al4_submit_sha256
Submit a file by its SHA256 hash to AssemblyLine for immediate synchronous malware analysis. Requires the file to already exist in the file store.
Instructions
Submit a file by its SHA256 hash to AssemblyLine for immediate synchronous analysis. The file must already exist in the AL4 file store.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sha256 | Yes | SHA256 hash of the file | |
| description | No | ||
| classification | No | ||
| services | No | ||
| metadata | No |
Implementation Reference
- src/al4-client.ts:447-456 (handler)The `submitSha256` method on AL4Client sends a POST /api/v4/submit/ with the SHA256 hash. Validates the hash against SHA256_RE regex, includes optional params/metadata, and calls requestJson to make the HTTP request.
submitSha256( sha256: string, options: SubmitOptions = {}, ): Promise<Record<string, unknown>> { if (!SHA256_RE.test(sha256)) throw new Error(`Invalid sha256: ${sha256}`); const body: Record<string, unknown> = { sha256 }; if (options.params) body.params = options.params; if (options.metadata) body.metadata = options.metadata; return this.requestJson("POST", "/api/v4/submit/", body, options); } - src/index.ts:73-88 (schema)Tool registration definition with inputSchema: requires sha256 (string), with optional description, classification, services (array of strings), and metadata (object).
{ name: "al4_submit_sha256", description: "Submit a file by its SHA256 hash to AssemblyLine for immediate synchronous analysis. The file must already exist in the AL4 file store.", inputSchema: { type: "object", properties: { sha256: { type: "string", description: "SHA256 hash of the file" }, description: { type: "string" }, classification: { type: "string" }, services: { type: "array", items: { type: "string" } }, metadata: { type: "object", additionalProperties: { type: "string" } }, }, required: ["sha256"], }, }, - src/index.ts:391-393 (registration)Switch case in the CallToolRequestSchema handler that routes 'al4_submit_sha256' to `client.submitSha256(a.sha256, buildSubmitOptions(a))`.
case "al4_submit_sha256": result = await client.submitSha256(a.sha256 as string, buildSubmitOptions(a)); break; - src/index.ts:322-334 (helper)The `buildSubmitOptions` helper function that extracts name, description, classification, services, and metadata from tool arguments into the SubmitOptions format passed to submitSha256.
function buildSubmitOptions(args: Record<string, unknown>) { return { name: args.name as string | undefined, params: { ...(args.description ? { description: args.description as string } : {}), ...(args.classification ? { classification: args.classification as string } : {}), ...(args.services ? { services: { selected: args.services as string[] } } : {}), }, metadata: args.metadata as Record<string, string> | undefined, }; }