{
  "opencollection": "1.0.0",
  "info": {
    "name": "VirusTotal API v3 - Access Control Access Control - Group Management Private Scanning - Files Behaviours API",
    "version": "3.0"
  },
  "request": {
    "auth": {
      "type": "apikey",
      "key": "x-apikey",
      "value": "{{x-apikey}}",
      "placement": "header"
    }
  },
  "items": [
    {
      "info": {
        "name": "Private Scanning - Files Behaviours",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "VirusTotal Get the Behaviour Reports from a Private File",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://www.virustotal.com/api/v3/private/file/:id/behaviours",
            "params": [
              {
                "name": "id",
                "value": "",
                "type": "path",
                "description": "id parameter"
              }
            ],
            "auth": {
              "type": "apikey",
              "key": "x-apikey",
              "value": "{{x-apikey}}",
              "placement": "header"
            }
          },
          "docs": "> 🚧 Special privileges required\n> \n> Private Scanning endpoints are only available to users with [Private Scanning license](https://www.virustotal.com/gui/private-scanning-overview).\n\nFetches all the [Private File Behaviour](https://gtidocs.virustotal.com/reference/private-file-behaviours-object) reports available for a private file.\n"
        },
        {
          "info": {
            "name": "VirusTotal Get a Behaviour Report from a Private File",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://www.virustotal.com/api/v3/private/file_behaviours/:sandbox_id",
            "params": [
              {
                "name": "sandbox_id",
                "value": "",
                "type": "path",
                "description": "Sandbox report ID."
              }
            ],
            "auth": {
              "type": "apikey",
              "key": "x-apikey",
              "value": "{{x-apikey}}",
              "placement": "header"
            }
          },
          "docs": "> 🚧 Special privileges required\n> \n> Private Scanning endpoints are only available to users with [Private Scanning license](https://www.virustotal.com/gui/private-scanning-overview).\n\nFetches a [Private File Behaviour](https://gtidocs.virustotal.com/reference/private-file-behaviours-object) object by ID. It expects the sandbox ID returned by the [GET /private/files/{id}/behaviours](https://gtidocs.virustotal.com/reference/get-all-behaviour-reports-from-a-private-file) endpoint.\n\n```json Example"
        },
        {
          "info": {
            "name": "VirusTotal Get the EVTX File Generated During a Private File’s Behavior Analysis",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://www.virustotal.com/api/v3/private/file_behaviours/:sandbox_id/evtx",
            "params": [
              {
                "name": "sandbox_id",
                "value": "",
                "type": "path",
                "description": "Sandbox report ID"
              }
            ],
            "auth": {
              "type": "apikey",
              "key": "x-apikey",
              "value": "{{x-apikey}}",
              "placement": "header"
            }
          },
          "docs": "> 🚧 Special privileges required\n> \n> Private Scanning endpoints are only available to users with [Private Scanning license](https://www.virustotal.com/gui/private-scanning-overview).\n\nFetch the EVTX file associated with the sandbox execution.\n"
        },
        {
          "info": {
            "name": "VirusTotal Get a Detailed HTML Behaviour Report",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://www.virustotal.com/api/v3/private/file_behaviours/:sandbox_id/html",
            "params": [
              {
                "name": "sandbox_id",
                "value": "",
                "type": "path",
                "description": "Sandbox report ID"
              }
            ],
            "auth": {
              "type": "apikey",
              "key": "x-apikey",
              "value": "{{x-apikey}}",
              "placement": "header"
            }
          },
          "docs": "> 🚧 Special privileges required\n> \n> Private Scanning endpoints are only available to users with [Private Scanning license](https://www.virustotal.com/gui/private-scanning-overview).\n\nReturns a [Private File Behaviour](https://gtidocs.virustotal.com/reference/private-file-behaviours-object) object as an HTML report. It expects the sandbox ID returned by the [GET /private/files/{id}/behaviours](https://gtidocs.virustotal.com/reference/get-all-behaviour-reports-from-a-private-file) endpoint.\n"
        },
        {
          "info": {
            "name": "VirusTotal Get the Memdump File Generated During a Private File’s Behavior Analysis",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://www.virustotal.com/api/v3/private/file_behaviours/:sandbox_id/memdump",
            "params": [
              {
                "name": "sandbox_id",
                "value": "",
                "type": "path",
                "description": "Sandbox report ID"
              }
            ],
            "auth": {
              "type": "apikey",
              "key": "x-apikey",
              "value": "{{x-apikey}}",
              "placement": "header"
            }
          },
          "docs": "> 🚧 Special privileges required\n> \n> Private Scanning endpoints are only available to users with [Private Scanning license](https://www.virustotal.com/gui/private-scanning-overview).\n\nFetch the PCAP file associated with the sandbox execution.\n"
        },
        {
          "info": {
            "name": "VirusTotal Get the PCAP File Generated During a Private File’s Behavior Analysis",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://www.virustotal.com/api/v3/private/file_behaviours/:sandbox_id/pcap",
            "params": [
              {
                "name": "sandbox_id",
                "value": "",
                "type": "path",
                "description": "Sandbox report ID"
              }
            ],
            "auth": {
              "type": "apikey",
              "key": "x-apikey",
              "value": "{{x-apikey}}",
              "placement": "header"
            }
          },
          "docs": "> 🚧 Special privileges required\n> \n> Private Scanning endpoints are only available to users with [Private Scanning license](https://www.virustotal.com/gui/private-scanning-overview).\n\nFetch the memdump file associated with the sandbox execution.\n"
        },
        {
          "info": {
            "name": "VirusTotal Get Object Descriptors Related to a Private File's Behaviour Report",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://www.virustotal.com/api/v3/private/file_behaviours/:sandbox_id/relationships/:relationship",
            "params": [
              {
                "name": "sandbox_id",
                "value": "",
                "type": "path",
                "description": "Sandbox report ID. See \"Sandbox Report identifiers\" section above for more info."
              },
              {
                "name": "relationship",
                "value": "",
                "type": "path",
                "description": "Relationship name (see [table](ref:private-file-behaviours-object#relationships))"
              },
              {
                "name": "limit",
                "value": "",
                "type": "query",
                "description": "Maximum number of related objects to retrieve"
              },
              {
                "name": "cursor",
                "value": "",
                "type": "query",
                "description": "Continuation cursor"
              }
            ],
            "auth": {
              "type": "apikey",
              "key": "x-apikey",
              "value": "{{x-apikey}}",
              "placement": "header"
            }
          },
          "docs": "> 🚧 Special privileges required\n> \n> Private Scanning endpoints are only available to users with [Private Scanning license](https://www.virustotal.com/gui/private-scanning-overview).\n\nThis endpoint is the same as [/private/file_behaviours/{sandbox_id}/{relationship}](https://gtidocs.virustotal.com/reference/privatefile-behaviourssandbox-idrelationship) except it returns just the related object's IDs (and context attributes, if any) instead of returning all attributes.\n"
        },
        {
          "info": {
            "name": "VirusTotal Get Objects Related to a Private File's Behaviour Report",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://www.virustotal.com/api/v3/private/file_behaviours/:sandbox_id/:relationship",
            "params": [
              {
                "name": "sandbox_id",
                "value": "",
                "type": "path",
                "description": "Sandbox report ID. See \"Sandbox Report identifiers\" section above for more info."
              },
              {
                "name": "relationship",
                "value": "",
                "type": "path",
                "description": "Relationship name (see [table](ref:private-file-behaviours-object#relationships))"
              },
              {
                "name": "limit",
                "value": "",
                "type": "query",
                "description": "Maximum number of related objects to retrieve"
              },
              {
                "name": "cursor",
                "value": "",
                "type": "query",
                "description": "Continuation cursor"
              }
            ],
            "auth": {
              "type": "apikey",
              "key": "x-apikey",
              "value": "{{x-apikey}}",
              "placement": "header"
            }
          },
          "docs": "> 🚧 Special privileges required\n> \n> Private Scanning endpoints are only available to users with [Private Scanning license](https://www.virustotal.com/gui/private-scanning-overview).\n\nAs mentioned in the [Relationships](https://gtidocs.virustotal.com/reference/relationships) section, those related objects can be retrieved by sending `GET` requests to the relationship URL. \n\nAvailable relationships are described in the [private file behaviour](https://gtidocs.virustotal.com/reference/private-fil"
        },
        {
          "info": {
            "name": "VirusTotal Get a Summary of All MITRE ATT&CK Techniques Observed in a File",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://www.virustotal.com/api/v3/private/files/:id/behaviour_mitre_trees",
            "params": [
              {
                "name": "id",
                "value": "",
                "type": "path",
                "description": "File's SHA-256"
              }
            ],
            "auth": {
              "type": "apikey",
              "key": "x-apikey",
              "value": "{{x-apikey}}",
              "placement": "header"
            }
          },
          "docs": "> 🚧 Special privileges required\n> \n> Private Scanning endpoints are only available to users with [Private Scanning license](https://www.virustotal.com/gui/private-scanning-overview).\n\nThis endpoint returns a summary of MITRE ATT&CK tactics and techniques observed in each of the behaviour reports of a file.\n\nThe resulting structure is the following one:\n\n```json\n{\n  sandbox_name: {\n    \"tactics\": [\n      {\n        \"id\": tactic_id,\n        \"name\": tactic_name,\n        \"description\": tactic_descri"
        },
        {
          "info": {
            "name": "VirusTotal Get a Summary of All Behavior Reports for a File",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://www.virustotal.com/api/v3/private/files/:id/behaviour_summary",
            "params": [
              {
                "name": "id",
                "value": "",
                "type": "path",
                "description": "File's SHA-256"
              }
            ],
            "auth": {
              "type": "apikey",
              "key": "x-apikey",
              "value": "{{x-apikey}}",
              "placement": "header"
            }
          },
          "docs": "> 🚧 Special privileges required\n> \n> Private Scanning endpoints are only available to users with [Private Scanning license](https://www.virustotal.com/gui/private-scanning-overview).\n\nThis endpoint returns a summary with behavioural information about the private file. The summary consists in merging together the reports produced by the multiple sandboxes we have integrated in VirusTotal. \n\nThis API call returns all fields contained in the [Private File Behaviour](https://gtidocs.virustotal.com/"
        }
      ]
    }
  ],
  "bundled": true
}