{"id":9153,"date":"2021-01-05T18:19:46","date_gmt":"2021-01-05T17:19:46","guid":{"rendered":"https:\/\/www.nextron-systems.com\/?p=9153"},"modified":"2023-02-02T16:18:03","modified_gmt":"2023-02-02T15:18:03","slug":"valhalla-api-1-1-changes","status":"publish","type":"post","link":"https:\/\/www.nextron-systems.com\/2021\/01\/05\/valhalla-api-1-1-changes\/","title":{"rendered":"VALHALLA API 1.1 Changes"},"content":{"rendered":"

[et_pb_section fb_built=”1″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}” da_is_popup=”off” da_exit_intent=”off” da_has_close=”on” da_alt_close=”off” da_dark_close=”off” da_not_modal=”on” da_is_singular=”off” da_with_loader=”off” da_has_shadow=”on” da_disable_devices=”off|off|off”][et_pb_row _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”]We’ve made some changes to VALHALLA and released version 1.1 and valhallAPI version 0.5 to reflect these changes.[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”1_4,3_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”1_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

The new modified date shows when this rule has last been modified.\u00a0<\/p>\n

See this<\/a> example.<\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”3_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-05-at-16.56.28.png” title_text=”Screenshot 2021-01-05 at 16.56.28″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”1_4,3_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”1_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”]The modified date will also appear in the JSON feed and metadata of the text feed.[\/et_pb_text][\/et_pb_column][et_pb_column type=”3_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-05-at-18.16.45.png” title_text=”Screenshot 2021-01-05 at 18.16.45″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”1_4,3_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”1_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

Rules now contain a “hash1” value, which is one of the samples from which it has been derived.<\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”3_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-05-at-17.18.39.png” title_text=”Screenshot 2021-01-05 at 17.18.39″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

The API offers two new endpoints named “keyword” and “keyword-matches”, which allow two new lookups. (customers only)<\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”2_5,3_5″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”2_5″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

The “keyword” lookup is not very spectacular and simply returns a list of rule meta data based on a certain keyword.\u00a0<\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”3_5″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-05-at-17.23.11.png” title_text=”Screenshot 2021-01-05 at 17.23.11″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”2_5,3_5″ _builder_version=”4.16″ _module_preset=”default” custom_padding=”27px|||||” global_colors_info=”{}”][et_pb_column type=”2_5″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

However, the “keyword-matches<\/a>” endpoint adds a new vector. It combines a keyword lookup on the rules with a lookup on matches created by these rules.\u00a0<\/p>\n

E.g. by providing the keyword “Turla”, you get a list of sample hashes on which Turla related rules matched in the past.<\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”3_5″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2021\/01\/Screenshot-2021-01-05-at-16.55.35.png” title_text=”Screenshot 2021-01-05 at 16.55.35″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.18.0″ _module_preset=”default” hover_enabled=”0″ global_colors_info=”{}” sticky_enabled=”0″]The new valhallaAPI client and Python module<\/a> in version 0.5 allow to use these features.<\/p>\n

You can upgrade your current version with<\/p>\n

\npip3 install valhallaAPI --upgrade\n<\/pre>\n
[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
We’ve made some changes to VALHALLA and released version 1.1 and valhallAPI version 0.5 to reflect these changes.The new modified date shows when this rule has last been modified.\u00a0 See this example.The modified date will also appear in the JSON feed and metadata of the text feed.Rules now contain a “hash1” value, which is one of the samples from which it has been derived.The API offers two new endpoints named “keyword” and “keyword-matches”, which allow two new lookups. (customers only)The “keyword” lookup is not very spectacular and simply returns a list of rule meta data based on a certain keyword.\u00a0However, the “keyword-matches” endpoint adds a new vector. It combines a keyword lookup on the rules with a lookup on matches created by these rules.\u00a0 E.g. by providing the keyword “Turla”, you get a list of sample hashes on which Turla related rules matched in the past.The new valhallaAPI client and Python module in version 0.5 allow to use these features. You can upgrade your current version with pip3 install valhallaAPI –upgrade<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[46,1,193],"tags":[159,188,322,571,514,551],"class_list":["post-9153","post","type-post","status-publish","format-standard","hentry","category-newsletter","category-nextron","category-valhalla","tag-api","tag-changes","tag-hashes","tag-keyword","tag-lookup","tag-valhalla"],"yoast_head":"\nVALHALLA API 1.1 Changes - Nextron Systems<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.nextron-systems.com\/2021\/01\/05\/valhalla-api-1-1-changes\/\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.nextron-systems.com\/2021\/01\/05\/valhalla-api-1-1-changes\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2021\/01\/05\/valhalla-api-1-1-changes\/\"},\"author\":{\"name\":\"Florian Roth\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\"},\"headline\":\"VALHALLA API 1.1 Changes\",\"datePublished\":\"2021-01-05T17:19:46+00:00\",\"dateModified\":\"2023-02-02T15:18:03+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2021\/01\/05\/valhalla-api-1-1-changes\/\"},\"wordCount\":830,\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"keywords\":[\"api\",\"changes\",\"hashes\",\"Keyword\",\"lookup\",\"VALHALLA\"],\"articleSection\":[\"Newsletter\",\"Nextron\",\"VALHALLA\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.nextron-systems.com\/2021\/01\/05\/valhalla-api-1-1-changes\/\",\"url\":\"https:\/\/www.nextron-systems.com\/2021\/01\/05\/valhalla-api-1-1-changes\/\",\"name\":\"VALHALLA API 1.1 Changes - Nextron Systems\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#website\"},\"datePublished\":\"2021-01-05T17:19:46+00:00\",\"dateModified\":\"2023-02-02T15:18:03+00:00\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.nextron-systems.com\/2021\/01\/05\/valhalla-api-1-1-changes\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.nextron-systems.com\/#website\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"name\":\"Nextron Systems\",\"description\":\"We Detect Hackers\",\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.nextron-systems.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\",\"name\":\"Nextron Systems GmbH\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"contentUrl\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"width\":260,\"height\":260,\"caption\":\"Nextron Systems GmbH\"},\"image\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\",\"name\":\"Florian Roth\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"caption\":\"Florian Roth\"},\"description\":\"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.\",\"url\":\"https:\/\/www.nextron-systems.com\/author\/florian\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"VALHALLA API 1.1 Changes - Nextron Systems","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.nextron-systems.com\/2021\/01\/05\/valhalla-api-1-1-changes\/","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.nextron-systems.com\/2021\/01\/05\/valhalla-api-1-1-changes\/#article","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/2021\/01\/05\/valhalla-api-1-1-changes\/"},"author":{"name":"Florian Roth","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919"},"headline":"VALHALLA API 1.1 Changes","datePublished":"2021-01-05T17:19:46+00:00","dateModified":"2023-02-02T15:18:03+00:00","mainEntityOfPage":{"@id":"https:\/\/www.nextron-systems.com\/2021\/01\/05\/valhalla-api-1-1-changes\/"},"wordCount":830,"publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"keywords":["api","changes","hashes","Keyword","lookup","VALHALLA"],"articleSection":["Newsletter","Nextron","VALHALLA"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.nextron-systems.com\/2021\/01\/05\/valhalla-api-1-1-changes\/","url":"https:\/\/www.nextron-systems.com\/2021\/01\/05\/valhalla-api-1-1-changes\/","name":"VALHALLA API 1.1 Changes - Nextron Systems","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/#website"},"datePublished":"2021-01-05T17:19:46+00:00","dateModified":"2023-02-02T15:18:03+00:00","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.nextron-systems.com\/2021\/01\/05\/valhalla-api-1-1-changes\/"]}]},{"@type":"WebSite","@id":"https:\/\/www.nextron-systems.com\/#website","url":"https:\/\/www.nextron-systems.com\/","name":"Nextron Systems","description":"We Detect Hackers","publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.nextron-systems.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.nextron-systems.com\/#organization","name":"Nextron Systems GmbH","url":"https:\/\/www.nextron-systems.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","contentUrl":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","width":260,"height":260,"caption":"Nextron Systems GmbH"},"image":{"@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919","name":"Florian Roth","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","caption":"Florian Roth"},"description":"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.","url":"https:\/\/www.nextron-systems.com\/author\/florian\/"}]}},"_links":{"self":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/9153","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/comments?post=9153"}],"version-history":[{"count":11,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/9153\/revisions"}],"predecessor-version":[{"id":15916,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/9153\/revisions\/15916"}],"wp:attachment":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/media?parent=9153"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/categories?post=9153"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/tags?post=9153"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}