atd 0.1.5

McAfee ATD API

This packet is compose of two elements, a class called atd.py and a script called atddir.py.

The class abstracts the McAfee ATD Sandboxing platform API, in order to facilitate the connection, authentication, uploading and the retrieval process of informacion sent to this analysis box.

The script, is an example of how to use this class to create a process able to monitor de files in a folder, move them to quarantine if they are infected and inform about the reputation of the object.

Use examples: Examples:

1.) *********************************************************

atddir.py -u admin -p admin -atd 192.168.0.202 -path c:path

Analyze the content of the folder c:path, sending the files to the ATD box using the default profile

2.-) *********************************************************

atddir.py -u admin -p admin -atd 192.168.0.202 -path \pathfilename.pdf -vm 20

Analyze the file in the share \pathfilename.pdf, sending it to the ATD box using the profile with the ID 20

3.-) *********************************************************

atddir.py -u admin -p admin -atd 192.168.0.202 -path c:/path/malware -vm 20 -q c:quarantine -monitor

Analyze the folder c:/path/malware in monitor mode if the file is supicious (severity >=3) it will be moved to quarantine

4.-) *********************************************************

atddir.py -u admin -p admin -atd 192.168.0.202 -path c:/path/malware -vm 20 -q c:quarantine -monitor -delta 86400

Same as before but in this case if the files has not been re-analyze in 86400 seconds they will be re-analyze

5.-) *********************************************************

atddir.py -u admin -p admin -atd 192.168.0.202 -path \path\filename.pdf -vm 20 -force

Even if the file filename.pdf has been already analyzed, so it is cache locally the -force paramete forces the re-analisys of the file