Getting started

Once your Halo order has been processed, if you’ve opted to include the File Reputation feature, we will set up a new ReversingLabs account for you.

Note: you can also use an existing ReversingLabs account, provided you have the required credentials.

Please follow the steps below to configure Glasswall Halo with your ReversingLabs account.

Prerequisite

• Minimum Halo version: v2.4.15

Configure Glasswall Halo with ReversingLabs

First, follow the steps in the deployment section to deploy Halo according to your cloud provider. How you then supply your ReversingLabs credentials depends on the deployment:

• Cloud (AKS, EKS, GKE, OKE) — store the credentials in your secret manager and set the remaining fields on the Engine's ConfigMap. See the Enable ReversingLabs step on the Install CDR components page for your provider.
• OVA and other self-hosted appliances — configure it at runtime from the Portal or the Halo API. See Enable ReversingLabs.

The ReversingLabs endpoint itself is fixed by the Engine and is not configurable; you supply only the credentials and, optionally, a lookup timeout.

Retrieve threat intelligence data for your files

Single files

In the Sync API

In this example, we process a single file on the CDR-file endpoint on the Sync API.

1. Make a POST request with a single file to the sync API, for example the CDR-file endpoint: /api/v3/cdr-file.

2. Observe the response headers. They should contain the following:

Header	Description	Values
x-filereputation-responsecode	HTTP response code from the file reputation service	200 OK, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 405 Method Not Allowed, 409 Conflict, 413 Request Too Large, 429 Too Many Requests, 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable, UnknownError, Timeout
x-filereputation-status	Malware presence status	unknown, known, suspicious, malicious
x-filereputation-threatname	Detected threat name for the requested sample	Example: win32.trojan.nsis
x-filereputation-threatlevel	Threat severity calculated by a proprietary ReversingLabs algorithm	Value from 0 to 5, where 5 indicates the highest severity
x-filereputation-trustlevel	Confidence that a known sample is goodware	Value from 0 to 5, where 0 represents the highest confidence

Archives

In this example, we process a ZIP file on the CDR-file endpoint on the Sync API.

1. Make a POST request with a supported archive file to the Sync API, for example the CDR-file endpoint: /api/v3/cdr-file. Ensure an analysis report will be generated.

2. Download the composite archive result containing the /clean and /report folders.

3. Open the report archive file under the /report directory.

4. Observe the contents of the manifest.cdr-json file. The JSON should contain a new fileReputation section:

{
  "fileReputation": {
    "response": "200",
    "fileStatus": "SUSPICIOUS",
    "threatName": "Win32.Trojan.Nsis",
    "threatLevel": "4",
    "trustLevel": "5"
  }
}

Compressed files

For compressed files (.bz2And.gzip), The file reputation data is returned via response headers (similar to single files).

Note: that the file reputation results are for the underlying file and not the parent compressed type.