Datetime in RFC3339 with timezone and added micro seconds.
Must match regular expression:^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}Z[+-]\d{2}:\d{2}$
\ No newline at end of file
diff --git a/report/v1.0.0/datetime.schema.json b/report/v1.0.0/datetime.schema.json
new file mode 100644
index 0000000..084fcd1
--- /dev/null
+++ b/report/v1.0.0/datetime.schema.json
@@ -0,0 +1,8 @@
+{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "$id": "https://yapscan.targodan.de/reportFormat/v1.0.0/datetime.schema.json",
+ "title": "datetime",
+ "description": "Datetime in RFC3339 with timezone and added micro seconds.",
+ "type": "string",
+ "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}.\\d{6}Z[+-]\\d{2}:\\d{2}$"
+}
\ No newline at end of file
diff --git a/report/v1.0.0/file-scans.schema.html b/report/v1.0.0/file-scans.schema.html
new file mode 100644
index 0000000..6ef2c5d
--- /dev/null
+++ b/report/v1.0.0/file-scans.schema.html
@@ -0,0 +1 @@
+ Scan results of file-scans. For each scanned file, where either a match was found or an error was emitted, one JSON object per line is stored.
Information about the scanned file
No Additional PropertiesThe path of the scanned file
MD5 hexdigest of the executable file, if the file could be read
SHA256 hexdigest of the executable file, if the file could be read
Contains information about matched rules. Is empty-array if no rules matched.
Information about a yara rule match
No Additional PropertiesThe exact strings of the yara rule, that were found, including their offsets in the memory segment.
The offset, where the string was found, relative to the start of the scanned memory segment or file. Note, this value can get very large. make sure your parser uses an int64.
The name of the matched string as defined in the yara rule
The namespace of the matched yara rule. This depends on how the rules where compiled.
The name of the matched yara rule
The error message or null if no error happened. Note, there may still be matches if an error happened.
Information about a yara rule match
No Additional PropertiesThe exact strings of the yara rule, that were found, including their offsets in the memory segment.
The offset, where the string was found, relative to the start of the scanned memory segment or file. Note, this value can get very large. make sure your parser uses an int64.
The name of the matched string as defined in the yara rule
The namespace of the matched yara rule. This depends on how the rules where compiled.
The name of the matched yara rule
Memory scan results. For each scanned memory section, where either a match was found or an error was emitted, one JSON object per line is stored.
No Additional PropertiesContains information about matched rules. Is empty-array if no rules matched.
Information about a yara rule match
No Additional PropertiesThe exact strings of the yara rule, that were found, including their offsets in the memory segment.
The offset, where the string was found, relative to the start of the scanned memory segment or file. Note, this value can get very large. make sure your parser uses an int64.
The name of the matched string as defined in the yara rule
The namespace of the matched yara rule. This depends on how the rules where compiled.
The name of the matched yara rule
PID of the scanned process
The error message or null if no error happened. Note, there may still be matches if an error happened.
The base address of the scanned memory segment. This can be used to resolve the memory segment information in the processes.json. Note, this value can get very large. make sure your parser uses an int64.
Metainformation about the yapscan report.
Version of Yapscan, used to generate the report
SchemaURLs for the files of the report. There is one schema link for each JSON file contained in the report.
All property whose name matches the following regular expression must respect the following conditions
Property name regular expression:\.json$ Version of the report format
Permissions of a memory segment
No Additional PropertiesTrue, if readable
True, if writable. If COW is true, this will be as well.
True, if the Copy-On-Write flag is set.
True, if executable
Information about running processes of a scanned system
No Additional PropertiesPID of the process
Bitness of the process
Path to the executable file of the process, if it could be determined
MD5 hexdigest of the executable file, if the file could be read
^[a-f0-9]{32}$ SHA256 hexdigest of the executable file, if the file could be read
^[a-f0-9]{64}$ Name of the user, which the process is executed under
Address of the parent segment. This is equal to baseAddress if the segment is a root segment. Note, this value can get very large. make sure your parser uses an int64.
Address of this segment. Note, this value can get very large. make sure your parser uses an int64.
The permissions, this segment was initialized with
No Additional PropertiesTrue, if readable
True, if writable. If COW is true, this will be as well.
True, if the Copy-On-Write flag is set.
True, if executable
The permissions, this segment had during time of the scan
Same definition as allocatedPermissionsSize of the segment in bytes. Note, this value can get very large. make sure your parser uses an int64.
The resident set size (RSS) of the segment in bytes. Only applicable on linux. Note, this value can get very large. make sure your parser uses an int64.
The state of the segment. Note that the state "reserve" is an approximation on linux; this will be set if the RSS is exactly zero.
The type of the memory segment
The path of the mapped file
MD5 hexdigest of the mapped file, if the file could be read
SHA256 hexdigest of the mapped file, if the file could be read
Statistic information about the Yapscan run
No Additional PropertiesDatetime of the start of the scan. Format is RFC3339 with added micro seconds.
Must match regular expression:^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}Z[+-]\d{2}:\d{2}$ Datetime of the start of the scan. Format is RFC3339 with added micro seconds.
Same definition as startThe currently free RAM in bytes. Note, this value can get very large. make sure your parser uses an int64.
The currently free swap in bytes. Note, this value can get very large. make sure your parser uses an int64.
The load average over the last minute, normalized over the number of CPUs, i.e. a value of 1.0 means the system is fully loaded. On linux this value can exceed 1.0, meaning processes are waiting for CPU time. Note, that on windows load checking start with the scan, thus this value will be inaccurate for the first minute of the scan.
Value must be greater or equal to 0.0
The load average over the last five minutes, normalized over the number of CPUs, i.e. a value of 1.0 means the system is fully loaded. On linux this value can exceed 1.0, meaning processes are waiting for CPU time. Note, that on windows load checking start with the scan, thus this value will be inaccurate for the first 5 minutes of the scan.
Value must be greater or equal to 0.0
The load average over the last fifteen minutes, normalized over the number of CPUs, i.e. a value of 1.0 means the system is fully loaded. On linux this value can exceed 1.0, meaning processes are waiting for CPU time. Note, that on windows load checking start with the scan, thus this value will be inaccurate for the first 15 minutes of the scan.
Value must be greater or equal to 0.0
Datetime of the stats snapshot. Format is RFC3339 with added micro seconds.
Same definition as startThe number of scanned processes
The number of scanned memory segments
Number of total bytes scanned from memory. Note, this value can get very large. make sure your parser uses an int64.
The number of scanned files
Number of total bytes scanned from files. Note, this value can get very large. make sure your parser uses an int64.
System information gathered by Yapscan
No Additional PropertiesTotal swap capacity in bytes. Note, this value can get very large. make sure your parser uses an int64.
The hostname of the scanned system
Operating system version
Total number of CPUs/Cores
The operating system's architecture
Name of the operating system
Flavour of the operating system
List of local IPs
Total installed RAM in bytes. Note, this value can get very large. make sure your parser uses an int64.