EngineResponseSchema

The EngineResponse Schema

This schema should be used to format the return value from your engine object's analyze method. It contains the following properties:

• iocs: (type: list) - A list of Indicators of Compromise returned by the analysis engine. Each item in this list is a dict that must follow the Indicator of Compromise schema. If no IOCs are present, an empty list should be returned here.
• engine_name: (type: str) - The name of the analysis engine generating this response.
• binary_hash: (type: str) - The hash value of the item that was analyzed. Always 64 characters in length. Should be copied from the sha256: element of the binary metadata.
• success: (type: bool) - A value of True if the analysis succeeded, False if it did not.