Intezer SDK

The SDK wraps the Intezer Platform API 2.0 (full HTTP API documentation).

📖 Full documentation: https://intezer-python-sdk.readthedocs.io/

What you can do with the SDK:

• Analyze files, URLs and endpoint scans
• Send and retrieve alerts (raw and phishing emails)
• Inspect incidents and cases (devices, users, TTPs)
• Search analyses, alerts, incidents, cases and devices history
• Index files as trusted or malicious and look up genetic families
• Get code reuse, metadata, IOCs, dynamic TTPs, capabilities and related samples

Installation

pip install intezer-sdk

The SDK requires CPython 3.10 or newer.

Quick start

Configure the global API once, then use any SDK class:

fromintezer_sdkimportapifromintezer_sdk.analysisimportFileAnalysisapi.set_global_api('<api_key>')
analysis=FileAnalysis(file_path='/path/to/sample')
analysis.send(wait=True)
print(analysis.result())

The API key can also be read from the INTEZER_ANALYZE_API_KEY environment variable. See the Getting started guide for US region, on-premise, and multi-tenant setups.

A taste of the SDK

# Analyze a URLfromintezer_sdk.analysisimportUrlAnalysisanalysis=UrlAnalysis(url='https://example.com/suspicious')
analysis.send(wait=True)
# Fetch an alert and its scansfromintezer_sdk.alertsimportAlertalert=Alert.from_id(alert_id='<alert_id>', wait=True, fetch_scans=True)
print(alert.verdict, alert.family_name)
# Look up a casefromintezer_sdk.casesimportCasecase=Case.from_id(case_id='<case_id>')
print(case.case_title, case.case_status, case.case_priority)

For the full set of examples — wait patterns, sub-analyses, alert ingestion, incident and case search, indexing, history queries, on-premise setup — see the hosted documentation.