msticpy.context.vtlookupv3.vtfile_behavior module

VirusTotal File Behavior functions.

class msticpy.context.vtlookupv3.vtfile_behavior.SIProcess(process_id: str, name: str, cmd_line: str, parent_id: int = -1, proc_key: str | None = None, parent_key: str | None = None, path: str | None = None, IsRoot: bool = False, IsLeaf: bool = False, IsBranch: bool = False, children: list = NOTHING, time_offset: int = 0)

Bases: object

Data class to hold each process from detonation.

Method generated by attrs for class SIProcess.

IsBranch: bool
IsLeaf: bool
IsRoot: bool
children: list
cmd_line: str
name: str
parent_id: int
parent_key: str | None
path: str | None
proc_key: str | None
process_id: str
time_offset: int
class msticpy.context.vtlookupv3.vtfile_behavior.VTFileBehavior(vt_key: str, file_id: str | None = None, file_summary: pd.DataFrame | pd.Series | dict[str, Any] | None = None)

Bases: object

VirusTotal File Behavior class.

Initialize the VTFileBehavior class.

Parameters:
  • vt_key (str, optional) – VirusTotal API key, by default None

  • file_id (Optional[str], optional) – The ID of the file to look up, by default None

  • file_summary (Optional[Union[pd.DataFrame, pd, Series, dict[str, Any]]], optional) – VT file summary - this can be in one of the following formats: VT object dictionary Pandas DataFrame - first row is assumed to be the file summary Pandas Series by default None

browse() widgets.VBox | None

Browse the behavior categories.

get_file_behavior(sandbox: str | None = None) None

Retrieve the file behavior data.

Parameters:

sandbox (str, optional) – Name of specific sandbox to retrieve, by default None If None, it will retrieve the behavior summary.

property has_behavior_data: bool

Return true if file behavior data available.

property has_evtx: bool

Return True if EVTX data is available (Enterprise only).

property has_memdump: bool

Return True if memory dump data is available (Enterprise only).

property has_pcap: bool

Return True if PCAP data is available (Enterprise only).

classmethod list_sandboxes() list[str]

Return list of known sandbox types.

property process_tree: figure | None

Return the process tree plot.

property sandbox_id: str

Return sandbox ID of detonation.