--- title: "UpdateMalwareDetectionWorkflow updates an existing workflow configuration." method: PATCH path: "/v1/namespaces/{object.tenant_meta.namespace}/malware-detection-workflows" tags: ["MalwareDetectionWorkflowService"] --- # UpdateMalwareDetectionWorkflow updates an existing workflow configuration. `PATCH /v1/namespaces/{object.tenant_meta.namespace}/malware-detection-workflows` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{object.tenant_meta.namespace}/malware-detection-workflows` - Auth: none declared ## Path parameters - `object.tenant_meta.namespace` string, required ## Request body - MalwareDetectionWorkflowServiceUpdateMalwareDetectionWorkflowBody: Request to update a malware detection workflow. - `object` object: The workflow to update. - `meta` V1Meta: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1MalwareDetectionWorkflowSpec: MalwareDetectionWorkflow specifications. - `auto_promote` boolean: When true, a MALICIOUS assessment from this workflow is auto-promoted to the malware feed on creation, bypassing human review. - `capture_iocs` V1IOCType[]: IoC types this workflow is expected to capture across all signal groups; acts as a workflow-level default. - `disabled` boolean: When true, malware detection is disabled for this workflow. - `infer_mal` boolean: When true, only the primary registry mirror is checked and shortcut verdicts produce MALICIOUS; when false all mirrors are searched and shortcut verdicts produce UNKNOWN. - `is_default` boolean: When true, this workflow is selected by default when no explicit workflow is requested. - `signal_groups` V1MalwareSignalGroup[]: Execution order of signal groups; groups are run in the order they appear in this list. - `name` string: Name that uniquely identifies this group within the workflow. - `signals` V1MalwareDetectionSignal[]: Ordered list of signals in this group. - `account` V1MalwareDetectionAccountSignal: MalwareDetectionAccountSignal fetches publisher account information from the registry. - `binary_strings` V1MalwareDetectionBinaryStringsSignal: MalwareDetectionBinaryStringsSignal extracts strings from binary files and passes them to an LLM for analysis. - `ground_iocs` boolean: When true, discovered IoCs are validated against the extracted string set. - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - … - `max_binaries_per_package` integer: Maximum number of binaries to analyze per package, prioritized by tier. - `max_binary_size_mb` integer: Maximum binary file size in megabytes to analyze. - `max_strings_to_llm` integer: Maximum number of extracted strings to send to the LLM. - `max_tokens_to_llm` integer: Maximum total tokens of extracted strings to send to the LLM per binary. - `min_string_length` integer: Minimum string length (in characters) to extract from binaries. - `strings_timeout` integer: Timeout in seconds for the strings extraction step. - `capture_iocs` V1IOCType[]: IoC types this signal is expected to capture; order reflects capture priority. - `code_diff` V1MalwareDetectionCodeDiffSignal: MalwareDetectionCodeDiffSignal produces an LLM-assisted diff analysis against the previous package version. - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - … - `max_diff_line_length` integer: Maximum character length per diff line before truncation. Deprecated: long lines are now diffed at the character level, see MalwareCodeDiffSelectionConfig.intra_line_diff. - `max_diff_size_bytes` integer: Maximum total diff size in bytes; -1 means unlimited. - `max_file_size_for_diff` integer: Maximum file size in bytes to include in the diff; -1 means unlimited. - `selection` V1MalwareCodeDiffSelectionConfig: MalwareCodeDiffSelectionConfig holds the file selection and render limits shared by the code diff signals, so the code_diff and code_diff_popular signals apply the same limits. - … - `code_diff_popular` V1MalwareDetectionCodeDiffPopularSignal: MalwareDetectionCodeDiffPopularSignal produces an LLM-assisted diff analysis for popular packages with a wider baseline. - `doc_suppression_triage_threshold` integer: A documentation file whose triage score is below this value is listed without its diff. Default 1. - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - … - `max_diff_line_length` integer: Maximum character length per diff line before truncation. Deprecated: long lines are now diffed at the character level, see MalwareCodeDiffSelectionConfig.intra_line_diff. - `max_diff_size_bytes` integer: Maximum total diff size in bytes; -1 means unlimited. - `max_file_size_for_diff` integer: Maximum file size in bytes to include in the diff; -1 means unlimited. - `popular_added_max_rows` integer: Maximum number of added files listed in the ledger. The rest are counted. Default 30. - `popular_deleted_max_rows` integer: Maximum number of deleted files listed in the ledger. The rest are counted. Default 30. - `popular_modified_max_rows` integer: Maximum number of modified files listed in the ledger. The rest are counted. Default 30. - `selection` V1MalwareCodeDiffSelectionConfig: MalwareCodeDiffSelectionConfig holds the file selection and render limits shared by the code diff signals, so the code_diff and code_diff_popular signals apply the same limits. - … - `code_diff_prescreen` V1MalwareDetectionCodeDiffPrescreenSignal: MalwareDetectionCodeDiffPrescreenSignal classifies a version-to-version diff without calling a model, so the pre-screen path can skip the LLM when every change is documentation or a dependency bump. - `deps_bump_check` boolean: When true, a manifest diff that only moves dependency versions is recognized as a dependency bump. - `docs_extensions` string[]: File extensions counted as documentation rather than code, each including the leading dot. - `docs_filenames` string[]: File names counted as documentation, compared against the lower-cased name including its extension. - `max_docs_file_size` integer: Size in bytes above which a documentation file stops being treated as documentation. - `critique` V1MalwareDetectionLLMSignal: MalwareDetectionLLMSignal carries LLM configuration for signals that produce a verdict or critique using a language model. Used for both the terminal decision signal (llm_decision) and the critique signal (critique). - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - … - `dependencies` V1MalwareDetectionDependenciesSignal: MalwareDetectionDependenciesSignal collects transitive dependency information for the package. - `depends_on` string[]: Names of signals that must complete before this signal runs; execution order follows the declaration order of this list. - `download_stats` V1MalwareDetectionDownloadStatsSignal: MalwareDetectionDownloadStatsSignal fetches download statistics to assess package popularity. - `github` V1MalwareDetectionGitHubSignal: MalwareDetectionGitHubSignal retrieves GitHub repository signals and analyzes them via an LLM. - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - … - `max_commits` integer: Maximum number of commits to include. - `max_contributors` integer: Maximum number of contributors to include. - `max_releases` integer: Maximum number of releases to include. - `install_hooks` V1MalwareDetectionInstallHooksSignal: MalwareDetectionInstallHooksSignal inspects package install hooks (preinstall, postinstall scripts). - `ioc_ingestor` V1MalwareDetectionIoCIngestorSignal: MalwareDetectionIoCIngestorSignal runs IoC and YARA short-circuit checks before the full analysis. - `yara_short_circuit_enabled` boolean: When true, the signal exits early upon any YARA match. - `yara_short_circuit_rule_prefix` string: Prefix used to identify short-circuit YARA rules, e.g. "MAL_". - `is_terminal` boolean: When true, this signal produces the terminal verdict for the group. - `keep_temp_files` boolean: When true, temporary files written by this signal producer are not deleted after execution; useful for debugging. - `llm_decision` V1MalwareDetectionLLMSignal: MalwareDetectionLLMSignal carries LLM configuration for signals that produce a verdict or critique using a language model. Used for both the terminal decision signal (llm_decision) and the critique signal (critique). - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - … - `llm_file_summary` V1MalwareDetectionLLMFileSummarySignal: MalwareDetectionLLMFileSummarySignal uses an LLM to produce a per-file summary of package contents. - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - … - `llm_analysis_threshold` integer: Minimum number of files that must be present before LLM analysis is triggered. - `min_llm_read_coverage` number, double: Minimum share (0.0 - 1.0) of the candidate content the LLM must be able to read within its input budget. Below it the signal returns a truncated delegation result instead of a summary. A value of 0 or less disables the check. Default 0.8. - `malware_diff` V1MalwareDetectionOpengrepDiffSignal: MalwareDetectionOpengrepDiffSignal diffs the package against its previous version using opengrep rules. Used for both sensitive-API diff (sens_api_diff) and malware-focused diff (malware_diff) signals; the rule set applied is determined by which oneof field is set in MalwareDetectionSignal. - `context_lines` integer: Number of context lines to include around each finding. - `level_threshold` 'OPENGREP_SEVERITY_LEVEL_UNSPECIFIED' | 'OPENGREP_SEVERITY_LEVEL_INFO' | 'OPENGREP_SEVERITY_LEVEL_WARNING' | 'OPENGREP_SEVERITY_LEVEL_ERROR': OpengrepSeverityLevel is the minimum rule severity threshold for diff-based signals. - OPENGREP_SEVERITY_LEVEL_UNSPECIFIED: No severity level has been set; the signal uses its default threshold. - OPENGREP_SEVERITY_LEVEL_INFO: Report informational findings and above. - OPENGREP_SEVERITY_LEVEL_WARNING: Report warning findings and above. - OPENGREP_SEVERITY_LEVEL_ERROR: Report only error-level findings. - `max_line_length` integer: Maximum character length per diff line before truncation. - `opengrep_max_detailed_findings` integer: Maximum number of findings rendered with code snippets. The rest are counted per rule. Default 30. - `opengrep_max_per_rule` integer: Maximum number of findings rendered with code snippets for any single rule. Default 3. - `opengrep_timeout` integer: Maximum seconds to allow the opengrep scan to run. - `metadata` V1MalwareDetectionMetadataSignal: MalwareDetectionMetadataSignal extracts package registry metadata via an LLM. - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - … - `name` string: Name that uniquely identifies this signal instance within the workflow. - `output_template` string: Go template that overrides the default go output template for this signal. When set, the scanner uses this template instead of the built-in template to render the signal's structured output into text before passing it to the LLM decision signal. Template variables must match the signal producer's output model; unrecognised variables are treated as empty strings. - `package_files` V1MalwareDetectionPackageFilesSignal: MalwareDetectionPackageFilesSignal reads and lists files from the package archive for downstream signals. - `max_files` integer: Maximum number of files to include from the archive. - `package_versions` V1MalwareDetectionPackageVersionsSignal: MalwareDetectionPackageVersionsSignal gathers version history of the package from the registry. - `max_versions_to_show` integer: Maximum number of recent versions to include in the signal output. - `prescreen_llm_decision` V1MalwareDetectionLLMSignal: MalwareDetectionLLMSignal carries LLM configuration for signals that produce a verdict or critique using a language model. Used for both the terminal decision signal (llm_decision) and the critique signal (critique). - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - … - `second_stage_analysis` V1MalwareDetectionSecondStageAnalysisSignal: MalwareDetectionSecondStageAnalysisSignal downloads and LLM-analyzes files referenced by suspicious code paths. - `download_timeout` integer: Timeout in seconds for each individual file download. - `enable_llm_cache` boolean: When true, previously fetched LLM responses are reused to reduce cost. - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - … - `max_download_size` integer: Maximum total download size in bytes across all second-stage files. - `max_file_size_for_llm` integer: Maximum file size in bytes to pass to the LLM. - `max_files_to_analyze` integer: Maximum number of files to download and analyze. - `sens_api_diff` V1MalwareDetectionOpengrepDiffSignal: MalwareDetectionOpengrepDiffSignal diffs the package against its previous version using opengrep rules. Used for both sensitive-API diff (sens_api_diff) and malware-focused diff (malware_diff) signals; the rule set applied is determined by which oneof field is set in MalwareDetectionSignal. - `context_lines` integer: Number of context lines to include around each finding. - `level_threshold` 'OPENGREP_SEVERITY_LEVEL_UNSPECIFIED' | 'OPENGREP_SEVERITY_LEVEL_INFO' | 'OPENGREP_SEVERITY_LEVEL_WARNING' | 'OPENGREP_SEVERITY_LEVEL_ERROR': OpengrepSeverityLevel is the minimum rule severity threshold for diff-based signals. - OPENGREP_SEVERITY_LEVEL_UNSPECIFIED: No severity level has been set; the signal uses its default threshold. - OPENGREP_SEVERITY_LEVEL_INFO: Report informational findings and above. - OPENGREP_SEVERITY_LEVEL_WARNING: Report warning findings and above. - OPENGREP_SEVERITY_LEVEL_ERROR: Report only error-level findings. - `max_line_length` integer: Maximum character length per diff line before truncation. - `opengrep_max_detailed_findings` integer: Maximum number of findings rendered with code snippets. The rest are counted per rule. Default 30. - `opengrep_max_per_rule` integer: Maximum number of findings rendered with code snippets for any single rule. Default 3. - `opengrep_timeout` integer: Maximum seconds to allow the opengrep scan to run. - `typosquatting` V1MalwareDetectionTyposquattingSignal: MalwareDetectionTyposquattingSignal detects potential typosquatting by comparing the package name to known packages. - `similarity_threshold` number, double: Minimum similarity score (0.0 – 1.0) to flag a package as a potential typosquat. - `yara_malware_detection` V1MalwareDetectionYaraSignal: MalwareDetectionYaraSignal scans package files with YARA rules to identify malware patterns. - `context_lines` integer: Number of context lines to include around each YARA match. - `max_file_size_mb` integer: Maximum file size in megabytes to pass through YARA scanning. - `show_code_snippets` boolean: When true, matching code snippets are included in the signal output. - `tenant_meta` object: Tenant metadata for namespace. - `uuid` string: The UUID of the workflow record. - `request` V1UpdateRequest: Message used for all update requests. - `force` boolean: Force will force the update of the resource if any checks fail. - `update_mask` string: Fields to update. Defaults to all fields. ## Response `200` A successful response. - V1MalwareDetectionWorkflow: MalwareDetectionWorkflow stores a named scan workflow configuration used by the malware detection pipeline. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1MalwareDetectionWorkflowSpec, required: MalwareDetectionWorkflow specifications. - `auto_promote` boolean: When true, a MALICIOUS assessment from this workflow is auto-promoted to the malware feed on creation, bypassing human review. - `capture_iocs` V1IOCType[]: IoC types this workflow is expected to capture across all signal groups; acts as a workflow-level default. - `disabled` boolean: When true, malware detection is disabled for this workflow. - `infer_mal` boolean: When true, only the primary registry mirror is checked and shortcut verdicts produce MALICIOUS; when false all mirrors are searched and shortcut verdicts produce UNKNOWN. - `is_default` boolean: When true, this workflow is selected by default when no explicit workflow is requested. - `signal_groups` V1MalwareSignalGroup[]: Execution order of signal groups; groups are run in the order they appear in this list. - `name` string: Name that uniquely identifies this group within the workflow. - `signals` V1MalwareDetectionSignal[]: Ordered list of signals in this group. - `account` V1MalwareDetectionAccountSignal: MalwareDetectionAccountSignal fetches publisher account information from the registry. - `binary_strings` V1MalwareDetectionBinaryStringsSignal: MalwareDetectionBinaryStringsSignal extracts strings from binary files and passes them to an LLM for analysis. - `ground_iocs` boolean: When true, discovered IoCs are validated against the extracted string set. - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - `max_tokens` integer: Maximum number of output tokens the model may generate. - `model` string: Model identifier used for inference, e.g. "vertex_ai/gemini-2.0-flash". - `prompt_template` string: Go template name to render the prompt; defaults to the signal class default when absent. - `save_prompt` boolean: When true, the rendered prompt is persisted alongside the assessment for audit and replay. - `temperature` number, double: Sampling temperature controlling output randomness (0.0 – 2.0). - `thinking_level` 'THINKING_LEVEL_UNSPECIFIED' | 'THINKING_LEVEL_AUTO' | 'THINKING_LEVEL_LOW' | 'THINKING_LEVEL_MEDIUM' | 'THINKING_LEVEL_HIGH': ThinkingLevel controls the depth of reasoning a model applies before producing a response. - THINKING_LEVEL_UNSPECIFIED: No thinking level has been set; the model uses its default behavior. - THINKING_LEVEL_AUTO: The model selects the appropriate thinking depth automatically. - THINKING_LEVEL_LOW: Minimal reasoning; faster and cheaper, suited for straightforward signals. - THINKING_LEVEL_MEDIUM: Moderate reasoning; balanced between quality and cost. - THINKING_LEVEL_HIGH: Maximum reasoning; slower and more expensive, suited for complex verdicts. - `max_binaries_per_package` integer: Maximum number of binaries to analyze per package, prioritized by tier. - `max_binary_size_mb` integer: Maximum binary file size in megabytes to analyze. - `max_strings_to_llm` integer: Maximum number of extracted strings to send to the LLM. - `max_tokens_to_llm` integer: Maximum total tokens of extracted strings to send to the LLM per binary. - `min_string_length` integer: Minimum string length (in characters) to extract from binaries. - `strings_timeout` integer: Timeout in seconds for the strings extraction step. - `capture_iocs` V1IOCType[]: IoC types this signal is expected to capture; order reflects capture priority. - `code_diff` V1MalwareDetectionCodeDiffSignal: MalwareDetectionCodeDiffSignal produces an LLM-assisted diff analysis against the previous package version. - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - `max_tokens` integer: Maximum number of output tokens the model may generate. - `model` string: Model identifier used for inference, e.g. "vertex_ai/gemini-2.0-flash". - `prompt_template` string: Go template name to render the prompt; defaults to the signal class default when absent. - `save_prompt` boolean: When true, the rendered prompt is persisted alongside the assessment for audit and replay. - `temperature` number, double: Sampling temperature controlling output randomness (0.0 – 2.0). - `thinking_level` 'THINKING_LEVEL_UNSPECIFIED' | 'THINKING_LEVEL_AUTO' | 'THINKING_LEVEL_LOW' | 'THINKING_LEVEL_MEDIUM' | 'THINKING_LEVEL_HIGH': ThinkingLevel controls the depth of reasoning a model applies before producing a response. - THINKING_LEVEL_UNSPECIFIED: No thinking level has been set; the model uses its default behavior. - THINKING_LEVEL_AUTO: The model selects the appropriate thinking depth automatically. - THINKING_LEVEL_LOW: Minimal reasoning; faster and cheaper, suited for straightforward signals. - THINKING_LEVEL_MEDIUM: Moderate reasoning; balanced between quality and cost. - THINKING_LEVEL_HIGH: Maximum reasoning; slower and more expensive, suited for complex verdicts. - `max_diff_line_length` integer: Maximum character length per diff line before truncation. Deprecated: long lines are now diffed at the character level, see MalwareCodeDiffSelectionConfig.intra_line_diff. - `max_diff_size_bytes` integer: Maximum total diff size in bytes; -1 means unlimited. - `max_file_size_for_diff` integer: Maximum file size in bytes to include in the diff; -1 means unlimited. - `selection` V1MalwareCodeDiffSelectionConfig: MalwareCodeDiffSelectionConfig holds the file selection and render limits shared by the code diff signals, so the code_diff and code_diff_popular signals apply the same limits. - `intra_line_diff` boolean: When true, long lines are diffed at the character level and only the changed regions are rendered. Default true. - `ledger_max_rows` integer: Maximum number of rows in the ledger of files that got no analysis. The rest are counted. Default 30. - `llm_analysis_slots` integer: Number of files that get a full LLM analysis. Default 5. - `max_islands_per_file` integer: Maximum number of changed regions (islands) extracted from one file. Default 30. - `min_novel_chars_to_analyze` integer: A file with fewer new characters than this value gets only a ledger row. Default 10. - `min_triage_for_llm` integer: Minimum triage score a file needs to take an LLM analysis slot. Default 8. - `non_llm_analysis_slots` integer: Number of further files that get a mechanical excerpt without an LLM call. Default 5. - `reachable_hops` integer: Number of import hops from the entrypoints and lifecycle scripts within which a file counts as reachable. Default 2. - `render_budget` integer: Maximum number of characters rendered for one file, including the space reserved for the analysis text. Default 8000. - `triage_window_chars` integer: Size in characters of the window that the triage pattern scan scores. Default 4096. - `code_diff_popular` V1MalwareDetectionCodeDiffPopularSignal: MalwareDetectionCodeDiffPopularSignal produces an LLM-assisted diff analysis for popular packages with a wider baseline. - `doc_suppression_triage_threshold` integer: A documentation file whose triage score is below this value is listed without its diff. Default 1. - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - `max_tokens` integer: Maximum number of output tokens the model may generate. - `model` string: Model identifier used for inference, e.g. "vertex_ai/gemini-2.0-flash". - `prompt_template` string: Go template name to render the prompt; defaults to the signal class default when absent. - `save_prompt` boolean: When true, the rendered prompt is persisted alongside the assessment for audit and replay. - `temperature` number, double: Sampling temperature controlling output randomness (0.0 – 2.0). - `thinking_level` 'THINKING_LEVEL_UNSPECIFIED' | 'THINKING_LEVEL_AUTO' | 'THINKING_LEVEL_LOW' | 'THINKING_LEVEL_MEDIUM' | 'THINKING_LEVEL_HIGH': ThinkingLevel controls the depth of reasoning a model applies before producing a response. - THINKING_LEVEL_UNSPECIFIED: No thinking level has been set; the model uses its default behavior. - THINKING_LEVEL_AUTO: The model selects the appropriate thinking depth automatically. - THINKING_LEVEL_LOW: Minimal reasoning; faster and cheaper, suited for straightforward signals. - THINKING_LEVEL_MEDIUM: Moderate reasoning; balanced between quality and cost. - THINKING_LEVEL_HIGH: Maximum reasoning; slower and more expensive, suited for complex verdicts. - `max_diff_line_length` integer: Maximum character length per diff line before truncation. Deprecated: long lines are now diffed at the character level, see MalwareCodeDiffSelectionConfig.intra_line_diff. - `max_diff_size_bytes` integer: Maximum total diff size in bytes; -1 means unlimited. - `max_file_size_for_diff` integer: Maximum file size in bytes to include in the diff; -1 means unlimited. - `popular_added_max_rows` integer: Maximum number of added files listed in the ledger. The rest are counted. Default 30. - `popular_deleted_max_rows` integer: Maximum number of deleted files listed in the ledger. The rest are counted. Default 30. - `popular_modified_max_rows` integer: Maximum number of modified files listed in the ledger. The rest are counted. Default 30. - `selection` V1MalwareCodeDiffSelectionConfig: MalwareCodeDiffSelectionConfig holds the file selection and render limits shared by the code diff signals, so the code_diff and code_diff_popular signals apply the same limits. - `intra_line_diff` boolean: When true, long lines are diffed at the character level and only the changed regions are rendered. Default true. - `ledger_max_rows` integer: Maximum number of rows in the ledger of files that got no analysis. The rest are counted. Default 30. - `llm_analysis_slots` integer: Number of files that get a full LLM analysis. Default 5. - `max_islands_per_file` integer: Maximum number of changed regions (islands) extracted from one file. Default 30. - `min_novel_chars_to_analyze` integer: A file with fewer new characters than this value gets only a ledger row. Default 10. - `min_triage_for_llm` integer: Minimum triage score a file needs to take an LLM analysis slot. Default 8. - `non_llm_analysis_slots` integer: Number of further files that get a mechanical excerpt without an LLM call. Default 5. - `reachable_hops` integer: Number of import hops from the entrypoints and lifecycle scripts within which a file counts as reachable. Default 2. - `render_budget` integer: Maximum number of characters rendered for one file, including the space reserved for the analysis text. Default 8000. - `triage_window_chars` integer: Size in characters of the window that the triage pattern scan scores. Default 4096. - `code_diff_prescreen` V1MalwareDetectionCodeDiffPrescreenSignal: MalwareDetectionCodeDiffPrescreenSignal classifies a version-to-version diff without calling a model, so the pre-screen path can skip the LLM when every change is documentation or a dependency bump. - `deps_bump_check` boolean: When true, a manifest diff that only moves dependency versions is recognized as a dependency bump. - `docs_extensions` string[]: File extensions counted as documentation rather than code, each including the leading dot. - `docs_filenames` string[]: File names counted as documentation, compared against the lower-cased name including its extension. - `max_docs_file_size` integer: Size in bytes above which a documentation file stops being treated as documentation. - `critique` V1MalwareDetectionLLMSignal: MalwareDetectionLLMSignal carries LLM configuration for signals that produce a verdict or critique using a language model. Used for both the terminal decision signal (llm_decision) and the critique signal (critique). - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - `max_tokens` integer: Maximum number of output tokens the model may generate. - `model` string: Model identifier used for inference, e.g. "vertex_ai/gemini-2.0-flash". - `prompt_template` string: Go template name to render the prompt; defaults to the signal class default when absent. - `save_prompt` boolean: When true, the rendered prompt is persisted alongside the assessment for audit and replay. - `temperature` number, double: Sampling temperature controlling output randomness (0.0 – 2.0). - `thinking_level` 'THINKING_LEVEL_UNSPECIFIED' | 'THINKING_LEVEL_AUTO' | 'THINKING_LEVEL_LOW' | 'THINKING_LEVEL_MEDIUM' | 'THINKING_LEVEL_HIGH': ThinkingLevel controls the depth of reasoning a model applies before producing a response. - THINKING_LEVEL_UNSPECIFIED: No thinking level has been set; the model uses its default behavior. - THINKING_LEVEL_AUTO: The model selects the appropriate thinking depth automatically. - THINKING_LEVEL_LOW: Minimal reasoning; faster and cheaper, suited for straightforward signals. - THINKING_LEVEL_MEDIUM: Moderate reasoning; balanced between quality and cost. - THINKING_LEVEL_HIGH: Maximum reasoning; slower and more expensive, suited for complex verdicts. - `dependencies` V1MalwareDetectionDependenciesSignal: MalwareDetectionDependenciesSignal collects transitive dependency information for the package. - `depends_on` string[]: Names of signals that must complete before this signal runs; execution order follows the declaration order of this list. - `download_stats` V1MalwareDetectionDownloadStatsSignal: MalwareDetectionDownloadStatsSignal fetches download statistics to assess package popularity. - `github` V1MalwareDetectionGitHubSignal: MalwareDetectionGitHubSignal retrieves GitHub repository signals and analyzes them via an LLM. - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - `max_tokens` integer: Maximum number of output tokens the model may generate. - `model` string: Model identifier used for inference, e.g. "vertex_ai/gemini-2.0-flash". - `prompt_template` string: Go template name to render the prompt; defaults to the signal class default when absent. - `save_prompt` boolean: When true, the rendered prompt is persisted alongside the assessment for audit and replay. - `temperature` number, double: Sampling temperature controlling output randomness (0.0 – 2.0). - `thinking_level` 'THINKING_LEVEL_UNSPECIFIED' | 'THINKING_LEVEL_AUTO' | 'THINKING_LEVEL_LOW' | 'THINKING_LEVEL_MEDIUM' | 'THINKING_LEVEL_HIGH': ThinkingLevel controls the depth of reasoning a model applies before producing a response. - THINKING_LEVEL_UNSPECIFIED: No thinking level has been set; the model uses its default behavior. - THINKING_LEVEL_AUTO: The model selects the appropriate thinking depth automatically. - THINKING_LEVEL_LOW: Minimal reasoning; faster and cheaper, suited for straightforward signals. - THINKING_LEVEL_MEDIUM: Moderate reasoning; balanced between quality and cost. - THINKING_LEVEL_HIGH: Maximum reasoning; slower and more expensive, suited for complex verdicts. - `max_commits` integer: Maximum number of commits to include. - `max_contributors` integer: Maximum number of contributors to include. - `max_releases` integer: Maximum number of releases to include. - `install_hooks` V1MalwareDetectionInstallHooksSignal: MalwareDetectionInstallHooksSignal inspects package install hooks (preinstall, postinstall scripts). - `ioc_ingestor` V1MalwareDetectionIoCIngestorSignal: MalwareDetectionIoCIngestorSignal runs IoC and YARA short-circuit checks before the full analysis. - `yara_short_circuit_enabled` boolean: When true, the signal exits early upon any YARA match. - `yara_short_circuit_rule_prefix` string: Prefix used to identify short-circuit YARA rules, e.g. "MAL_". - `is_terminal` boolean: When true, this signal produces the terminal verdict for the group. - `keep_temp_files` boolean: When true, temporary files written by this signal producer are not deleted after execution; useful for debugging. - `llm_decision` V1MalwareDetectionLLMSignal: MalwareDetectionLLMSignal carries LLM configuration for signals that produce a verdict or critique using a language model. Used for both the terminal decision signal (llm_decision) and the critique signal (critique). - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - `max_tokens` integer: Maximum number of output tokens the model may generate. - `model` string: Model identifier used for inference, e.g. "vertex_ai/gemini-2.0-flash". - `prompt_template` string: Go template name to render the prompt; defaults to the signal class default when absent. - `save_prompt` boolean: When true, the rendered prompt is persisted alongside the assessment for audit and replay. - `temperature` number, double: Sampling temperature controlling output randomness (0.0 – 2.0). - `thinking_level` 'THINKING_LEVEL_UNSPECIFIED' | 'THINKING_LEVEL_AUTO' | 'THINKING_LEVEL_LOW' | 'THINKING_LEVEL_MEDIUM' | 'THINKING_LEVEL_HIGH': ThinkingLevel controls the depth of reasoning a model applies before producing a response. - THINKING_LEVEL_UNSPECIFIED: No thinking level has been set; the model uses its default behavior. - THINKING_LEVEL_AUTO: The model selects the appropriate thinking depth automatically. - THINKING_LEVEL_LOW: Minimal reasoning; faster and cheaper, suited for straightforward signals. - THINKING_LEVEL_MEDIUM: Moderate reasoning; balanced between quality and cost. - THINKING_LEVEL_HIGH: Maximum reasoning; slower and more expensive, suited for complex verdicts. - `llm_file_summary` V1MalwareDetectionLLMFileSummarySignal: MalwareDetectionLLMFileSummarySignal uses an LLM to produce a per-file summary of package contents. - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - `max_tokens` integer: Maximum number of output tokens the model may generate. - `model` string: Model identifier used for inference, e.g. "vertex_ai/gemini-2.0-flash". - `prompt_template` string: Go template name to render the prompt; defaults to the signal class default when absent. - `save_prompt` boolean: When true, the rendered prompt is persisted alongside the assessment for audit and replay. - `temperature` number, double: Sampling temperature controlling output randomness (0.0 – 2.0). - `thinking_level` 'THINKING_LEVEL_UNSPECIFIED' | 'THINKING_LEVEL_AUTO' | 'THINKING_LEVEL_LOW' | 'THINKING_LEVEL_MEDIUM' | 'THINKING_LEVEL_HIGH': ThinkingLevel controls the depth of reasoning a model applies before producing a response. - THINKING_LEVEL_UNSPECIFIED: No thinking level has been set; the model uses its default behavior. - THINKING_LEVEL_AUTO: The model selects the appropriate thinking depth automatically. - THINKING_LEVEL_LOW: Minimal reasoning; faster and cheaper, suited for straightforward signals. - THINKING_LEVEL_MEDIUM: Moderate reasoning; balanced between quality and cost. - THINKING_LEVEL_HIGH: Maximum reasoning; slower and more expensive, suited for complex verdicts. - `llm_analysis_threshold` integer: Minimum number of files that must be present before LLM analysis is triggered. - `min_llm_read_coverage` number, double: Minimum share (0.0 - 1.0) of the candidate content the LLM must be able to read within its input budget. Below it the signal returns a truncated delegation result instead of a summary. A value of 0 or less disables the check. Default 0.8. - `malware_diff` V1MalwareDetectionOpengrepDiffSignal: MalwareDetectionOpengrepDiffSignal diffs the package against its previous version using opengrep rules. Used for both sensitive-API diff (sens_api_diff) and malware-focused diff (malware_diff) signals; the rule set applied is determined by which oneof field is set in MalwareDetectionSignal. - `context_lines` integer: Number of context lines to include around each finding. - `level_threshold` 'OPENGREP_SEVERITY_LEVEL_UNSPECIFIED' | 'OPENGREP_SEVERITY_LEVEL_INFO' | 'OPENGREP_SEVERITY_LEVEL_WARNING' | 'OPENGREP_SEVERITY_LEVEL_ERROR': OpengrepSeverityLevel is the minimum rule severity threshold for diff-based signals. - OPENGREP_SEVERITY_LEVEL_UNSPECIFIED: No severity level has been set; the signal uses its default threshold. - OPENGREP_SEVERITY_LEVEL_INFO: Report informational findings and above. - OPENGREP_SEVERITY_LEVEL_WARNING: Report warning findings and above. - OPENGREP_SEVERITY_LEVEL_ERROR: Report only error-level findings. - `max_line_length` integer: Maximum character length per diff line before truncation. - `opengrep_max_detailed_findings` integer: Maximum number of findings rendered with code snippets. The rest are counted per rule. Default 30. - `opengrep_max_per_rule` integer: Maximum number of findings rendered with code snippets for any single rule. Default 3. - `opengrep_timeout` integer: Maximum seconds to allow the opengrep scan to run. - `metadata` V1MalwareDetectionMetadataSignal: MalwareDetectionMetadataSignal extracts package registry metadata via an LLM. - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - `max_tokens` integer: Maximum number of output tokens the model may generate. - `model` string: Model identifier used for inference, e.g. "vertex_ai/gemini-2.0-flash". - `prompt_template` string: Go template name to render the prompt; defaults to the signal class default when absent. - `save_prompt` boolean: When true, the rendered prompt is persisted alongside the assessment for audit and replay. - `temperature` number, double: Sampling temperature controlling output randomness (0.0 – 2.0). - `thinking_level` 'THINKING_LEVEL_UNSPECIFIED' | 'THINKING_LEVEL_AUTO' | 'THINKING_LEVEL_LOW' | 'THINKING_LEVEL_MEDIUM' | 'THINKING_LEVEL_HIGH': ThinkingLevel controls the depth of reasoning a model applies before producing a response. - THINKING_LEVEL_UNSPECIFIED: No thinking level has been set; the model uses its default behavior. - THINKING_LEVEL_AUTO: The model selects the appropriate thinking depth automatically. - THINKING_LEVEL_LOW: Minimal reasoning; faster and cheaper, suited for straightforward signals. - THINKING_LEVEL_MEDIUM: Moderate reasoning; balanced between quality and cost. - THINKING_LEVEL_HIGH: Maximum reasoning; slower and more expensive, suited for complex verdicts. - `name` string: Name that uniquely identifies this signal instance within the workflow. - `output_template` string: Go template that overrides the default go output template for this signal. When set, the scanner uses this template instead of the built-in template to render the signal's structured output into text before passing it to the LLM decision signal. Template variables must match the signal producer's output model; unrecognised variables are treated as empty strings. - `package_files` V1MalwareDetectionPackageFilesSignal: MalwareDetectionPackageFilesSignal reads and lists files from the package archive for downstream signals. - `max_files` integer: Maximum number of files to include from the archive. - `package_versions` V1MalwareDetectionPackageVersionsSignal: MalwareDetectionPackageVersionsSignal gathers version history of the package from the registry. - `max_versions_to_show` integer: Maximum number of recent versions to include in the signal output. - `prescreen_llm_decision` V1MalwareDetectionLLMSignal: MalwareDetectionLLMSignal carries LLM configuration for signals that produce a verdict or critique using a language model. Used for both the terminal decision signal (llm_decision) and the critique signal (critique). - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - `max_tokens` integer: Maximum number of output tokens the model may generate. - `model` string: Model identifier used for inference, e.g. "vertex_ai/gemini-2.0-flash". - `prompt_template` string: Go template name to render the prompt; defaults to the signal class default when absent. - `save_prompt` boolean: When true, the rendered prompt is persisted alongside the assessment for audit and replay. - `temperature` number, double: Sampling temperature controlling output randomness (0.0 – 2.0). - `thinking_level` 'THINKING_LEVEL_UNSPECIFIED' | 'THINKING_LEVEL_AUTO' | 'THINKING_LEVEL_LOW' | 'THINKING_LEVEL_MEDIUM' | 'THINKING_LEVEL_HIGH': ThinkingLevel controls the depth of reasoning a model applies before producing a response. - THINKING_LEVEL_UNSPECIFIED: No thinking level has been set; the model uses its default behavior. - THINKING_LEVEL_AUTO: The model selects the appropriate thinking depth automatically. - THINKING_LEVEL_LOW: Minimal reasoning; faster and cheaper, suited for straightforward signals. - THINKING_LEVEL_MEDIUM: Moderate reasoning; balanced between quality and cost. - THINKING_LEVEL_HIGH: Maximum reasoning; slower and more expensive, suited for complex verdicts. - `second_stage_analysis` V1MalwareDetectionSecondStageAnalysisSignal: MalwareDetectionSecondStageAnalysisSignal downloads and LLM-analyzes files referenced by suspicious code paths. - `download_timeout` integer: Timeout in seconds for each individual file download. - `enable_llm_cache` boolean: When true, previously fetched LLM responses are reused to reduce cost. - `llm` V1MalwareWorkflowLLMConfig: MalwareWorkflowLLMConfig carries the LLM-specific settings for a signal that is backed by a language model. - `max_tokens` integer: Maximum number of output tokens the model may generate. - `model` string: Model identifier used for inference, e.g. "vertex_ai/gemini-2.0-flash". - `prompt_template` string: Go template name to render the prompt; defaults to the signal class default when absent. - `save_prompt` boolean: When true, the rendered prompt is persisted alongside the assessment for audit and replay. - `temperature` number, double: Sampling temperature controlling output randomness (0.0 – 2.0). - `thinking_level` 'THINKING_LEVEL_UNSPECIFIED' | 'THINKING_LEVEL_AUTO' | 'THINKING_LEVEL_LOW' | 'THINKING_LEVEL_MEDIUM' | 'THINKING_LEVEL_HIGH': ThinkingLevel controls the depth of reasoning a model applies before producing a response. - THINKING_LEVEL_UNSPECIFIED: No thinking level has been set; the model uses its default behavior. - THINKING_LEVEL_AUTO: The model selects the appropriate thinking depth automatically. - THINKING_LEVEL_LOW: Minimal reasoning; faster and cheaper, suited for straightforward signals. - THINKING_LEVEL_MEDIUM: Moderate reasoning; balanced between quality and cost. - THINKING_LEVEL_HIGH: Maximum reasoning; slower and more expensive, suited for complex verdicts. - `max_download_size` integer: Maximum total download size in bytes across all second-stage files. - `max_file_size_for_llm` integer: Maximum file size in bytes to pass to the LLM. - `max_files_to_analyze` integer: Maximum number of files to download and analyze. - `sens_api_diff` V1MalwareDetectionOpengrepDiffSignal: MalwareDetectionOpengrepDiffSignal diffs the package against its previous version using opengrep rules. Used for both sensitive-API diff (sens_api_diff) and malware-focused diff (malware_diff) signals; the rule set applied is determined by which oneof field is set in MalwareDetectionSignal. - `context_lines` integer: Number of context lines to include around each finding. - `level_threshold` 'OPENGREP_SEVERITY_LEVEL_UNSPECIFIED' | 'OPENGREP_SEVERITY_LEVEL_INFO' | 'OPENGREP_SEVERITY_LEVEL_WARNING' | 'OPENGREP_SEVERITY_LEVEL_ERROR': OpengrepSeverityLevel is the minimum rule severity threshold for diff-based signals. - OPENGREP_SEVERITY_LEVEL_UNSPECIFIED: No severity level has been set; the signal uses its default threshold. - OPENGREP_SEVERITY_LEVEL_INFO: Report informational findings and above. - OPENGREP_SEVERITY_LEVEL_WARNING: Report warning findings and above. - OPENGREP_SEVERITY_LEVEL_ERROR: Report only error-level findings. - `max_line_length` integer: Maximum character length per diff line before truncation. - `opengrep_max_detailed_findings` integer: Maximum number of findings rendered with code snippets. The rest are counted per rule. Default 30. - `opengrep_max_per_rule` integer: Maximum number of findings rendered with code snippets for any single rule. Default 3. - `opengrep_timeout` integer: Maximum seconds to allow the opengrep scan to run. - `typosquatting` V1MalwareDetectionTyposquattingSignal: MalwareDetectionTyposquattingSignal detects potential typosquatting by comparing the package name to known packages. - `similarity_threshold` number, double: Minimum similarity score (0.0 – 1.0) to flag a package as a potential typosquat. - `yara_malware_detection` V1MalwareDetectionYaraSignal: MalwareDetectionYaraSignal scans package files with YARA rules to identify malware patterns. - `context_lines` integer: Number of context lines to include around each YARA match. - `max_file_size_mb` integer: Maximum file size in megabytes to pass through YARA scanning. - `show_code_snippets` boolean: When true, matching code snippets are included in the signal output. - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of the workflow record. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:object.tenant_meta.namespace/malware-detection-workflows/patch.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)