--- title: "ListMalware" method: GET path: "/v1/namespaces/{tenant_meta.namespace}/malware" tags: ["MalwareService"] --- # ListMalware `GET /v1/namespaces/{tenant_meta.namespace}/malware` List all malware in the namespace. ## Path parameters - `tenant_meta.namespace` string, required ## Query parameters - `list_parameters.filter` string - `list_parameters.page_token` integer - `list_parameters.page_size` integer - `list_parameters.action` string - `list_parameters.mask` string - `list_parameters.traverse` boolean - `list_parameters.sort.path` string - `list_parameters.sort.order` 'SORT_ENTRY_ORDER_UNSPECIFIED' | 'SORT_ENTRY_ORDER_ASC' | 'SORT_ENTRY_ORDER_DESC' - `list_parameters.count` boolean - `list_parameters.group.aggregation_paths` string - `list_parameters.group.show_aggregation_uuids` boolean - `list_parameters.group.unique_count_paths` string - `list_parameters.group.unique_value_paths` string - `list_parameters.ci_run_uuid` string - `list_parameters.page_id` string - `list_parameters.group_by_time.aggregation_paths` string - `list_parameters.group_by_time.show_aggregation_uuids` boolean - `list_parameters.group_by_time.interval` 'GROUP_BY_TIME_INTERVAL_UNSPECIFIED' | 'GROUP_BY_TIME_INTERVAL_YEAR' | 'GROUP_BY_TIME_INTERVAL_QUARTER' | 'GROUP_BY_TIME_INTERVAL_MONTH' | 'GROUP_BY_TIME_INTERVAL_WEEK' | 'GROUP_BY_TIME_INTERVAL_DAY' | 'GROUP_BY_TIME_INTERVAL_HOUR' | 'GROUP_BY_TIME_INTERVAL_MINUTE' | 'GROUP_BY_TIME_INTERVAL_SECOND' - `list_parameters.group_by_time.group_size` integer - `list_parameters.group_by_time.start_time` string, date-time - `list_parameters.group_by_time.end_time` string, date-time - `list_parameters.group_by_time.mode` string - `list_parameters.group_by_time.aggregation_value_field` string - `list_parameters.group_by_time.aggregation_operator` string - `list_parameters.disable_pagination` boolean ## Response `200` A successful response. - V1ListMalwareResponse — Response to the request to list malware. - `count_response` V1CountResponse — Response to a list count request. - `count` integer — Number of objects matching the given list parameters. - `group_response` V1GroupResponse — Response to a list group request. - `groups` object — Map indexed by values of the fields specified in aggregation_paths, for example, {"[{"key":"meta.kind","value":"Project"}]": { "aggregation_count": { "count": 1649 } } }. - `list` V1ListMalwareResponseList - `objects` V1Malware[] - `meta` V1Meta, required — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `spec` V1MalwareSpec, required - `additional_notes` string[] — Additional notes for the malware record. - `advisory_last_updated` string, date-time — Timestamp of the last update of the malware record by the advisory. - `advisory_published` string, date-time — Date when the advisory published the malware record. - `aliases` string[] — Aliases of the malware record. - `contested` boolean — Has the malware record been contested. - `contested_date` string, date-time — Date when the malware record was contested. - `contested_reason` string — Reason for the malware record being contested. - `contributing_feeds` SpecMalwareSource[] — Feeds that contributed to this record. Set on merge when more than one source applies; each value is a concrete feed (not UNSPECIFIED). Empty when a single feed supplies the record or provenance is not tracked. - `cwe_id` string — The CWE ID for the malware record. - `deletion_exempt` boolean — When true, this record is exempt from orphaned malware deletion and will never be automatically removed during ingestion cleanup, regardless of whether it was ingested. - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE', required — - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `iocs` V1MalwareIOCAttribute[] — IOC attributes of the malware found during the analysis. - `type` 'IOC_TYPE_UNSPECIFIED' | 'IOC_TYPE_URL' | 'IOC_TYPE_IP' | 'IOC_TYPE_DOMAIN' | 'IOC_TYPE_FILENAME' | 'IOC_TYPE_FILEPATH' | 'IOC_TYPE_DIGEST_SHA1' | 'IOC_TYPE_DIGEST_SHA256' | 'IOC_TYPE_DIGEST_SHA512' | 'IOC_TYPE_DIGEST_MD5' | 'IOC_TYPE_WALLET_ADDRESS' | 'IOC_TYPE_REGISTRY_ACCOUNT_NAME' | 'IOC_TYPE_REGISTRY_ACCOUNT_EMAIL', required — IOCType classifies the type of Indicator of Compromise. - `value` string, required — Value of the IOC attribute. - `malware_detected_on` string, date-time — Date when the malware was detected. - `package_name` string, required — Name of malicious package. - `package_version` V1PackageVersion — PackageVersion represents a version of a package. - `context` V1Context, required — Contexts keep objects from different scans separated. - `id` string, required — The context ID, such as a pull request ID or branch reference. - `tags` string[] — A list of tags applied to a context. Used primarily for CI and SBOM contexts. - `type` 'CONTEXT_TYPE_UNSPECIFIED' | 'CONTEXT_TYPE_MAIN' | 'CONTEXT_TYPE_EXTERNAL' | 'CONTEXT_TYPE_CI_RUN' | 'CONTEXT_TYPE_SBOM' | 'CONTEXT_TYPE_REF', required — - CONTEXT_TYPE_MAIN: Objects from a scan of the default branch. All objects in the oss namespace are in the main context. The context id is always "default". - CONTEXT_TYPE_EXTERNAL: Indicates that this object is a copy/temporary value of an object in another project. Used for same-tenant dependencies. In source code reference this is equivalent to "vendor" folders. Package versions in the external context are only scanned for call graphs. No other operations are performed on them. - CONTEXT_TYPE_CI_RUN: Objects from a PR scan. The context id is the PR UUID. Objects in this context are deleted after 30 days. - CONTEXT_TYPE_SBOM: Objects from an SBOM scan. The context id is the SBOM serial number or some other unique identifier. - CONTEXT_TYPE_REF: Objects from a scan of a specific branch. The context id is the branch reference name. - `will_be_deleted_at` string, date-time — Time that all objects in this context will be deleted. This field is deprecated and will be removed in the future. Please use the meta.will_be_deleted_at field instead. - `meta` V1Meta, required — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - … - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `processing_status` V1ProcessingStatus - `analytic_time` string, date-time — Last time a project was analyzed. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `deactivated` boolean — Indicates whether the project is deactivated. Deactivated projects are not scanned and are not visible to users in the UI by default. - `disable_automated_scan` boolean — This is a private package and it must not be scanned by the background scheduler. It will be scanned by an endorctl client instead. Default: false. - `metadata` V1ProcessingStatusMetadata - … - `queue_time` string, date-time — Last time a project was queued. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `scan_state` 'SCAN_STATE_UNSPECIFIED' | 'SCAN_STATE_NOT_PROCESSED' | 'SCAN_STATE_IDLE' | 'SCAN_STATE_INGESTING' | 'SCAN_STATE_ANALYTIC' | 'SCAN_STATE_UNREACHABLE' | 'SCAN_STATE_REQUEST_FULL_RESCAN' | 'SCAN_STATE_REQUEST_INCREMENTAL_RESCAN' | 'SCAN_STATE_QUEUED' | 'SCAN_STATE_QUARANTINED' — Scan state for a project or package version. - SCAN_STATE_NOT_PROCESSED: Object has not been processed by the system yet. Set when the project or package is created for the first time. A new project or package version is automatically placed in this state. - SCAN_STATE_IDLE: Object has been scanned at least once. - SCAN_STATE_INGESTING: Object is being scanned. - SCAN_STATE_ANALYTIC: Object is being analyzed. - SCAN_STATE_UNREACHABLE: Object cannot be ingested because it is not reachable from the scheduler. - SCAN_STATE_REQUEST_FULL_RESCAN: Object is marked for a complete rescan. This only applies to OSS projects. - SCAN_STATE_REQUEST_INCREMENTAL_RESCAN: Object is marked for an incremental rescan, where only new packages discovered in the scan are added. Indicates that this project should be rescanned with a higher priority. Often because it is used by a customer and we need any new packages to be discovered and scanned with higher priority. If the project is put in this state, we will scan any new packages at high priority but we will not re-scan older packages. - SCAN_STATE_QUEUED: Object is queued to be scanned. - SCAN_STATE_QUARANTINED: Scan scheduling was unsuccessful due to a system errors. Object is quarantined from additional scheduling. Potentially object is an orphan or similar situations. - `scan_time` string, date-time — Last time a project was ingested. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt - `spec` V1PackageVersionSpec, required - `bazel_metadata` V1BazelMetadata — BazelMetadata contains the Bazel metadata. - … - `call_graph_available` boolean — Set to true if a call graph was successfully created by the latest scan. - `code_owners` V1CodeOwnerData — Code owner information for a file path or pattern. - … - `container_metadata` V1ContainerMetadata — ContainerMetadata is the metadata of a container image. - … - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE' — - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `internal_reference_key` string — Unique key for the package generated by Endor Labs to simplify lookups. - `language` 'LANGUAGE_UNSPECIFIED' | 'LANGUAGE_GO' | 'LANGUAGE_JAVA' | 'LANGUAGE_SCALA' | 'LANGUAGE_PYTHON' | 'LANGUAGE_RUST' | 'LANGUAGE_JS' | 'LANGUAGE_RUBY' | 'LANGUAGE_CSHARP' | 'LANGUAGE_PHP' | 'LANGUAGE_TYPESCRIPT' | 'LANGUAGE_KOTLIN' | 'LANGUAGE_SWIFT' | 'LANGUAGE_OBJECTIVEC' | 'LANGUAGE_C' | 'LANGUAGE_CPP' | 'LANGUAGE_SWIFTURL' | 'LANGUAGE_CONAN' - `package_name` string — The name of the package of this package version. It is calculated automatically from the package version name. - `precomputed_call_graph_state` 'PRECOMPUTED_STATE_UNSPECIFIED' | 'PRECOMPUTED_STATE_SUCCESS' | 'PRECOMPUTED_STATE_FAILURE' — PrecomputedState represents the state of precomputed operations. - PRECOMPUTED_STATE_UNSPECIFIED: UNSPECIFIED indicates that the precomputed state is not set or unknown. - PRECOMPUTED_STATE_SUCCESS: SUCCESS indicates that the precomputed operation completed successfully. - PRECOMPUTED_STATE_FAILURE: FAILURE indicates that the precomputed operation failed. - `project_uuid` string, required — The UUID of the project to which this package version belongs. - `relative_path` string — Relative path of the package from where the package was discovered relative to the workspace root. - `release_timestamp` string, date-time — The release timestamp corresponding to the time a particular package version was released. - `resolution_errors` PackageVersionResolutionErrors — ResolutionErrors captures the error results. - … - `resolved_dependencies` V1Bom - … - `source_code_reference` PackageVersionSourceCodeReference - … - `unresolved_dependencies` V1PackageVersionDependency[] — The exact dependency declarations in the package manager descriptor file. In Golang, this represents the list of dependencies in the go.mod. In Java/Maven, this represents the list of dependencies in the pom.xml. - … - `tenant_meta` V1TenantMeta — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The UUID of the package version resource. - `pkg_release_date` string, date-time — Release date of the package version. - `purl` string — PURL of the package without the version component. - `ranges` SpecMalwareRanges - `ranges` SpecMalwareRange[] - `fixed` string — The version or commit in which malicious behaviour was fixed. - `introduced` string — The earliest version or commit in which malicious behaviour was introduced. - `osv_id` string — The OSV ID for the malware record. - `repo` string — The repository URL. - `type` 'MALWARE_RANGE_TYPE_UNSPECIFIED' | 'MALWARE_RANGE_TYPE_GIT' | 'MALWARE_RANGE_TYPE_SEMVER' | 'MALWARE_RANGE_TYPE_ECOSYSTEM' — Type of the version information. - `reasons` string[] — Reasons for flagging the package as malicious. - `references` VulnSpecReference[] — Reference URLs for the malware record. - `type` 'REFERENCE_TYPE_UNSPECIFIED' | 'REFERENCE_TYPE_WEB' | 'REFERENCE_TYPE_ADVISORY' | 'REFERENCE_TYPE_REPORT' | 'REFERENCE_TYPE_FIX' | 'REFERENCE_TYPE_PACKAGE' | 'REFERENCE_TYPE_ARTICLE', required - `url` string, required — The vulnerability URL. - `source` 'MALWARE_SOURCE_UNSPECIFIED' | 'MALWARE_SOURCE_ENDOR' | 'MALWARE_SOURCE_OSV' | 'MALWARE_SOURCE_AMF' | 'MALWARE_SOURCE_INTERNAL' — - MALWARE_SOURCE_ENDOR: Merged from one or more external malware feeds (OSV, AMF, INTERNAL etc). - MALWARE_SOURCE_INTERNAL: Endor security research team assessments. - `status` string — Status of the malware record. - `summary` string — Summary of the malware record. - `upsert_key` string — The upsert key of the malware record. This will be ecosystem+package_name_version for specific version type records. For range type records, it will be ecosystem+package_name. - `version` SpecMalwareVersion - `osv_id` string — The status of the malware record. - `version` string — The version of the malware record. - `tenant_meta` V1TenantMeta — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The UUID of a malware record. - `response` V1ListResponse — Response to a list request. - `next_page_id` string — The UUID of last message retrieved. - `next_page_token` integer — Pagination token that can be used to retrieve the next page of results. ## Other responses - `default` — An unexpected error response. --- [API](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference.md) · [All operations](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/endorlabs/endor-labs-rest-api-reference/versions/2fe1f84213b3/schema)