# Threatray Documentation

> Documentation for Threatray

## Guides
- [Threatray On-Boarding Documentation](https://docs.threatray.com/docs/introduction-video-series.md)
- [Submitting Files](https://docs.threatray.com/docs/submitting-files.md)
- [Analysis Report](https://docs.threatray.com/docs/analysis-report.md)
- [Detection & Identification Verdicts](https://docs.threatray.com/docs/detection-identification-verdicts.md)
- [Search](https://docs.threatray.com/docs/search.md)
- [Retrohunt](https://docs.threatray.com/docs/retrohunt.md)
- [OSINT Hunt](https://docs.threatray.com/docs/osint-hunt.md)
- [IDA Plugin](https://docs.threatray.com/docs/ida-plugin.md)
- [MCP Server](https://docs.threatray.com/docs/mcp-server.md)
- [Chrome Extension](https://docs.threatray.com/docs/chrome-extension.md)
- [Private YARA Rules](https://docs.threatray.com/docs/private-yara-rules.md)
- [Endpoint Scanning](https://docs.threatray.com/docs/endpoint-scanning.md)
- [Integration with Velociraptor](https://docs.threatray.com/docs/integration-with-velociraptor.md)
- [Integration with Microsoft Defender for Endpoint Live Response](https://docs.threatray.com/docs/integration-with-microsoft-defender-for-endpoint-live-response.md)
- [From Binary Code to YARA Rule: A Threatray Walkthrough with Eddiestealer](https://docs.threatray.com/docs/building-accurate-yara-rules.md)

## API Reference
- [Overview](https://docs.threatray.com/reference/overview-api.md)
- [Authentication](https://docs.threatray.com/reference/authentication.md)
- [Core Entities](https://docs.threatray.com/reference/core-entities.md)
- [Submit samples for analysis.](https://docs.threatray.com/reference/post_submissions-samples.md): Submit a file or a ZIP file for analysis. A set of parameters can be given to specify how the file should be analyzed. Note: The parameters starting with raw_binary are only allowed and considered in combination with the parameter raw_binary_file_format set to `unknown`, `raw` or `pe`.
- [Submit URLs for analysis.](https://docs.threatray.com/reference/post_submissions-urls.md): Submit a URL for analysis. All files downloaded from the URL are dynamically analyzed based on the parameters given.
- [Submit an endpoint scan archive.](https://docs.threatray.com/reference/post_submissions-endpoint-scan-archive.md): Submit an endpoint scan archive for analysis.
- [Submit a MANS file.](https://docs.threatray.com/reference/post_submissions-mans-file.md): Submit a Mandiant MANS file for analysis.
- [Submit a minidump.](https://docs.threatray.com/reference/post_submissions-minidump.md): Submit a minidump file for analysis.
- [Reanalyze a sample by hash.](https://docs.threatray.com/reference/post_samples-hash-analyze.md): Reanalyze a previously submitted sample by its hash. Note: The parameters starting with raw_binary are only allowed and considered in combination with the parameter raw_binary_file_format set to `unknown`, `raw` or `pe`.
- [List sample submissions.](https://docs.threatray.com/reference/get_submissions.md): Get the latest file submissions to the system.
- [List endpoint scan submissions.](https://docs.threatray.com/reference/get_submissions-endpoint-scan.md): Get the latest endpoint scan submissions to the system.
- [List tasks.](https://docs.threatray.com/reference/get_tasks.md): Get a list of tasks, optionally filtered by parameters.
- [Get a task by ID.](https://docs.threatray.com/reference/get_tasks-task-id.md): Get a task by its ID.
- [Get task by analysis ID.](https://docs.threatray.com/reference/get_tasks-by-analysis-analysis-id.md): Get a task by Analysis ID.
- [List sample analyses.](https://docs.threatray.com/reference/get_analyses-samples.md): Get a list of sample analyses with the option to apply a filter to the query.
- [List endpoint scan analyses.](https://docs.threatray.com/reference/get_analyses-endpoint-scans.md): Get a list of endpoint scan analyses with the option to apply a filter to the query.
- [Get an analysis by ID.](https://docs.threatray.com/reference/get_analyses-analysis-id.md): Get an analysis of a sample identified by its analysis ID.
- [Delete an analysis.](https://docs.threatray.com/reference/delete_analyses-analysis-id.md): Delete an analysis identified by its analysis ID.
- [Get the latest analysis of a sample by hash.](https://docs.threatray.com/reference/get_samples-hash.md): Get the latest analysis of a sample identified by hash (MD5, SHA1, SHA256). The contents of the response depend on the type of the analysis, which can be dynamic or static. For static analyses, the keys "processes" and "ioc" are set to "null".
- [Delete a sample by hash.](https://docs.threatray.com/reference/delete_samples-hash.md): Delete a sample and all of its analyses, identified by hash (MD5, SHA1, SHA256).
- [List all analyses of a sample.](https://docs.threatray.com/reference/get_samples-hash-analyses.md): Get a list of all analyses for a sample identified by hash (MD5, SHA1, SHA256). Each entry contains summary metadata for one analysis of the sample.
- [Download file data by hash.](https://docs.threatray.com/reference/get_files-hash-data.md): Download the binary data of a code region (a memory dump or sample) identified by its hash (MD5, SHA1, SHA256).
- [Get file metadata by hash.](https://docs.threatray.com/reference/get_files-hash-metadata.md): Get PE metadata (if its a PE file) and strings on a code region identified by hash (MD5, SHA1, SHA256).
- [Get functions for a file.](https://docs.threatray.com/reference/get_functions-file-hash.md): Retrieves all functions of a binary file.
- [List code detections for functions.](https://docs.threatray.com/reference/get_functions-code-detections.md): Retrieves code detections for each functions of a binary file.
- [Submit a file for CAPA analysis](https://docs.threatray.com/reference/post_capa-analysis-jobs.md): Creates and enqueues a CAPA analysis job for the specified file hash.
- [Get the status of a CAPA analysis job](https://docs.threatray.com/reference/get_capa-analysis-jobs-job-id.md): Retrieves the status of the CAPA analysis job for the specified job ID.
- [Get the latest CAPA analysis for a file](https://docs.threatray.com/reference/get_capa-analysis-results-latest.md): Retrieves the latest CAPA analysis for the specified file SHA256 hash.
- [Submit a dynamic analysis for CAPA analysis](https://docs.threatray.com/reference/post_dynamic-capa-analysis-jobs.md): Creates and enqueues a dynamic CAPA analysis job for the specified analysis ID.
- [Get the status of a dynamic CAPA analysis job](https://docs.threatray.com/reference/get_dynamic-capa-analysis-jobs-job-id.md): Retrieves the status of the dynamic CAPA analysis job for the specified job ID.
- [Get the latest dynamic CAPA analysis for a sandbox execution](https://docs.threatray.com/reference/get_dynamic-capa-analysis-results-latest.md): Retrieves the latest dynamic CAPA analysis for the specified analysis ID.
- [Submit a file for AI analysis](https://docs.threatray.com/reference/post_ai-analysis-jobs.md): Creates and enqueues an AI analysis job that uses LLM-based code understanding to analyze the file's functions, identify behaviors, and provide verdicts.
- [Get the status of an AI analysis job](https://docs.threatray.com/reference/get_ai-analysis-jobs-job-id.md): Retrieves the status of the AI analysis job for the specified job ID.
- [Get the latest AI analysis job for a file](https://docs.threatray.com/reference/get_ai-analysis-jobs-latest.md): Retrieves the most recent AI analysis job for the specified file hash.
- [List AI analysis results for a file](https://docs.threatray.com/reference/get_ai-analysis-results.md): Retrieves all AI analysis results for the specified file hash.
- [Get a specific AI analysis result](https://docs.threatray.com/reference/get_ai-analysis-results-analysis-id.md): Retrieves the full AI analysis result by its ID, including per-function analysis.
- [Search analyses.](https://docs.threatray.com/reference/get_search.md): Submit a search query, e.g. 'ip:"10.11.12.13".
- [Get OSINT data for a file by hash.](https://docs.threatray.com/reference/get_osint-hash.md): Look up open source intelligence (OSINT) for a file identified by its hash (MD5, SHA1, or SHA256). The response lists similar samples that are referenced in OSINT sources (threat reports, blog posts, vendor write-ups), along with extracted metadata such as the report title, summary, malware families and publication date.
- [Fetch a list of Yara rulesets.](https://docs.threatray.com/reference/get_yara-rulesets.md): Retrieves all Yara rulesets with their metadata.
- [Create a new Yara ruleset.](https://docs.threatray.com/reference/post_yara-rulesets.md): Creates a new Yara ruleset with the provided name and rules.
- [Fetch a specific Yara ruleset.](https://docs.threatray.com/reference/get_yara-rulesets-yara-ruleset-id.md): Retrieves the metadata and rules of a single Yara ruleset based on its ID.
- [Update a Yara ruleset.](https://docs.threatray.com/reference/put_yara-rulesets-yara-ruleset-id.md): Updates the metadata of a Yara ruleset. Currently only the name can be updated.
- [Delete a Yara ruleset.](https://docs.threatray.com/reference/delete_yara-rulesets-yara-ruleset-id.md): Deletes a Yara ruleset and its matches based on its ID. It may take a while for the matches to be completely deleted.
- [Update the rules within a Yara ruleset.](https://docs.threatray.com/reference/put_yara-rulesets-yara-ruleset-id-rules.md): Updates the rules associated with a specific Yara ruleset.