Search the Reputation database for one or more user Reputation entries.
- Specify up to 10,000 entries in a single request.
- The SMS returns all matching entries in the query in UTF-8 encoding.
- Returned entries are ordered from lowest to highest address, regardless of the order in which they are specified in the query.
- Each entry is terminated by a newline character.
Definition
repEntries/query
Parameters
A request can use the ip, dns, url, or filehash parameter, but not a mix of them.
| Parameter | Type | Description |
| ip | IP address | IPv4 or IPv6 address of the Reputation entry. |
| dns | string | DNS address of the Reputation entry. |
| url | url | Reputation URL entry. |
| filehash | File hash string |
The file hash string can be a full file hash or a portion of a file hash to query
for file hashes that contain the string. You can also query all file hashes for a
specific SHA type by using one of the two supported SHA hash prefixes in the query:
sha1: or sha256:.Prefix the file hash string with either
sha1: or sha256: in order to indicate the type of SHA algorithm the file hash string represents. For
example:
sha1:b7c74f7fbde596ba87ac98ff4a9c8235d437ebce sha256:779d0a008cb96a61ad6b075e29dad85d97ccf2d5c528d3292ccb9535079b6b40 |
| punycode | N/A | Used in conjunction with the dns parameter, punycode converts Unicode characters in domain names to ASCII before displaying them. |
Examples
The following example includes multiple IPs in a single query request:
curl -v -k --header "X-SMS-API-KEY: <string>" "https://<sms_server>/repEntries/query?&ip=1.1.1.1&ip=1.1.1.2"
The following example includes a specific URL:
curl -v -k --header "X-SMS-API-KEY: <string>" "https://<sms_server>//repEntries/query?url=http://badurl.com/this/is/nice"
The following example includes a less specific URL so that more records can be matched:
curl -v -k --header "X-SMS-API-KEY: <string>" "https://<sms_server>//repEntries/query?url=http://badurl.com"
The following examples query file hashes:
curl -v -k --header "X-SMS-API-KEY: <string>” "https://<sms_server>/repEntries/query?filehash=b7c74f7fbde596ba87ac98ff4a9c8235d437ebce"
curl -v -k --header "X-SMS-API-KEY: <string>" "https://<sms_server>/repEntries/query?filehash=sha256:1c17d07a2762f6baab41004b57eec1 13774bc3f745d4c1d64c0fe464720a2126 "The following example query will match all SHA-1 file hash entries:
curl -v -k --header "X-SMS-API-KEY: <string>” "https://<sms_server>/repEntries/query?filehash=sha1"
Response
All responses will include matched user reputation entries with their tag values.
In most cases, the returned queries will be in a format that, when saved to a file,
could be used in an import/POST request, or a delete/POST request. An exception would
be where the results return both SHA-1 and SHA-256 file hashes. These would need to
be separated before importing, since SHA hash types cannot be combined in the same
CSV file.
1.1.1.1,AtaHost,myata.device.com,MalwareIpType,infectedHost 1.1.1.2,AtaHost,myata.device.com,ThreatScore,28,MalwareIpType,cncHost~~~infectedHost
https://www.cnn.com/,Source,URL https://www.google.com/,Source,URL https://www.facebook.com/,Source,URL https://www.trendmicro.com/,Source,URL https://www.ebay.com/,Source,URL https://www.amazon.com/,Source,URL
sha1:0047ec317c28baa9b6a4b5ee3e8c78abfe2d0c61 sha1:0dfc9caaef84a33795541655ae0a0bb76c27f9b3 sha1:0fe995653b91dc4760d4b12f1464414b5dbe1747 sha1:11bb0c64cccba49ed249b526d9c3563087248625 sha1:2b91418b6f9e75231db1f4a8a0046dbf6ec9d9ab sha1:2fed31e9687a49127676ea2f60a1bda38538cca8 sha1:4474703263bc73015ba83d39dbd3211baee37b4c sha1:4634aa9544f9c33d69edde732bb4c9bf91479213
 |
NoteDNS queries return data in UTF-8 character encoding so
unicode domain names can be displayed.
|