TE: Error: verdict is Benign

[checkpointsw]

TE: Error: verdict is Benign

[zoharme]

hi @dipenpatel235, I don't understand the problem
is this a malicious file you're testing?

[Tubbs10]

When you look at the reponse it's giving in debug mode (-d) it says that "verdict": "Benign". This does not match with teapi-master/python/utils/gs.py file that has BENIGN defined as benign (lower case first letter). So fixing this variable to have uppcase first letter for BENIGN and MALICIOUS fixed the issue for me. Not sure though if ERROR and MESSAGE has the same issue.

So my utils/gs.py now looks like this:
BENIGN = 'Benign'
MALICIOUS = 'Malicious'
ERROR = 'error'
MESSAGE = 'message'

and it works as expected. Now also malicious files gets proper severity and confidence values which does not happen if these are wrong.

The output you see comes from teapi-master/python/api/te.py from else statement as it does not match with if and elif statements before:

def __str__(self):
    if self.verdict == utils.gs.BENIGN:
        return 'TE: Benign'
    elif self.verdict == utils.gs.MALICIOUS:
        return 'TE: Malicious, Severity: %d, Confidence: %d' % (
            self.severity, self.confidence)
    else:
        return 'TE: Error: %s' % self.status

I think this is a bug.

[chkp-shakedk]

We no longer support using this tool to access the local Threat Emulation appliance API.
To see instructions on how to upload files on the appliance, see - https://community.checkpoint.com/t5/SandBlast-Network/Best-Practices-for-Threat-Prevention-API-Calls-to-Appliance/td-p/82825