@@ -8,40 +8,22 @@ Here you can find the Extended Search Documentation!
88
99## Keywords
1010
11- | ** Keyword** | ** Description** |
12- | -------------- | ----------------------------------------------------------- |
13- | ` FILENAME ` | Name of the file, including extensions (e.g., ` .exe ` ) |
14- | ` UID ` | Unique identifier for a file or user |
15- | ` SHA256 ` | SHA-256 cryptographic hash of the file |
16- | ` MD5 ` | MD5 hash value of the file |
17- | ` SHA1 ` | SHA-1 hash value of the file |
18- | ` FILETYPE ` | File type or format |
19- | ` SIGNER ` | Entity that signed the file, if applicable |
20- | ` VERDICT ` | Security verdict or analysis result |
21- | ` USER ` | User linked to the file |
22- | ` PACKER ` | Packer or compression method used |
23- | ` SSDEEP ` | Fuzzy hash (ssdeep) for similarity detection |
24- | ` MAGIC ` | File signature or magic number |
25- | ` TLSH ` | Trend Micro Locality Sensitive Hash (TLSH) value |
26- | ` AUTHENTIHASH ` | Authenticode hash for verifying file authenticity |
27- | ` TYPETAG ` | Tag indicating file type or category |
28- | ` PASSWORD ` | Password related to the file, if present |
29- | ` HASH ` | General hash value of the file |
30- | ` PENDING ` | Indicates files awaiting processing or analysis |
31- | ` QUEUED ` | Files that are in the processing queue |
32- | ` ENCRYPTED ` | Shows if the file is encrypted |
33- | ` SCORE ` | Security score or risk rating |
34- | ` REPUTATION ` | Reputation status or score of the file |
35- | ` VOTE ` | User’s vote (` DOWNVOTE ` , ` NEUTRAL ` , ` UPVOTE ` ) |
36- | ` VOTELABEL ` | Label assigned by user (` MALWARE ` , ` CLEAN ` , etc.) |
37- | ` VOTEFAMILY ` | Malware family specified by user (` Redline ` , ` DCRAT ` , etc.) |
38- | ` COMMENT ` | Search within user vote comments |
39- | ` TAG ` | Tag from analysis or metadata |
40- | ` FAMILY ` | Specific malware family name |
41- | ` CONTENT ` | Search within extracted file content |
42- | ` VTSCORE ` | VirusTotal detection score |
43- | ` FILESIZE ` | File size in bytes |
44- | ` THREAT ` | The threat label of the report |
11+ | ** Keyword** | ** Description** |
12+ | ------------ | ----------------------------------------------------- |
13+ | ` FILENAME ` | Name of the file, including extensions (e.g., ` .exe ` ) |
14+ | ` SHA256 ` | SHA-256 cryptographic hash of the file |
15+ | ` MD5 ` | MD5 hash value of the file |
16+ | ` SHA1 ` | SHA-1 hash value of the file |
17+ | ` FILETYPE ` | File type or format |
18+ | ` VERDICT ` | Security verdict or analysis result |
19+ | ` USER ` | User linked to the file |
20+ | ` PACKER ` | Packer or compression method used |
21+ | ` TYPETAG ` | Tag indicating file type or category |
22+ | ` HASH ` | General hash value of the file |
23+ | ` SCORE ` | Security score or risk rating |
24+ | ` REPUTATION ` | Reputation status or score of the file |
25+ | ` THREAT ` | Specific malware Threat detection name |
26+ | ` FILESIZE ` | File size in bytes |
4527
4628## Operators
4729
@@ -56,11 +38,7 @@ Here you can find the Extended Search Documentation!
5638Here are some example queries to help you get started:
5739
5840``` sql
59- filename:solara .exe AND score:100
60-
61- family:lumma OR tag:stealer AND score:100
62-
63- encrypted:true OR password:infected OR filetype:.zip
41+ threat:Family .XWORM
6442
6543filesize:10mb OR filesize:> 10mb OR filesize:10mb- 20mb
6644```
0 commit comments