Submitting a file

File submissions are required to be performed using the multipart/form-data scheme. The field name of uploaded file should be file and the file should have a filename. Optionally override the filename with the target field.

Because submitting a JSON payload when submitting a multipart upload can be difficult, the submission parameters can be submitted in one of two ways:

For simple submissions, encode the parameters as form values instead of JSON. Nested objects can be specified with a period (e.g. defaults.network). Array fields can be specified multiple times.
Alternatively, the JSON parameter payload can be encoded as a form field with key _json.

See below for examples.

File submission examples

Important: Make sure to include the @ symbol before the file path to upload the file contents, not just the path string.

Submitting a file:

curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    -F 'file=@<YOUR_SAMPLE_FILE_PATH>' \
    https://tria.ge/api/v0/samples

// Response:
{
  "id": "190724-hakvlwz8cx",
  "status": "running",
  "kind": "file",
  "filename": "evil.bat",
  "private": true,
  "submitted": "2019-07-24T13:32:07.253524Z"
}

Submitting a file with JSON parameters:

curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    -F '_json={"kind":"file","defaults":{"timeout": 60, "network":"drop"}}' \
    -F 'file=@<YOUR_SAMPLE_FILE_PATH>' \
    https://tria.ge/api/v0/samples

Submitting a password-protected .zip file:

curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    -F 'password=mysecret' \
    -F 'file=@<YOUR_ZIP_FILE_PATH>' \
    https://tria.ge/api/v0/samples

Submitting a file with custom filename, user tags, and Tor network routing:

curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    -F 'target=custom-filename.bat' \
    -F 'user_tags=4e2000db-6b18-4c25-9876-748aaa808a32' \
    -F 'user_tags=source:1234' \
    -F 'defaults.network=tor' \
    -F 'file=@<YOUR_SAMPLE_FILE_PATH>' \
    https://tria.ge/api/v0/samples

Common troubleshooting

If you encounter issues with file uploads:

Missing @ symbol: Ensure you use @ before the file path to upload file contents
Content-Type headers: Don't manually set Content-Type when using -F flag - curl sets it automatically
File path: Use absolute paths or ensure the file exists in the current directory
Verbose output: Add -v flag to see detailed request/response information for debugging

Submitting a URL

To submit a URL, you must do one of the following:

Set the "url" parameter
Specify "kind" to be "url" and "target" to be the URL

It's not possible to mix file upload and URL submissions.

Fetching a sample from a URL

In some use-cases it's desirable to submit a URL from which Triage will download the sample itself. E.g., the sample could be located in AWS S3, your own website, etc.

To have Triage fetch the sample from a URL, you must set kind to "fetch" and include the URL of the sample as url or target.

URL submission examples

Submitting a URL:

curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    -F 'url=http://example.org/' \
    https://tria.ge/api/v0/samples

Fetching a sample from a URL:

# As form:
curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    -F 'kind=fetch' \
    -F 'url=https://hostname.tld/sample.exe' \
    https://tria.ge/api/v0/samples

# As JSON:
curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    -H 'Content-Type: application/json' \
    -d '{"kind": "fetch", "url": "https://hostname.tld/sample.exe"}' \
    https://tria.ge/api/v0/samples

It's also possible to import an analysis from the public cloud:

curl -H 'Authorization: Bearer <YOUR_ACCESS_KEY>' \
    -F 'kind=import' \
    -F 'url=https://tria.ge/220202-rs4ehsacen' \
    https://tria.ge/api/v0/samples

Note that you can also specify just the sample/analysis ID (in this case "220202-rs4ehsacen") instead of the full https://tria.ge/ URL.

Choosing a profile

Choosing a profile is only available to users that are registered with a company.

Selecting a profile allows more control over the virtual environment that is used to run the sample.

Selecting a profile requires interactive to be false.

Profiles can be selected by adding them to the profiles array as shown below:

{
  "profiles": [
    {
      // The ID or name of the profile to use.
      "profile": "myprofilename",
      // If an archive is submitted, specify the filename in the archive this
      // profile should be used for (as per this example). This field can be
      // omitted if a single file is submitted (alternatively "sample" also
      // selects the submitted file).
      "pick": "unpack001/something.exe"
    }
  ],
  // Other options
}

A file may be selected multiple times with different profiles so it will be executed in different environments.