The response to signature searches is similar
to sample and sessions searches. Use the af_cookie parameter
from the initial response to view the results of your search:
{
{
"total_count": 1,
"page_count": 1,
"signatures": [{
"metadata": {
"severity": "low",
"reference": "http://www.spywareguide.com/spydet_3531_expertantivirus.html,http://www.ca.com/securityadvisor/pest/pest.aspx?id=45311130",
"panOsMaximumVersion": "",
"description": "This signature detects the runtime behavior of ExpertAntivirus 4.1ExpertAntivirus is a rogue anti-spyware program that reports false positive infections.",
"panOsMinimumVersion": "6.1.0",
"action": "alert",
"category": "adware",
"changeData": ""
},
"cve": "",
"signatureName": "ExpertAntivirus_4_1",
"vendor": "",
"signatureType": "spyware",
"firstReleaseTime": "2015-06-26 UTC",
"signatureId": 11785,
"latestReleaseTime": "2020-06-09 UTC",
"latestReleaseVersion": 8281,
"status": "released",
"firstReleaseVersion": 509
}]
}
Use the af_cookie parameter
when you check on the results of your search using the /ips/search/result/, /panav/search/result, or dns/search/result/ resource.