Query compressed file detection results with ListCompressFileDetectResult - Security Center

Retrieves a list of file detection results from an archive.

Operation description

Use this API to retrieve detection results for files within a compressed file that has been submitted for detection. The system retains detection results for 5 hours, during which you can query them multiple times. To submit a file for detection, use the CreateFileDetect API. To retrieve the detection result for the compressed file itself, use the GetFileDetectResult API.

All file detection APIs include the HashKey parameter, which is the unique file identifier.

For malicious file detection (when Type is 0), you must provide the MD5 or SHA-256 hash of the complete file content. Calculate this value before you call the API.

For Skill compressed file detection (when Type is 6), obtain the HashKey from the return value of the CreateFileDetect API.

Note: You must use the same HashKey for the submission and query requests for a single detection. Otherwise, you cannot correctly submit the file for detection or retrieve its results.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-sas:ListCompressFileDetectResult

list

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
SourceIp	string	No	The source IP address of the request.	27.9.XX.XX
HashKey	string	No	The unique identifier for the file.	0a212417e65c26ff133cfff28f6c****
CurrentPage	integer	Yes	The page number. Default value: 1.	1
PageSize	integer	Yes	The number of entries per page. Default value: 20.	20

Response elements

Element	Type	Description	Example
	object
RequestId	string	The unique ID of the request, generated by Alibaba Cloud. Use this ID for troubleshooting.	E10BAF1C-A6C5-51E2-866C-76D5922E****
PageInfo	object	The pagination information.
CurrentPage	integer	The current page number.	1
PageSize	integer	The number of entries per page.	20
TotalCount	integer	The total number of entries.	55
ResultList	array<object>	A list of detection results for the files in the archive.
	object	The details of a file detection result.
HashKey	string	The unique identifier for the file.	0a212417e65c26ff133cfff28f6c****
Result	integer	The detection result of the file. Valid values: 0: safe file 1: suspicious file 3: detection in progress	0
Score	integer	The detection score for the file. The following list describes the score ranges and corresponding risk levels: 0–60: Safe 61–70: Risky 71–80: Suspicious 81–100: Malicious Important A higher score indicates a greater risk. Note This parameter is not returned when `Type` is `6`.	100
VirusType	string	The threat type. Valid values: Trojan: trojan WebShell: A website backdoor Backdoor: A generic backdoor RansomWare: ransomware Scanner: scanner Stealer: stealer Malbaseware: Contaminated base software Hacktool: hacktool Engtest: Engine test program Downloader: downloader Virus: virus Miner: miner Worm: worm DDoS: DDoS trojan Malware: malware Backdoor: reverse shell backdoor RiskWare: riskware Proxytool: proxy tool Suspicious: suspicious program MalScript: malicious script Rootkit: rootkit Exploit: exploit Note This parameter is not returned when `Result` is `0` or `3`.	WebShell
Ext	string	Additional information about the detection result.	{ "HighLight": [ [ 23245, 23212 ] ], "FileLabel": [ "PE32", "Zip", "SFX", "encrypted" ] }
Path	string	The file path within the archive.	/root/1.zip/test****

Examples

Success response

JSON format

{
  "RequestId": "E10BAF1C-A6C5-51E2-866C-76D5922E****",
  "PageInfo": {
    "CurrentPage": 1,
    "PageSize": 20,
    "TotalCount": 55
  },
  "ResultList": [
    {
      "HashKey": "0a212417e65c26ff133cfff28f6c****",
      "Result": 0,
      "Score": 100,
      "VirusType": "WebShell",
      "Ext": "{\n    \"HighLight\":\n    [\n        [\n            23245,\n            23212\n        ]\n    ],\n    \"FileLabel\":\n    [\n        \"PE32\",\n        \"Zip\",\n        \"SFX\",\n        \"encrypted\"\n    ]\n}",
      "Path": "/root/1.zip/test****"
    }
  ]
}

Error codes

HTTP status code	Error code	Error message	Description
400	RequestTooFrequently	Request too frequently, please try again later
400	GetResultFail	Get result fail, found no detect record for this file or result has been expired
400	InvalidApiDetectType	Unsupported Api Detect Type.	The file type is not supported.
500	ServerError	ServerError
500	SystemBusy	System busy, please try again later.
403	NoPermission	caller has no permission	You are not authorized to do this operation.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.