Understanding-the-analysis-reports

User Objective

To thoroughly analyse the contents of a given file, gaining insights and extracting relevant information about the files structure, and potentially hidden active content, with the aim of extracting meaningful and actionable information.

Why?

Performing in-depth content analysis of a file serves several important purposes across various domains and industries:

1. Information Extraction: By analysing the binary structure of files, you can extract valuable information that might be obscured within the intricate arrangement of bytes. This information can include insights, trends, statistics, and patterns that are crucial for making informed decisions.

2. Decision-Making: Content analysis of the binary structure helps individuals and organisations make data-driven decisions based on the flow and arrangement of data within a file. Understanding the file's structure aids in grasping the context and relationships between different parts of the data.

3. Trend Identification: Analysing the binary structure allows you to identify emerging trends early on, especially in fields like machine learning where data patterns and structures play a key role in training models and recognising trends.

4. Quality Assurance: Analysing the binary content of files ensures the quality and accuracy of documents. By examining structural components and verifying expected patterns, you can identify discrepancies that might indicate errors or inconsistencies.

5. Risk Assessment: Analysing the binary structure of files lets you identify potential structures that could harbour security threats or vulnerabilities. Recognising unusual patterns or headers can facilitate proactive risk mitigation.

6. Research and Academia: Understanding the contents and structural patterns within documents is essential for identifying trends and drawing insights in research and academia. This extends to security research, where analysing the binary structure of files can reveal crucial evidence.

7. Data Recovery: Analysing the binary structure becomes invaluable when attempting data recovery from corrupted or damaged files. By recognising familiar patterns, you can piece together fragments of the file even when parts of it are corrupted.

8. File Validation: Analysing the binary structure helps validate the integrity of files. Verifying headers, checksums, and other structural components ensures that files haven't been tampered with or modified without authorization.

9. Media and Multimedia Files: When dealing with audio, image, and video files, analysing their binary structure is essential for identifying headers, metadata, and encoding schemes. This information ensures proper rendering and playback of media content.

10. Forensics and Investigations: In the realm of digital forensics, analysing the binary structure of files is a cornerstone for reconstructing events, tracking digital evidence, and understanding the sequence of actions taken within a system.

Understanding the binary structure of files is a fundamental skill in many technical fields, offering insights that range from extracting valuable information to ensuring security and integrity. It's a versatile tool that has implications across disciplines where data and information play a critical role.

API Documentation

To enhance your personal and organisational security against potential attacks, the CDR Platform can be a valuable tool. By utilising the CDR Platform, you can safely analyse files and better inform you on what they contain. You can use the following API's to create an analysis report for any given file:

POST api/v3/cdr-file?response-content=noRebuiltFile&format=JSON
POST api/v3/cdr?response-content=noRebuiltFile&format=JSON

For more information on our API's please visit our API documentation

##API Authentication

To understand how to authenticate with the CDR Platform please see here

CDR Platform Flow of Events

Upon making a request to the CDR Platform the following will happen:

1. You send a file to the REST API for processing.
2. The file is stored in the CDR Platform whilst processing occurs.
3. The Glasswall Embedded Engine is notified to process the file.
4. The Glasswall Embedded Engine retrieves the file and begins its CDR process.
5. The analysis report is then returned to the user via the API response

Request Construction

The CDR Platform provides a wide range of file processing capabilities, accommodating both binary and base64 encoded files. Additionally, you have the option to leverage policies to guide the file processing according to your needs. For a comprehensive understanding and practical implementation of the policy management feature, consult the Understanding and Using Policy documentation.

When utilising the CDR Platform, you can submit files in either binary or base64 format, offering the flexibility to choose the most appropriate file representation for your specific use case and application requirements. Moreover, if you solely require an analysis report without the clean file, you can make this specific request using the response-content query parameter with the value set to noRebuiltFile. You are also able to request the analysis report in either XML of JSON format by using the format query param and setting the value to either XML or JSON.

This versatile functionality of the CDR Platform empowers you to tailor the file processing process precisely to your preferences and efficiently achieve your objectives with ease.

Binary File Processing

POST {baseUrl}/api/v3/cdr-file?response-content=noRebuiltFile&format=JSON

Base64 Encoded File Processing

Submit the base64 encoded string in the request body to the following endpoint:

POST {baseUrl}/api/v3/cdr?response-content=noRebuiltFile&format=JSON

Request Body Format

The body of the request should be in JSON format and include the base64 field containing the base64 encoded string of the file, and the fileName field specifying the original filename (including the appropriate file extension).

{
  "base64": "string",
  "fileName": "filename.pdf",
}

Variations

A variation of this request is to not pass in the response-content query param. This means that you will get both the rebuilt file and the analysis report back for the file you requested.

You can also pass in format=XML which will generate an XML analysis report instead of JSON. This can be done regardless of the desired output. If you ommit this parameter the default of XML will be applied

Binary File Processing

POST {baseUrl}/api/v3/cdr-file?response-content=noRebuiltFile&format=XML

POST {baseUrl}/api/v3/cdr-file?format=XML

Base64 Encoded File Processing

Submit the base64 encoded string in the request body to the following endpoint:

POST {baseUrl}/api/v3/cdr?response-content=noRebuiltFile&format=XML

POST {baseUrl}/api/v3/cdr?format=XML

Note:

• Replace {baseUrl} with the actual base URL of the Glasswall CDR Platform API.
• Correct auth header should be provided with each request
• For binary file processing, use a multipart form post, while for base64 encoded file processing, provide the file content in the JSON request body with the appropriate filename.

Response Handling

When you submit a request to the binary endpoint for an analysis report, the response will provide you with a binary version of the analysis report. This report can be downloaded and opened in the format you specified in your request.

Alternatively, if your request is directed to the base64 endpoint, the response will consist of a json object. Within this object, the analysis report is presented as a base64 encoded string, accessible through the analysisReport.content field. By decoding this base64 string, you can then access the analysis report in the desired format you've indicated.

{
  "errorReason": null,
  "processingId": "de30c22d-fcef-467c-9ed9-16296318615b",
  "processingStatus": "rebuilt",
  "fileType": "archive",
  "analysisReport": { 
    "content": "UEsDBBQAAAgIACU/EFeWuyNVWwAAAL0AAAARAAAAbWFua...",
    "contentType": "application/octet-stream",
    "contentEncoding": "base64"
  }
  "rebuiltFile": {
  }
}

When you open the report there will be a number of information points which you may want to pay attention to. For more information on what is contained in an analysis report please see here

Objective Achievement

You have now been able to conduct a comprehensive analysis of the provided file's contents, successfully extracting valuable insights, and relevant information regarding the file's structure, and potentially embedded media. This achievement facilitated the extraction of meaningful and actionable data, contributing to informed decision-making and enhancing overall understanding.

Quick Start

If you wish to take a look for yourself you can follow our quick start guide and use the CDR Platform yourself.