"
|
"database"
|
"archive"
|
"artifact"
;
sha256
:
string
;
}
;
}
,
)
:
Result
<
number
,
AnalysisError
>
;
importEvidenceBundle
(
bundle
:
unknown
,
)
:
Result
<
number
,
EvidenceIntegrityError
|
EvidenceLimitError
>
;
investigationWorkspace
(
workspaceId
:
string
,
revision
:
number
,
)
:
|
{
bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
|
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
previous_revision_digest
:
string
|
null
;
revision
:
number
;
revision_digest
:
string
;
runs
:
(
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
legacy_request_identity
:
true
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
)
[]
;
workspace_id
:
string
;
workspace_version
:
1
;
}
|
undefined
;
investigationWorkspaces
()
:
readonly
{
bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
previous_revision_digest
:
string
|
null
;
revision
:
number
;
revision_digest
:
string
;
runs
:
(
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
legacy_request_identity
:
true
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
)
[]
;
workspace_id
:
string
;
workspace_version
:
1
;
}
[]
;
listUnknowns
(
filters
?:
{
domain
?:
string
;
severity
?:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
?:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
}
,
)
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
onAvailabilityChanged
?
(
listener
:
()
=>
void
|
Promise
<
void
>
)
:
()
=>
void
;
open
(
path
:
string
,
options
?:
{
providerId
?:
string
;
signal
?:
AbortSignal
;
snapshot
?:
{
binding
:
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
}
;
entries
:
{
execution
:
{
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
raw_result
:
JSONType
;
result
:
JSONType
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
path
:
string
;
sha256
:
string
;
}
|
null
;
}
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
query_id
:
string
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
(...)
|
(...)
|
(...)
|
(...)
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
...
;
kind
:
...
}
|
{
end
:
...
;
kind
:
...
;
start
:
...
}
|
{
kind
:
...
;
path
:
...
}
|
{
kind
:
...
;
offset
:
...
}
|
{
end
:
...
;
kind
:
...
;
start
:
...
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
(...)
|
(...)
|
(...)
|
(...)
|
(...)
;
digest
:
{
sha256
:
...
}
;
format
:
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
(...)
|
(...)
|
(...)
|
(...)
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
...
;
kind
:
...
}
|
{
end
:
...
;
kind
:
...
;
start
:
...
}
|
{
kind
:
...
;
path
:
...
}
|
{
kind
:
...
;
offset
:
...
}
|
{
end
:
...
;
kind
:
...
;
start
:
...
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
(...)
|
(...)
|
(...)
|
(...)
|
(...)
;
digest
:
{
sha256
:
...
}
;
format
:
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
|
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
snapshot_version
:
2
;
target
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"javascript"
|
"source-map"
|
"plist"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"mach-o"
|
"elf"
|
"pe"
|
"analysis-database"
|
"ipa"
|
"apk"
;
kind
:
"executable"
|
"database"
|
"archive"
|
"artifact"
;
sha256
:
string
;
}
;
}
;
targetKind
?:
"executable"
|
"database"
|
"archive"
|
"artifact"
;
}
,
)
:
Promise
<
Result
<
BinaryTarget
,
AnalysisError
>
>
;
openCompatibility
()
:
Readonly
<
Record
<
string
,
JsonValue
>
>
;
providerIdentity
(
operation
?:
AnalysisOperation
)
:
ProviderIdentity
;
reconstructionCoverageWorkspace
(
workspaceId
:
string
,
revision
:
number
,
)
:
|
{
artifacts
:
{
artifact_id
:
string
;
artifact_sha256
:
string
;
environment_sha256
:
string
;
evidence_ids
:
string
[]
;
version
:
string
;
}
[]
;
boundaries
:
{
allowed_dispositions
:
(
"external"
|
"non-goal"
)
[]
;
allowed_unknown_ids
:
string
[]
;
boundary_id
:
string
;
required_claim_ids
:
string
[]
;
required_package_proof_kinds
:
(
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
)
[]
;
required_surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
claims
:
{
claim_id
:
string
;
kind
:
string
;
required_authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
required_dimensions
:
string
[]
;
surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
contradictions
:
{
claim_ids
:
string
[]
;
contradiction_id
:
string
;
evidence_ids
:
string
[]
;
status
:
"resolved"
|
"active"
;
surface_ids
:
string
[]
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
|
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
owners
:
{
ownership
:
|
{
authority_route
:
"unknown"
|
"none"
|
"detected"
;
disposition
:
"implemented"
;
owner_export
:
string
|
null
;
owner_path
:
string
;
owner_sha256
:
string
;
package_state
:
"unknown"
|
"missing"
|
"distributed"
;
path_state
:
"unknown"
|
"missing"
|
"present"
;
}
|
{
disposition
:
"external"
|
"non-goal"
;
rationale
:
string
}
;
surface_id
:
string
;
}
[]
;
package_proofs
:
{
artifact_sha256s
:
string
[]
;
evidence_ids
:
string
[]
;
kind
:
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
;
proof_id
:
string
;
status
:
"unknown"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
}
[]
;
previous_revision_sha256
:
string
|
null
;
residual_unknown_ids
:
string
[]
;
revision
:
number
;
revision_sha256
:
string
;
schema_version
:
1
;
surfaces
:
{
artifact_id
:
string
;
authority
:
|
"external"
|
"observed"
|
"derived"
|
"inferred"
|
"historical"
;
dependency_surface_ids
:
string
[]
;
evidence_ids
:
string
[]
;
family
:
string
;
location
:
string
;
occurrence_id
:
string
|
null
;
surface_id
:
string
;
}
[]
;
verifier_contracts
:
{
authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
claim_ids
:
string
[]
;
contract_sha256
:
string
;
dimensions
:
string
[]
;
max_age_ms
:
number
;
minimum_repeats
:
number
;
normalization_removes_dimensions
:
false
;
normalization_sha256
:
string
;
verifier_id
:
string
;
}
[]
;
verifier_results
:
{
artifact_sha256s
:
string
[]
;
contract_sha256
:
string
;
covered_claim_ids
:
string
[]
;
covered_dimensions
:
string
[]
;
evidence_ids
:
string
[]
;
normalization_sha256
:
string
;
observed_at
:
string
;
owner_sha256s
:
string
[]
;
repeats
:
number
;
status
:
|
"unknown"
|
"truncated"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
verifier_id
:
string
;
}
[]
;
workspace_id
:
string
;
}
|
undefined
;
reconstructionCoverageWorkspaces
()
:
readonly
{
artifacts
:
{
artifact_id
:
string
;
artifact_sha256
:
string
;
environment_sha256
:
string
;
evidence_ids
:
string
[]
;
version
:
string
;
}
[]
;
boundaries
:
{
allowed_dispositions
:
(
"external"
|
"non-goal"
)
[]
;
allowed_unknown_ids
:
string
[]
;
boundary_id
:
string
;
required_claim_ids
:
string
[]
;
required_package_proof_kinds
:
(
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
)
[]
;
required_surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
claims
:
{
claim_id
:
string
;
kind
:
string
;
required_authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
required_dimensions
:
string
[]
;
surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
contradictions
:
{
claim_ids
:
string
[]
;
contradiction_id
:
string
;
evidence_ids
:
string
[]
;
status
:
"resolved"
|
"active"
;
surface_ids
:
string
[]
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
owners
:
{
ownership
:
|
{
authority_route
:
"unknown"
|
"none"
|
"detected"
;
disposition
:
"implemented"
;
owner_export
:
string
|
null
;
owner_path
:
string
;
owner_sha256
:
string
;
package_state
:
"unknown"
|
"missing"
|
"distributed"
;
path_state
:
"unknown"
|
"missing"
|
"present"
;
}
|
{
disposition
:
"external"
|
"non-goal"
;
rationale
:
string
}
;
surface_id
:
string
;
}
[]
;
package_proofs
:
{
artifact_sha256s
:
string
[]
;
evidence_ids
:
string
[]
;
kind
:
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
;
proof_id
:
string
;
status
:
"unknown"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
}
[]
;
previous_revision_sha256
:
string
|
null
;
residual_unknown_ids
:
string
[]
;
revision
:
number
;
revision_sha256
:
string
;
schema_version
:
1
;
surfaces
:
{
artifact_id
:
string
;
authority
:
|
"external"
|
"observed"
|
"derived"
|
"inferred"
|
"historical"
;
dependency_surface_ids
:
string
[]
;
evidence_ids
:
string
[]
;
family
:
string
;
location
:
string
;
occurrence_id
:
string
|
null
;
surface_id
:
string
;
}
[]
;
verifier_contracts
:
{
authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
claim_ids
:
string
[]
;
contract_sha256
:
string
;
dimensions
:
string
[]
;
max_age_ms
:
number
;
minimum_repeats
:
number
;
normalization_removes_dimensions
:
false
;
normalization_sha256
:
string
;
verifier_id
:
string
;
}
[]
;
verifier_results
:
{
artifact_sha256s
:
string
[]
;
contract_sha256
:
string
;
covered_claim_ids
:
string
[]
;
covered_dimensions
:
string
[]
;
evidence_ids
:
string
[]
;
normalization_sha256
:
string
;
observed_at
:
string
;
owner_sha256s
:
string
[]
;
repeats
:
number
;
status
:
|
"unknown"
|
"truncated"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
verifier_id
:
string
;
}
[]
;
workspace_id
:
string
;
}
[]
;
recordEvidence
(
evidence
:
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
,
)
:
Result
<
"added"
|
"duplicate"
,
EvidenceIntegrityError
|
EvidenceLimitError
,
>
;
recordEvidenceWithUnknown
(
evidence
:
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
,
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
supporting_evidence_ids
:
string
[]
;
}
,
)
:
Result
<
|
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
|
null
,
AnalysisError
,
>
;
recordUnknown
(
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
supporting_evidence_ids
:
string
[]
;
}
,
)
:
Result
<
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
,
AnalysisError
,
>
;
retainInvestigationWorkspace
(
workspace
:
{
bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
|
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
previous_revision_digest
:
string
|
null
;
revision
:
number
;
revision_digest
:
string
;
runs
:
(
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
legacy_request_identity
:
true
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
)
[]
;
workspace_id
:
string
;
workspace_version
:
1
;
}
,
)
:
"added"
|
"duplicate"
;
retainReconstructionCoverageWorkspace
(
workspace
:
{
artifacts
:
{
artifact_id
:
string
;
artifact_sha256
:
string
;
environment_sha256
:
string
;
evidence_ids
:
string
[]
;
version
:
string
;
}
[]
;
boundaries
:
{
allowed_dispositions
:
(
"external"
|
"non-goal"
)
[]
;
allowed_unknown_ids
:
string
[]
;
boundary_id
:
string
;
required_claim_ids
:
string
[]
;
required_package_proof_kinds
:
(
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
)
[]
;
required_surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
claims
:
{
claim_id
:
string
;
kind
:
string
;
required_authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
required_dimensions
:
string
[]
;
surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
contradictions
:
{
claim_ids
:
string
[]
;
contradiction_id
:
string
;
evidence_ids
:
string
[]
;
status
:
"resolved"
|
"active"
;
surface_ids
:
string
[]
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
|
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
owners
:
{
ownership
:
|
{
authority_route
:
"unknown"
|
"none"
|
"detected"
;
disposition
:
"implemented"
;
owner_export
:
string
|
null
;
owner_path
:
string
;
owner_sha256
:
string
;
package_state
:
"unknown"
|
"missing"
|
"distributed"
;
path_state
:
"unknown"
|
"missing"
|
"present"
;
}
|
{
disposition
:
"external"
|
"non-goal"
;
rationale
:
string
}
;
surface_id
:
string
;
}
[]
;
package_proofs
:
{
artifact_sha256s
:
string
[]
;
evidence_ids
:
string
[]
;
kind
:
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
;
proof_id
:
string
;
status
:
"unknown"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
}
[]
;
previous_revision_sha256
:
string
|
null
;
residual_unknown_ids
:
string
[]
;
revision
:
number
;
revision_sha256
:
string
;
schema_version
:
1
;
surfaces
:
{
artifact_id
:
string
;
authority
:
|
"external"
|
"observed"
|
"derived"
|
"inferred"
|
"historical"
;
dependency_surface_ids
:
string
[]
;
evidence_ids
:
string
[]
;
family
:
string
;
location
:
string
;
occurrence_id
:
string
|
null
;
surface_id
:
string
;
}
[]
;
verifier_contracts
:
{
authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
claim_ids
:
string
[]
;
contract_sha256
:
string
;
dimensions
:
string
[]
;
max_age_ms
:
number
;
minimum_repeats
:
number
;
normalization_removes_dimensions
:
false
;
normalization_sha256
:
string
;
verifier_id
:
string
;
}
[]
;
verifier_results
:
{
artifact_sha256s
:
string
[]
;
contract_sha256
:
string
;
covered_claim_ids
:
string
[]
;
covered_dimensions
:
string
[]
;
evidence_ids
:
string
[]
;
normalization_sha256
:
string
;
observed_at
:
string
;
owner_sha256s
:
string
[]
;
repeats
:
number
;
status
:
|
"unknown"
|
"truncated"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
verifier_id
:
string
;
}
[]
;
workspace_id
:
string
;
}
,
)
:
"added"
|
"duplicate"
;
status
()
:
JSONType
;
updateUnknown
(
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
expected_revision
:
number
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
,
)
:
Result
<
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
,
AnalysisError
,
>
;
verifyUnknownResolution
(
unknownId
:
string
,
)
:
Result
<
{
truthVerified
:
boolean
;
unknown
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
;
valid
:
boolean
;
}
,
UnknownRegistryError
,
>
;
}
Hierarchy (
View Summary
)
AnalysisOperationPort
BinarySessionPort
Implemented by
BinarySession
Index
Methods
active
Target
analysis
Profile
close
evidence
By
Id
execute
export
Analysis
Snapshot
export
Evidence
Bundle
has
Evidence
import
Analysis
Snapshot
import
Evidence
Bundle
investigation
Workspace
investigation
Workspaces
list
Unknowns
on
Availability
Changed?
open
open
Compatibility
provider
Identity
reconstruction
Coverage
Workspace
reconstruction
Coverage
Workspaces
record
Evidence
record
Evidence
With
Unknown
record
Unknown
retain
Investigation
Workspace
retain
Reconstruction
Coverage
Workspace
status
update
Unknown
verify
Unknown
Resolution
Methods
active
Target
activeTarget
()
:
BinaryTarget
|
undefined
Returns
BinaryTarget
|
undefined
analysis
Profile
analysisProfile
(
operation
?:
AnalysisOperation
,
)
:
|
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
|
undefined
Parameters
Optional
operation
:
AnalysisOperation
Returns
|
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
|
undefined
close
close
()
:
Promise
<
Result
<
null
,
AnalysisError
>
>
Returns
Promise
<
Result
<
null
,
AnalysisError
>
>
evidence
By
Id
evidenceById
(
evidenceId
:
string
,
)
:
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
undefined
Parameters
evidenceId
:
string
Returns
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
undefined
execute
execute
(
operation
:
AnalysisOperation
,
parameters
:
Readonly
<
Record
<
string
,
JsonValue
>
>
,
options
?:
ExecutionOptions
,
)
:
Promise
<
Result
<
AnalysisExecution
,
AnalysisError
>
>
Parameters
operation
:
AnalysisOperation
parameters
:
Readonly
<
Record
<
string
,
JsonValue
>
>
Optional
options
:
ExecutionOptions
Returns
Promise
<
Result
<
AnalysisExecution
,
AnalysisError
>
>
export
Analysis
Snapshot
exportAnalysisSnapshot
()
:
Result
<
{
binding
:
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
}
;
entries
:
{
execution
:
{
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
raw_result
:
JSONType
;
result
:
JSONType
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
path
:
string
;
sha256
:
string
;
}
|
null
;
}
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
query_id
:
string
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
snapshot_version
:
2
;
target
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"javascript"
|
"source-map"
|
"plist"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"mach-o"
|
"elf"
|
"pe"
|
"analysis-database"
|
"ipa"
|
"apk"
;
kind
:
"executable"
|
"database"
|
"archive"
|
"artifact"
;
sha256
:
string
;
}
;
}
,
AnalysisError
,
>
Returns
Result
<
{
binding
:
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
}
;
entries
:
{
execution
:
{
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
raw_result
:
JSONType
;
result
:
JSONType
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
path
:
string
;
sha256
:
string
;
}
|
null
;
}
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
query_id
:
string
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
snapshot_version
:
2
;
target
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"javascript"
|
"source-map"
|
"plist"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"mach-o"
|
"elf"
|
"pe"
|
"analysis-database"
|
"ipa"
|
"apk"
;
kind
:
"executable"
|
"database"
|
"archive"
|
"artifact"
;
sha256
:
string
;
}
;
}
,
AnalysisError
,
>
export
Evidence
Bundle
exportEvidenceBundle
()
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
Returns
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
has
Evidence
hasEvidence
(
evidenceId
:
string
)
:
boolean
Parameters
evidenceId
:
string
Returns
boolean
import
Analysis
Snapshot
importAnalysisSnapshot
(
snapshot
:
{
binding
:
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
}
;
entries
:
{
execution
:
{
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
raw_result
:
JSONType
;
result
:
JSONType
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
path
:
string
;
sha256
:
string
;
}
|
null
;
}
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
query_id
:
string
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
snapshot_version
:
2
;
target
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"javascript"
|
"source-map"
|
"plist"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"mach-o"
|
"elf"
|
"pe"
|
"analysis-database"
|
"ipa"
|
"apk"
;
kind
:
"executable"
|
"database"
|
"archive"
|
"artifact"
;
sha256
:
string
;
}
;
}
,
)
:
Result
<
number
,
AnalysisError
>
Parameters
snapshot
:
{
binding
:
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
}
;
entries
:
{
execution
:
{
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
raw_result
:
JSONType
;
result
:
JSONType
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
path
:
string
;
sha256
:
string
;
}
|
null
;
}
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
query_id
:
string
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
snapshot_version
:
2
;
target
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"javascript"
|
"source-map"
|
"plist"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"mach-o"
|
"elf"
|
"pe"
|
"analysis-database"
|
"ipa"
|
"apk"
;
kind
:
"executable"
|
"database"
|
"archive"
|
"artifact"
;
sha256
:
string
;
}
;
}
Returns
Result
<
number
,
AnalysisError
>
import
Evidence
Bundle
importEvidenceBundle
(
bundle
:
unknown
,
)
:
Result
<
number
,
EvidenceIntegrityError
|
EvidenceLimitError
>
Parameters
bundle
:
unknown
Returns
Result
<
number
,
EvidenceIntegrityError
|
EvidenceLimitError
>
investigation
Workspace
investigationWorkspace
(
workspaceId
:
string
,
revision
:
number
,
)
:
|
{
bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
previous_revision_digest
:
string
|
null
;
revision
:
number
;
revision_digest
:
string
;
runs
:
(
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
legacy_request_identity
:
true
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
)
[]
;
workspace_id
:
string
;
workspace_version
:
1
;
}
|
undefined
Parameters
workspaceId
:
string
revision
:
number
Returns
|
{
bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
previous_revision_digest
:
string
|
null
;
revision
:
number
;
revision_digest
:
string
;
runs
:
(
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
legacy_request_identity
:
true
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
)
[]
;
workspace_id
:
string
;
workspace_version
:
1
;
}
|
undefined
investigation
Workspaces
investigationWorkspaces
()
:
readonly
{
bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
previous_revision_digest
:
string
|
null
;
revision
:
number
;
revision_digest
:
string
;
runs
:
(
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
legacy_request_identity
:
true
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
)
[]
;
workspace_id
:
string
;
workspace_version
:
1
;
}
[]
Returns
readonly
{
bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
previous_revision_digest
:
string
|
null
;
revision
:
number
;
revision_digest
:
string
;
runs
:
(
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
legacy_request_identity
:
true
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
)
[]
;
workspace_id
:
string
;
workspace_version
:
1
;
}
[]
list
Unknowns
listUnknowns
(
filters
?:
{
domain
?:
string
;
severity
?:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
?:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
}
,
)
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
Parameters
Optional
filters
:
{
domain
?:
string
;
severity
?:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
?:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
}
Returns
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
Optional
on
Availability
Changed
onAvailabilityChanged
?
(
listener
:
()
=>
void
|
Promise
<
void
>
)
:
()
=>
void
Parameters
listener
:
()
=>
void
|
Promise
<
void
>
Returns
()
=>
void
open
open
(
path
:
string
,
options
?:
{
providerId
?:
string
;
signal
?:
AbortSignal
;
snapshot
?:
{
binding
:
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
}
;
entries
:
{
execution
:
{
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
raw_result
:
JSONType
;
result
:
JSONType
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
path
:
string
;
sha256
:
string
;
}
|
null
;
}
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
query_id
:
string
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
(...)
|
(...)
|
(...)
|
(...)
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
...
;
kind
:
...
}
|
{
end
:
...
;
kind
:
...
;
start
:
...
}
|
{
kind
:
...
;
path
:
...
}
|
{
kind
:
...
;
offset
:
...
}
|
{
end
:
...
;
kind
:
...
;
start
:
...
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
(...)
|
(...)
|
(...)
|
(...)
|
(...)
;
digest
:
{
sha256
:
...
}
;
format
:
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
(...)
|
(...)
|
(...)
|
(...)
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
...
;
kind
:
...
}
|
{
end
:
...
;
kind
:
...
;
start
:
...
}
|
{
kind
:
...
;
path
:
...
}
|
{
kind
:
...
;
offset
:
...
}
|
{
end
:
...
;
kind
:
...
;
start
:
...
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
(...)
|
(...)
|
(...)
|
(...)
|
(...)
;
digest
:
{
sha256
:
...
}
;
format
:
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
|
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
snapshot_version
:
2
;
target
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"javascript"
|
"source-map"
|
"plist"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"mach-o"
|
"elf"
|
"pe"
|
"analysis-database"
|
"ipa"
|
"apk"
;
kind
:
"executable"
|
"database"
|
"archive"
|
"artifact"
;
sha256
:
string
;
}
;
}
;
targetKind
?:
"executable"
|
"database"
|
"archive"
|
"artifact"
;
}
,
)
:
Promise
<
Result
<
BinaryTarget
,
AnalysisError
>
>
Parameters
path
:
string
Optional
options
:
{
providerId
?:
string
;
signal
?:
AbortSignal
;
snapshot
?:
{
binding
:
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
}
;
entries
:
{
execution
:
{
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
raw_result
:
JSONType
;
result
:
JSONType
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
path
:
string
;
sha256
:
string
;
}
|
null
;
}
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
query_id
:
string
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
(...)
|
(...)
|
(...)
|
(...)
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
...
;
kind
:
...
}
|
{
end
:
...
;
kind
:
...
;
start
:
...
}
|
{
kind
:
...
;
path
:
...
}
|
{
kind
:
...
;
offset
:
...
}
|
{
end
:
...
;
kind
:
...
;
start
:
...
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
(...)
|
(...)
|
(...)
|
(...)
|
(...)
;
digest
:
{
sha256
:
...
}
;
format
:
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
(...)
|
(...)
|
(...)
|
(...)
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
...
;
kind
:
...
}
|
{
end
:
...
;
kind
:
...
;
start
:
...
}
|
{
kind
:
...
;
path
:
...
}
|
{
kind
:
...
;
offset
:
...
}
|
{
end
:
...
;
kind
:
...
;
start
:
...
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
(...)
|
(...)
|
(...)
|
(...)
|
(...)
;
digest
:
{
sha256
:
...
}
;
format
:
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
|
(...)
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
snapshot_version
:
2
;
target
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
format
:
|
"javascript"
|
"source-map"
|
"plist"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"mach-o"
|
"elf"
|
"pe"
|
"analysis-database"
|
"ipa"
|
"apk"
;
kind
:
"executable"
|
"database"
|
"archive"
|
"artifact"
;
sha256
:
string
;
}
;
}
;
targetKind
?:
"executable"
|
"database"
|
"archive"
|
"artifact"
;
}
Returns
Promise
<
Result
<
BinaryTarget
,
AnalysisError
>
>
open
Compatibility
openCompatibility
()
:
Readonly
<
Record
<
string
,
JsonValue
>
>
Returns
Readonly
<
Record
<
string
,
JsonValue
>
>
provider
Identity
providerIdentity
(
operation
?:
AnalysisOperation
)
:
ProviderIdentity
Parameters
Optional
operation
:
AnalysisOperation
Returns
ProviderIdentity
reconstruction
Coverage
Workspace
reconstructionCoverageWorkspace
(
workspaceId
:
string
,
revision
:
number
,
)
:
|
{
artifacts
:
{
artifact_id
:
string
;
artifact_sha256
:
string
;
environment_sha256
:
string
;
evidence_ids
:
string
[]
;
version
:
string
;
}
[]
;
boundaries
:
{
allowed_dispositions
:
(
"external"
|
"non-goal"
)
[]
;
allowed_unknown_ids
:
string
[]
;
boundary_id
:
string
;
required_claim_ids
:
string
[]
;
required_package_proof_kinds
:
(
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
)
[]
;
required_surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
claims
:
{
claim_id
:
string
;
kind
:
string
;
required_authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
required_dimensions
:
string
[]
;
surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
contradictions
:
{
claim_ids
:
string
[]
;
contradiction_id
:
string
;
evidence_ids
:
string
[]
;
status
:
"resolved"
|
"active"
;
surface_ids
:
string
[]
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
owners
:
{
ownership
:
|
{
authority_route
:
"unknown"
|
"none"
|
"detected"
;
disposition
:
"implemented"
;
owner_export
:
string
|
null
;
owner_path
:
string
;
owner_sha256
:
string
;
package_state
:
"unknown"
|
"missing"
|
"distributed"
;
path_state
:
"unknown"
|
"missing"
|
"present"
;
}
|
{
disposition
:
"external"
|
"non-goal"
;
rationale
:
string
}
;
surface_id
:
string
;
}
[]
;
package_proofs
:
{
artifact_sha256s
:
string
[]
;
evidence_ids
:
string
[]
;
kind
:
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
;
proof_id
:
string
;
status
:
"unknown"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
}
[]
;
previous_revision_sha256
:
string
|
null
;
residual_unknown_ids
:
string
[]
;
revision
:
number
;
revision_sha256
:
string
;
schema_version
:
1
;
surfaces
:
{
artifact_id
:
string
;
authority
:
|
"external"
|
"observed"
|
"derived"
|
"inferred"
|
"historical"
;
dependency_surface_ids
:
string
[]
;
evidence_ids
:
string
[]
;
family
:
string
;
location
:
string
;
occurrence_id
:
string
|
null
;
surface_id
:
string
;
}
[]
;
verifier_contracts
:
{
authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
claim_ids
:
string
[]
;
contract_sha256
:
string
;
dimensions
:
string
[]
;
max_age_ms
:
number
;
minimum_repeats
:
number
;
normalization_removes_dimensions
:
false
;
normalization_sha256
:
string
;
verifier_id
:
string
;
}
[]
;
verifier_results
:
{
artifact_sha256s
:
string
[]
;
contract_sha256
:
string
;
covered_claim_ids
:
string
[]
;
covered_dimensions
:
string
[]
;
evidence_ids
:
string
[]
;
normalization_sha256
:
string
;
observed_at
:
string
;
owner_sha256s
:
string
[]
;
repeats
:
number
;
status
:
|
"unknown"
|
"truncated"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
verifier_id
:
string
;
}
[]
;
workspace_id
:
string
;
}
|
undefined
Parameters
workspaceId
:
string
revision
:
number
Returns
|
{
artifacts
:
{
artifact_id
:
string
;
artifact_sha256
:
string
;
environment_sha256
:
string
;
evidence_ids
:
string
[]
;
version
:
string
;
}
[]
;
boundaries
:
{
allowed_dispositions
:
(
"external"
|
"non-goal"
)
[]
;
allowed_unknown_ids
:
string
[]
;
boundary_id
:
string
;
required_claim_ids
:
string
[]
;
required_package_proof_kinds
:
(
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
)
[]
;
required_surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
claims
:
{
claim_id
:
string
;
kind
:
string
;
required_authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
required_dimensions
:
string
[]
;
surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
contradictions
:
{
claim_ids
:
string
[]
;
contradiction_id
:
string
;
evidence_ids
:
string
[]
;
status
:
"resolved"
|
"active"
;
surface_ids
:
string
[]
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
owners
:
{
ownership
:
|
{
authority_route
:
"unknown"
|
"none"
|
"detected"
;
disposition
:
"implemented"
;
owner_export
:
string
|
null
;
owner_path
:
string
;
owner_sha256
:
string
;
package_state
:
"unknown"
|
"missing"
|
"distributed"
;
path_state
:
"unknown"
|
"missing"
|
"present"
;
}
|
{
disposition
:
"external"
|
"non-goal"
;
rationale
:
string
}
;
surface_id
:
string
;
}
[]
;
package_proofs
:
{
artifact_sha256s
:
string
[]
;
evidence_ids
:
string
[]
;
kind
:
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
;
proof_id
:
string
;
status
:
"unknown"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
}
[]
;
previous_revision_sha256
:
string
|
null
;
residual_unknown_ids
:
string
[]
;
revision
:
number
;
revision_sha256
:
string
;
schema_version
:
1
;
surfaces
:
{
artifact_id
:
string
;
authority
:
|
"external"
|
"observed"
|
"derived"
|
"inferred"
|
"historical"
;
dependency_surface_ids
:
string
[]
;
evidence_ids
:
string
[]
;
family
:
string
;
location
:
string
;
occurrence_id
:
string
|
null
;
surface_id
:
string
;
}
[]
;
verifier_contracts
:
{
authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
claim_ids
:
string
[]
;
contract_sha256
:
string
;
dimensions
:
string
[]
;
max_age_ms
:
number
;
minimum_repeats
:
number
;
normalization_removes_dimensions
:
false
;
normalization_sha256
:
string
;
verifier_id
:
string
;
}
[]
;
verifier_results
:
{
artifact_sha256s
:
string
[]
;
contract_sha256
:
string
;
covered_claim_ids
:
string
[]
;
covered_dimensions
:
string
[]
;
evidence_ids
:
string
[]
;
normalization_sha256
:
string
;
observed_at
:
string
;
owner_sha256s
:
string
[]
;
repeats
:
number
;
status
:
|
"unknown"
|
"truncated"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
verifier_id
:
string
;
}
[]
;
workspace_id
:
string
;
}
|
undefined
reconstruction
Coverage
Workspaces
reconstructionCoverageWorkspaces
()
:
readonly
{
artifacts
:
{
artifact_id
:
string
;
artifact_sha256
:
string
;
environment_sha256
:
string
;
evidence_ids
:
string
[]
;
version
:
string
;
}
[]
;
boundaries
:
{
allowed_dispositions
:
(
"external"
|
"non-goal"
)
[]
;
allowed_unknown_ids
:
string
[]
;
boundary_id
:
string
;
required_claim_ids
:
string
[]
;
required_package_proof_kinds
:
(
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
)
[]
;
required_surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
claims
:
{
claim_id
:
string
;
kind
:
string
;
required_authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
required_dimensions
:
string
[]
;
surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
contradictions
:
{
claim_ids
:
string
[]
;
contradiction_id
:
string
;
evidence_ids
:
string
[]
;
status
:
"resolved"
|
"active"
;
surface_ids
:
string
[]
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
owners
:
{
ownership
:
|
{
authority_route
:
"unknown"
|
"none"
|
"detected"
;
disposition
:
"implemented"
;
owner_export
:
string
|
null
;
owner_path
:
string
;
owner_sha256
:
string
;
package_state
:
"unknown"
|
"missing"
|
"distributed"
;
path_state
:
"unknown"
|
"missing"
|
"present"
;
}
|
{
disposition
:
"external"
|
"non-goal"
;
rationale
:
string
}
;
surface_id
:
string
;
}
[]
;
package_proofs
:
{
artifact_sha256s
:
string
[]
;
evidence_ids
:
string
[]
;
kind
:
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
;
proof_id
:
string
;
status
:
"unknown"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
}
[]
;
previous_revision_sha256
:
string
|
null
;
residual_unknown_ids
:
string
[]
;
revision
:
number
;
revision_sha256
:
string
;
schema_version
:
1
;
surfaces
:
{
artifact_id
:
string
;
authority
:
"external"
|
"observed"
|
"derived"
|
"inferred"
|
"historical"
;
dependency_surface_ids
:
string
[]
;
evidence_ids
:
string
[]
;
family
:
string
;
location
:
string
;
occurrence_id
:
string
|
null
;
surface_id
:
string
;
}
[]
;
verifier_contracts
:
{
authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
claim_ids
:
string
[]
;
contract_sha256
:
string
;
dimensions
:
string
[]
;
max_age_ms
:
number
;
minimum_repeats
:
number
;
normalization_removes_dimensions
:
false
;
normalization_sha256
:
string
;
verifier_id
:
string
;
}
[]
;
verifier_results
:
{
artifact_sha256s
:
string
[]
;
contract_sha256
:
string
;
covered_claim_ids
:
string
[]
;
covered_dimensions
:
string
[]
;
evidence_ids
:
string
[]
;
normalization_sha256
:
string
;
observed_at
:
string
;
owner_sha256s
:
string
[]
;
repeats
:
number
;
status
:
|
"unknown"
|
"truncated"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
verifier_id
:
string
;
}
[]
;
workspace_id
:
string
;
}
[]
Returns
readonly
{
artifacts
:
{
artifact_id
:
string
;
artifact_sha256
:
string
;
environment_sha256
:
string
;
evidence_ids
:
string
[]
;
version
:
string
;
}
[]
;
boundaries
:
{
allowed_dispositions
:
(
"external"
|
"non-goal"
)
[]
;
allowed_unknown_ids
:
string
[]
;
boundary_id
:
string
;
required_claim_ids
:
string
[]
;
required_package_proof_kinds
:
(
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
)
[]
;
required_surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
claims
:
{
claim_id
:
string
;
kind
:
string
;
required_authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
required_dimensions
:
string
[]
;
surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
contradictions
:
{
claim_ids
:
string
[]
;
contradiction_id
:
string
;
evidence_ids
:
string
[]
;
status
:
"resolved"
|
"active"
;
surface_ids
:
string
[]
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
owners
:
{
ownership
:
|
{
authority_route
:
"unknown"
|
"none"
|
"detected"
;
disposition
:
"implemented"
;
owner_export
:
string
|
null
;
owner_path
:
string
;
owner_sha256
:
string
;
package_state
:
"unknown"
|
"missing"
|
"distributed"
;
path_state
:
"unknown"
|
"missing"
|
"present"
;
}
|
{
disposition
:
"external"
|
"non-goal"
;
rationale
:
string
}
;
surface_id
:
string
;
}
[]
;
package_proofs
:
{
artifact_sha256s
:
string
[]
;
evidence_ids
:
string
[]
;
kind
:
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
;
proof_id
:
string
;
status
:
"unknown"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
}
[]
;
previous_revision_sha256
:
string
|
null
;
residual_unknown_ids
:
string
[]
;
revision
:
number
;
revision_sha256
:
string
;
schema_version
:
1
;
surfaces
:
{
artifact_id
:
string
;
authority
:
"external"
|
"observed"
|
"derived"
|
"inferred"
|
"historical"
;
dependency_surface_ids
:
string
[]
;
evidence_ids
:
string
[]
;
family
:
string
;
location
:
string
;
occurrence_id
:
string
|
null
;
surface_id
:
string
;
}
[]
;
verifier_contracts
:
{
authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
claim_ids
:
string
[]
;
contract_sha256
:
string
;
dimensions
:
string
[]
;
max_age_ms
:
number
;
minimum_repeats
:
number
;
normalization_removes_dimensions
:
false
;
normalization_sha256
:
string
;
verifier_id
:
string
;
}
[]
;
verifier_results
:
{
artifact_sha256s
:
string
[]
;
contract_sha256
:
string
;
covered_claim_ids
:
string
[]
;
covered_dimensions
:
string
[]
;
evidence_ids
:
string
[]
;
normalization_sha256
:
string
;
observed_at
:
string
;
owner_sha256s
:
string
[]
;
repeats
:
number
;
status
:
|
"unknown"
|
"truncated"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
verifier_id
:
string
;
}
[]
;
workspace_id
:
string
;
}
[]
record
Evidence
recordEvidence
(
evidence
:
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
,
)
:
Result
<
"added"
|
"duplicate"
,
EvidenceIntegrityError
|
EvidenceLimitError
,
>
Parameters
evidence
:
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
Returns
Result
<
"added"
|
"duplicate"
,
EvidenceIntegrityError
|
EvidenceLimitError
>
record
Evidence
With
Unknown
recordEvidenceWithUnknown
(
evidence
:
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
,
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
supporting_evidence_ids
:
string
[]
;
}
,
)
:
Result
<
|
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
|
null
,
AnalysisError
,
>
Parameters
evidence
:
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
supporting_evidence_ids
:
string
[]
;
}
Returns
Result
<
|
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
|
null
,
AnalysisError
,
>
record
Unknown
recordUnknown
(
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
supporting_evidence_ids
:
string
[]
;
}
,
)
:
Result
<
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
,
AnalysisError
,
>
Parameters
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
supporting_evidence_ids
:
string
[]
;
}
Returns
Result
<
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
,
AnalysisError
,
>
retain
Investigation
Workspace
retainInvestigationWorkspace
(
workspace
:
{
bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
previous_revision_digest
:
string
|
null
;
revision
:
number
;
revision_digest
:
string
;
runs
:
(
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
legacy_request_identity
:
true
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
)
[]
;
workspace_id
:
string
;
workspace_version
:
1
;
}
,
)
:
"added"
|
"duplicate"
Parameters
workspace
:
{
bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
previous_revision_digest
:
string
|
null
;
revision
:
number
;
revision_digest
:
string
;
runs
:
(
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
|
{
comparison_evidence_id
:
string
|
null
;
completed_stages
:
(
|
"inventory_left"
|
"inventory_right"
|
"compare_artifacts"
|
"find_changed_behavior"
)
[]
;
integrity_continue_approved
:
boolean
;
integrity_policy
:
"fail"
|
"record-and-continue"
;
left
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
left_inventory_evidence_ids
:
string
[]
;
legacy_request_identity
:
true
;
limitations
:
string
[]
;
max_integrity_mismatches
:
number
;
options
:
{
change_limit
:
number
;
max_compression_ratio
:
number
;
max_depth
:
number
;
max_entries
:
number
;
max_entry_bytes
:
number
;
max_path_bytes
:
number
;
max_total_bytes
:
number
;
page_size
:
number
;
}
;
request_sha256
:
string
;
result_evidence_id
:
string
|
null
;
right
:
{
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
graph_sha256
:
string
;
manifest_id
:
string
;
root_sha256
:
string
;
}
;
right_inventory_evidence_ids
:
string
[]
;
run_id
:
string
;
schema_version
:
1
;
status
:
"complete"
|
"running"
;
}
)
[]
;
workspace_id
:
string
;
workspace_version
:
1
;
}
Returns
"added"
|
"duplicate"
retain
Reconstruction
Coverage
Workspace
retainReconstructionCoverageWorkspace
(
workspace
:
{
artifacts
:
{
artifact_id
:
string
;
artifact_sha256
:
string
;
environment_sha256
:
string
;
evidence_ids
:
string
[]
;
version
:
string
;
}
[]
;
boundaries
:
{
allowed_dispositions
:
(
"external"
|
"non-goal"
)
[]
;
allowed_unknown_ids
:
string
[]
;
boundary_id
:
string
;
required_claim_ids
:
string
[]
;
required_package_proof_kinds
:
(
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
)
[]
;
required_surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
claims
:
{
claim_id
:
string
;
kind
:
string
;
required_authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
required_dimensions
:
string
[]
;
surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
contradictions
:
{
claim_ids
:
string
[]
;
contradiction_id
:
string
;
evidence_ids
:
string
[]
;
status
:
"resolved"
|
"active"
;
surface_ids
:
string
[]
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
owners
:
{
ownership
:
|
{
authority_route
:
"unknown"
|
"none"
|
"detected"
;
disposition
:
"implemented"
;
owner_export
:
string
|
null
;
owner_path
:
string
;
owner_sha256
:
string
;
package_state
:
"unknown"
|
"missing"
|
"distributed"
;
path_state
:
"unknown"
|
"missing"
|
"present"
;
}
|
{
disposition
:
"external"
|
"non-goal"
;
rationale
:
string
}
;
surface_id
:
string
;
}
[]
;
package_proofs
:
{
artifact_sha256s
:
string
[]
;
evidence_ids
:
string
[]
;
kind
:
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
;
proof_id
:
string
;
status
:
"unknown"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
}
[]
;
previous_revision_sha256
:
string
|
null
;
residual_unknown_ids
:
string
[]
;
revision
:
number
;
revision_sha256
:
string
;
schema_version
:
1
;
surfaces
:
{
artifact_id
:
string
;
authority
:
|
"external"
|
"observed"
|
"derived"
|
"inferred"
|
"historical"
;
dependency_surface_ids
:
string
[]
;
evidence_ids
:
string
[]
;
family
:
string
;
location
:
string
;
occurrence_id
:
string
|
null
;
surface_id
:
string
;
}
[]
;
verifier_contracts
:
{
authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
claim_ids
:
string
[]
;
contract_sha256
:
string
;
dimensions
:
string
[]
;
max_age_ms
:
number
;
minimum_repeats
:
number
;
normalization_removes_dimensions
:
false
;
normalization_sha256
:
string
;
verifier_id
:
string
;
}
[]
;
verifier_results
:
{
artifact_sha256s
:
string
[]
;
contract_sha256
:
string
;
covered_claim_ids
:
string
[]
;
covered_dimensions
:
string
[]
;
evidence_ids
:
string
[]
;
normalization_sha256
:
string
;
observed_at
:
string
;
owner_sha256s
:
string
[]
;
repeats
:
number
;
status
:
|
"unknown"
|
"truncated"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
verifier_id
:
string
;
}
[]
;
workspace_id
:
string
;
}
,
)
:
"added"
|
"duplicate"
Parameters
workspace
:
{
artifacts
:
{
artifact_id
:
string
;
artifact_sha256
:
string
;
environment_sha256
:
string
;
evidence_ids
:
string
[]
;
version
:
string
;
}
[]
;
boundaries
:
{
allowed_dispositions
:
(
"external"
|
"non-goal"
)
[]
;
allowed_unknown_ids
:
string
[]
;
boundary_id
:
string
;
required_claim_ids
:
string
[]
;
required_package_proof_kinds
:
(
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
)
[]
;
required_surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
claims
:
{
claim_id
:
string
;
kind
:
string
;
required_authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
required_dimensions
:
string
[]
;
surface_ids
:
string
[]
;
title
:
string
;
}
[]
;
contradictions
:
{
claim_ids
:
string
[]
;
contradiction_id
:
string
;
evidence_ids
:
string
[]
;
status
:
"resolved"
|
"active"
;
surface_ids
:
string
[]
;
}
[]
;
evidence_bundle
:
{
artifacts
:
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
}
[]
;
bundle_version
:
2
;
captures
:
{
evidence_id
:
string
;
predicate_type
:
string
}
[]
;
environments
:
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
[]
;
providers
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
[]
;
records
:
(
|
{
analysis_profile
:
{
digest
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
}
;
provider_profile_schema_version
:
number
;
schema_version
:
1
;
}
;
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
|
{
authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
;
confidence
:
"observed"
|
"derived"
|
"inferred"
;
environment
:
|
{
architecture
:
string
;
id
:
string
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
;
platform
:
string
;
}
|
null
;
evidence_id
:
string
;
evidence_links
:
string
[]
;
limitations
:
string
[]
;
locations
:
(
|
{
address
:
string
;
kind
:
"address"
}
|
{
end
:
string
;
kind
:
"address-range"
;
start
:
string
}
|
{
kind
:
"artifact-path"
;
path
:
string
}
|
{
kind
:
"file-offset"
;
offset
:
number
}
|
{
end
:
number
;
kind
:
"file-offset-range"
;
start
:
number
}
)
[]
;
normalized_result
:
JSONType
;
operation
:
string
;
parameters
:
Record
<
string
,
JSONType
>
;
predicate_type
:
string
;
provider
:
{
id
:
string
;
name
:
string
;
version
:
string
|
null
}
;
raw_result
:
JSONType
;
schema_version
:
2
;
subject
:
|
{
architecture
:
"x86"
|
"x86_64"
|
"arm"
|
"arm64"
|
null
;
digest
:
{
sha256
:
string
}
;
format
:
|
"unknown"
|
"file"
|
"directory"
|
"javascript"
|
"source-map"
|
"plist"
|
"entitlements"
|
"dmg"
|
"zip"
|
"pkg"
|
"asar"
|
"javascript-bundle"
|
"mach-o-universal"
|
"mach-o"
|
"elf"
|
"pe"
|
"hopper"
|
"analysis-database"
|
"ipa"
|
"apk"
;
local_path
:
string
;
name
:
string
;
}
|
null
;
}
)
[]
;
scenarios
:
{
authority
:
"controlled-replay"
;
evidence_id
:
string
;
operation
:
string
;
}
[]
;
unknowns
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
[]
;
}
;
name
:
string
;
owners
:
{
ownership
:
|
{
authority_route
:
"unknown"
|
"none"
|
"detected"
;
disposition
:
"implemented"
;
owner_export
:
string
|
null
;
owner_path
:
string
;
owner_sha256
:
string
;
package_state
:
"unknown"
|
"missing"
|
"distributed"
;
path_state
:
"unknown"
|
"missing"
|
"present"
;
}
|
{
disposition
:
"external"
|
"non-goal"
;
rationale
:
string
}
;
surface_id
:
string
;
}
[]
;
package_proofs
:
{
artifact_sha256s
:
string
[]
;
evidence_ids
:
string
[]
;
kind
:
|
"build"
|
"clean-install"
|
"package-contents"
|
"runtime-routing"
|
"authority-independence"
;
proof_id
:
string
;
status
:
"unknown"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
}
[]
;
previous_revision_sha256
:
string
|
null
;
residual_unknown_ids
:
string
[]
;
revision
:
number
;
revision_sha256
:
string
;
schema_version
:
1
;
surfaces
:
{
artifact_id
:
string
;
authority
:
"external"
|
"observed"
|
"derived"
|
"inferred"
|
"historical"
;
dependency_surface_ids
:
string
[]
;
evidence_ids
:
string
[]
;
family
:
string
;
location
:
string
;
occurrence_id
:
string
|
null
;
surface_id
:
string
;
}
[]
;
verifier_contracts
:
{
authority
:
|
"external"
|
"shipped-artifact"
|
"controlled-replay"
|
"live-observation"
;
claim_ids
:
string
[]
;
contract_sha256
:
string
;
dimensions
:
string
[]
;
max_age_ms
:
number
;
minimum_repeats
:
number
;
normalization_removes_dimensions
:
false
;
normalization_sha256
:
string
;
verifier_id
:
string
;
}
[]
;
verifier_results
:
{
artifact_sha256s
:
string
[]
;
contract_sha256
:
string
;
covered_claim_ids
:
string
[]
;
covered_dimensions
:
string
[]
;
evidence_ids
:
string
[]
;
normalization_sha256
:
string
;
observed_at
:
string
;
owner_sha256s
:
string
[]
;
repeats
:
number
;
status
:
|
"unknown"
|
"truncated"
|
"fail"
|
"pass"
|
"unsupported"
|
"skipped"
;
verifier_id
:
string
;
}
[]
;
workspace_id
:
string
;
}
Returns
"added"
|
"duplicate"
status
status
()
:
JSONType
Returns
JSONType
update
Unknown
updateUnknown
(
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
expected_revision
:
number
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
,
)
:
Result
<
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
,
AnalysisError
,
>
Parameters
input
:
{
approved
:
true
;
contradicting_evidence_ids
:
string
[]
;
expected_revision
:
number
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
Returns
Result
<
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
,
AnalysisError
,
>
verify
Unknown
Resolution
verifyUnknownResolution
(
unknownId
:
string
,
)
:
Result
<
{
truthVerified
:
boolean
;
unknown
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
;
valid
:
boolean
;
}
,
UnknownRegistryError
,
>
Parameters
unknownId
:
string
Returns
Result
<
{
truthVerified
:
boolean
;
unknown
:
{
contradicting_evidence_ids
:
string
[]
;
domain
:
string
;
mutation_evidence_ids
:
string
[]
;
previous_revision_digest
:
string
|
null
;
question
:
string
;
recommended_probes
:
{
operation
:
string
;
rationale
:
string
}
[]
;
registry_version
:
1
;
relationships
:
{
type
:
"depends-on"
|
"related-to"
|
"contradicts"
;
unknown_id
:
string
;
}
[]
;
required_authority
:
|
"shipped-artifact"
|
"controlled-replay"
|
"historical-reference"
|
"external-service"
|
"analyst-inference"
|
null
;
required_confidence
:
"observed"
|
"derived"
|
"inferred"
;
required_environment
:
|
{
architecture
:
string
|
null
;
id
:
string
|
null
;
isolation
:
"process"
|
"none"
|
"container"
|
"virtual-machine"
|
null
;
platform
:
string
|
null
;
}
|
null
;
resolution
:
|
{
disposition
:
"verified"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
{
disposition
:
"withdrawn"
|
"out-of-scope"
;
evidence_ids
:
string
[]
;
rationale
:
string
;
}
|
null
;
revision
:
number
;
revision_digest
:
string
;
scope_digest
:
string
|
null
;
severity
:
"low"
|
"medium"
|
"high"
|
"critical"
;
status
:
|
"open"
|
"investigating"
|
"blocked"
|
"contradicted"
|
"resolved"
;
supporting_evidence_ids
:
string
[]
;
unknown_id
:
string
;
}
;
valid
:
boolean
;
}
,
UnknownRegistryError
,
>
Settings
Member Visibility
Protected
Inherited
Theme
OS
Light
Dark
On This Page
Methods
active
Target
analysis
Profile
close
evidence
By
Id
execute
export
Analysis
Snapshot
export
Evidence
Bundle
has
Evidence
import
Analysis
Snapshot
import
Evidence
Bundle
investigation
Workspace
investigation
Workspaces
list
Unknowns
on
Availability
Changed
open
open
Compatibility
provider
Identity
reconstruction
Coverage
Workspace
reconstruction
Coverage
Workspaces
record
Evidence
record
Evidence
With
Unknown
record
Unknown
retain
Investigation
Workspace
retain
Reconstruction
Coverage
Workspace
status
update
Unknown
verify
Unknown
Resolution
rea-agents - v2.1.0
Loading...
Target lifecycle used by CLI and MCP without exposing a concrete provider.