Submit a Sample Verdict Change (API)

Changes the WildFire verdict applied to a sample. Verdict changes apply only to those samples submitted to the WildFire appliance, and the verdict for the same sample remains unchanged in the WildFire global cloud. Use this resource to update incorrect verdicts generated by local WildFire analysis.
The WildFire private cloud content package is updated to reflect any verdict changes that you make (on the firewall, select DeviceDynamic UpdatesWF-Private to enable WildFire private cloud content updates). When you change a sample verdict to malicious, the WildFire appliance generates a new signature to detect the malware and adds that signature to the WildFire private cloud content package. When you change a sample verdict to benign, the WildFire appliance removes the signature from the WildFire private cloud content package.

Resource

/submit/local-verdict-change/
Code copied to clipboard
Unable to copy due to lack of browser support.

Request Parameters

Use the following parameters when changing a WildFire appliance verdict for a sample:
Parameters
Description
Example
apikey
Code copied to clipboard
Unable to copy due to lack of browser support.
(Required) API key
Example:
apikey=b0e0e395614d46170ee7498452967c71
Code copied to clipboard
Unable to copy due to lack of browser support.
hash
Code copied to clipboard
Unable to copy due to lack of browser support.
(Required) SHA-256 hash value of the sample
Example:
hash=afe6b95ad95bc689c356f34
	ec8d9094c495e4af57c932ac413b65ef132063acc
Code copied to clipboard
Unable to copy due to lack of browser support.
comment
Code copied to clipboard
Unable to copy due to lack of browser support.
(Required) A description of the change request in quotes, with a maximum length of 2,048 characters.
Example:
comment=This
is a legitimate sample that erroneously generated a value of malware. Modifying
to benign.
Code copied to clipboard
Unable to copy due to lack of browser support.
verdict
Code copied to clipboard
Unable to copy due to lack of browser support.
(Required) The new verdict to be applied to the sample
The verdict value can have one of the following:
  • 0: benign
  • 1: malware
  • 2: grayware
  • 4: phishing (Applicable only to samples processed through email link analysis.)
Example:
verdict=1
Code copied to clipboard
Unable to copy due to lack of browser support.

Example Request

Make a POST request to the /submit/local-verdict-change resource and include the API key, the SHA-256 hash value of the sample, the desired verdict for the sample, and a comment with a description of the change.
In the request, include the API key, the hash value of the sample, and the new verdict for the sample:
curl
-k -F ‘apikey=b0e0e395614d46170ee7498452967c71’ -F ‘hash=afe6b95ad95bc689c356f34ec8d9094c495e4af57c932ac413b65ef132063acc’
-F ‘verdict=1’ -F ‘comment=changing verdict from benign to malicious’ ‘https://10.1.1.1/publicapi/submit/local-verdict-change’
Code copied to clipboard
Unable to copy due to lack of browser support.
The XML response verifies a successful verdict change. Example:
<wildfire> 
    <body>verdict is changed (old verdict: 0, new verdict:1)</body> 
    <headers/> 
</wildfire> 
Code copied to clipboard
Unable to copy due to lack of browser support.

Related Documentation