Files
livewells checks files as well as links. Send a file and livewells reads it in a disposable container. The case shows what the file holds, with a defanged report.
Send a file
- On New case, choose Upload a file.
- Drop the file on the page, or choose it from your computer.
- Choose Check file.
Your tools can send a file through the API. See API.
- Each case holds one file, 25 MiB at most.
- A file counts as one submission.
- livewells decides the type from the content of the file.
- A file that holds other files becomes one case. The files inside it are items of that case.
File types
| Type | Files | Guide |
|---|---|---|
.eml, .msg and .ics | Email and calendar files | |
| QR code | PNG and JPEG images | QR codes in images |
| HTML | .html, .htm, .hta and .svg | HTML files |
.pdf | PDF files | |
| Office | Word, Excel, PowerPoint, OpenDocument and RTF | Word, Excel, PowerPoint and RTF files |
| Macros | VBA and Excel 4.0 macros in Office files | Macro emulation |
| Archive | ZIP, 7z, RAR, tar, gzip and ISO | Archives |
A file of another type gets its type, size and SHA-256 hash in the case.
Passwords
Tick This file is password protected and type the password. You can send up to 3 passwords with one file. API clients send them as archive_password fields.
When a file needs a password that you did not send, the case shows This file is locked. Type the password and choose Send the password. Try infected when the sender gave no password.
- livewells holds a password in memory for one check.
- A case takes 5 password tries.
- A case that waits for a password closes after 24 hours.
Limits for every file
| Limit | Value |
|---|---|
| Size of one file | 25 MiB |
| Items in one case | 300 |
| Nesting depth | 3 levels |
| Unpacked data in one case | 256 MiB |
| Time for one case | 3 minutes |
| Passwords for one file | 3 |
| Files sent in one minute | 10 for each organisation |
| File checks and sessions started in 15 minutes | 10 for each organisation |
| Sessions started in 15 minutes | 5 for each person |
Each guide lists the limits of its file type. When a file reaches a limit, the report says so.
When a file is malicious
Your analysts set the verdict. A verdict of any kind leaves the file where it is.
- livewells keeps the file for the retention period of your organisation. Then livewells deletes the case.
- Download the original file of a case in a password-protected ZIP. See Cases.
- The ZIP password is
infected, and the page shows it. - No route returns the original file except the sample ZIP routes. See API.
- Every address in a report is defanged.
- An administrator can switch sample downloads off in Settings. See Cases.
Reports
- Every address in a report is defanged. The report shows
hxxps[://]login[.]example[.]com/verifyfor a web address. - A web address in a report goes to the disposable browser when you choose it. That run uses one submission.
- The report downloads as JSON or CSV.
- livewells keeps the file for the retention period of your organisation. Then livewells deletes the case.
Samples and downloads
- Download the original file of a case in a password-protected ZIP. See Cases.
- livewells keeps the file for the retention period of your organisation. Then livewells deletes the case.
- livewells passes the file straight to the disposable container that reads it.
- A verdict of any kind leaves the file where it is.
- Each download is a password-protected ZIP with AES-256 encryption.
- The ZIP password is
infected, and the page shows it. - An administrator can switch sample downloads off in Settings. See Cases.
- A page can offer a download while an analyst browses. livewells captures it and checks it. See Captured downloads.
What an administrator sets
- Retention: how long livewells keeps cases.
- Sample downloads: whether members can download the original files of a case.
- API key access: Read only, Read and send, or Download samples only.