Report Schema

Here you will find an explanation of the JSON report schema

allowed

• file_paths: JSON array of files with Allowed result

blocked

• file_paths: JSON array of file paths with a Blocked result

blocked_av

• file_paths: JSON array of file paths with a Blocked result from the onboard AV scanning

blocked_manifest

• file_paths: JSON array of file paths with a Blocked result from the signed manifest on the media

cdr

• file_paths: JSON array of file paths that were sanitized

client_identity

JSON object containing a collection of scan clients with their respective info:

• clients: array of scan clients

  • product_type: name of the product that performed scanning of files

  • name: display name of the system

  • scan_profile: name of the scan profile used

  • session_id: the ID of the scan session

  • timestamp: UNIX epoch timestamp of the start of the scan session

  • av_info: JSON object containing objects describing the scanning engines used from the product

    • key is the name of AV engine

    • def_time: timestamp of the last time the engine was updated

    • eng_id: string used to identify the engine

complex_archives

• file_paths: JSON array of file paths that are archives with identified issues

concealed

• file_paths: JSON array of file paths not found in the manifest

coo

• file_paths: JSON array of file paths blocked due to Country Of Origin

dlp

• file_paths: JSON array of file paths corresponding to sensitive data found results

encrypted

• file_paths: JSON array of file paths that are encrypted/password protected

end_time

scan end timestamp

infected

• file_paths: JSON array of infected file paths

manifest_valid

(optional): boolean value

true if the manifest was valid

false if the manifest was invalid

missing if the manifest could not be validated

media_errors

• file_paths: JSON array of file paths that MMF had issues with validating

media_type

string value

Type of media scanned: USB-A, USB-C, SD Card, MicroSD Card, Compact Flash

name

name for this specific report made from internal instance ID, date, and time

paths

JSON array of mount points for scanned media

result_set

JSON object containing objects for individual file results

• key is the full path to the file

  • av_info: (optional) JSON object containing onboard AV scan engine results for the file (if it was scanned)

    • scan_result_i: integer of the scan result

    • scan_time: time taken to scan (in seconds)

    • threat_found: name of detected threat

  • file_info: JSON object containing details about this file

    • display_name: display name for this file

    • file_size: size of file

    • sha256: SHA256 hash of file

  • primary_result: the overall scan result determined from all engine results

  • transfer_info: JSON object containing details on where the file was sent when primary_result is Allowed, empty for any other primary result.

    • final_destination: file path from the root of the Firewall drive available on the Host

    • method: firewall -> files are displayed on the Firewall drive

    • success: boolean (true or false)

session_error

(optional): string error message.

Message if there was an issue that stopped the session before completion

session_type

type of session

• validation -> Session where a media manifest was used

start_time

scan start time

total_result_count

total count of all files seen

vulnerable

• file_paths: JSON array of file paths that MMF had issues with validating

uuid: (internal use only)

version: (internal use only)