CODEWITHSUNDEEP
sophoslabs-intelix
RPC
RPC

Reputation: 58

What do reputationScore values mean in SophosLabs File Malware Cloud Lookup API

The File Malware Cloud Lookup API returns 'reputationScore' in response. The doc page has various values of reputation score in examples, but it doesn't say what those values mean. How we can make use of those values?

https://api.labs.sophos.com/doc/lookup/files.html

Upvotes: 3

Views: 168

Answers (1)

János Márkus
János Márkus

Reputation: 91

You can see how the result should be evaluated in the FileLookupResponse schema:

[0-19]: Malware
[20-29]: PUA (potentially unwanted application)
[30-69]: Unknown/suspicious
[70-100]: Known good

The default reputationScore is 30, the larger the number, the better its reputation is.

The detailed response fields can be found in the dropdown box titled "Schemas" on the bottom of the page, or you can switch the "Example Value" view for a specific response to a "Schema" view.

Upvotes: 4

Related Questions