@spec download_file(String.t()) :: {:ok, map()} | {:error, any()}

Download a malware file (raw binary).

Examples

{:ok, %{body: data}} = Intel471Ex.Malware.download_file("sample-hash.exe")

@spec events_stream(map()) :: {:ok, map()} | {:error, any()}

Stream malware events matching filter criteria (cursor-paginated).

Parameters

• params: A map of query parameters
  • :type — Event type
  • :text_filter — Free text search
  • :malware_id — Filter by malware ID
  • :malware_family_id — Filter by malware family ID
  • :malware_family_name — Filter by malware family name
  • :girs — Filter by GIRs
  • :from / :until — Time range
  • :size / :cursor — Pagination

Examples

{:ok, result} = Intel471Ex.Malware.events_stream(%{malware_family_name: "lokibot", size: 10})

@spec get_event(String.t()) :: {:ok, map()} | {:error, any()}

Get a malware event by ID.

Examples

{:ok, event} = Intel471Ex.Malware.get_event("event-id")

@spec get_malware_family(String.t()) :: {:ok, map()} | {:error, any()}

Get a malware family profile by ID.

Examples

{:ok, profile} = Intel471Ex.Malware.get_malware_family("family-id")

@spec list_malware(map()) :: {:ok, map()} | {:error, any()}

List malware profiles matching filter criteria.

Parameters

• params: A map of query parameters
  • :text_filter — Free text search
  • :malware_family_id — Filter by malware family ID
  • :malware_family_name — Filter by malware family name
  • :girs — Filter by GIRs
  • :sort_by — Sort field
  • :order_by — Sort order
  • :page / :size — Pagination
  • :from / :until — Time range

Examples

{:ok, profiles} = Intel471Ex.Malware.list_malware(%{malware_family_name: "conti", size: 10})