Malspark

Advanced

Validation codes

Every code the platform's validators file a finding under: where it is raised, what it means, and the pages that name it.

This page is generated from the source by uv run python scripts/validation_codes/run.py and is not edited by hand. A test regenerates it and fails when this file is not what the source gives, when a code has no place that raises it, and when no test names a code.

A validation code is the family.name string a finding is filed under: the code a retry turn shows the producer, the key of run_summary.validation.by_code, and the code of every unresolved row. The register reads the source with Python's ast module and never imports it. A string counts as a code only in a code position (the value of a code= keyword, the value assigned to a name ending in _CODE, a member of a set or tuple bound to a name ending in _CODES, or the code slot of a finding the platform builds) and only in the form family.name. The families are the ones the source uses.

A code is raised only where the platform puts it into a finding it emits: a call building an object of a class whose instances carry a code (with code= or in its positional place), a dict with a "code" key, a copy made with its code changed, a tuple shaped like such a class, a call to a factory whose parameter reaches one of those, or a callback the function was handed; and only in code something calls. Sites that store or forward an existing code are listed as passing it on. Comparing a code, looking up or counting by it, testing a string against it, logging it, filtering by it, a default that reaches no finding and formatted text read it, and are not listed. A name, a loop over constants, a conditional, a constant mapping and a parameter fed by constants at every call site are followed. Places are named module:function, without line numbers, so an edit elsewhere in a file leaves this page as it is. A class or factory whose code slots only ever receive strings of another shape files another kind of code (a team rule, a tool error); its slots the register cannot follow are left out of the unresolved list. A code-shaped string in a pair is listed only when its family is already a code family, so a code first written only as a pair literal in a new family is not seen; bind it to a _CODE name.

A code's meaning is the comment or docstring on its own constant; where there is none, the message a raise site passes, with each value it fills in written <name> (a site that passes several messages for a code is pointed at instead); where there is neither, the comment written over the group of constants it belongs to, marked as such. A code counts as tested when a Python test names it, in a string other than a docstring or by its constant; that does not prove the test makes the platform raise it. The tests are not listed here: uv run python scripts/validation_codes/run.py --tests prints them. A code bound under a LEGACY_ name is one nothing raises any more and stored runs still carry; the comment on that name says what reads it.

118 codes in 12 families: agreement 10 · attck 6 · attribution 1 · composer 4 · isr 14 · narrative 5 · question 9 · report 19 · stix 32 · tool 1 · validation 1 · verdict 16. 14 code positions the register could not resolve are listed at the end.

agreement

agreement.failure_redone

A rewrite of a limitations sentence that still says a call failed, or a reading could not be made, where a later call redid it (T-526).

  • Raised at maljan.reporting.section_agreement:_failure_redone_violation
  • Constant maljan.reporting.section_agreement:FAILURE_REDONE_CODE
  • Docs none

agreement.listed

A sentence of a passage shown for reading only (a section 5 passage, a record's value field), listed as saying otherwise than its sources and kept as written: the model's answer, recorded where a reader finds it.

  • Raised at maljan.reporting.section_agreement:apply_rows
  • Constant maljan.reporting.section_agreement:LISTED_CODE
  • Docs none

agreement.rewrite_cites_elsewhere

A rewrite cites an id that neither its sources nor its passage cite.

  • Raised at maljan.reporting.section_agreement:_grounding_violations
  • Constant maljan.reporting.section_agreement:REWRITE_CITES_ELSEWHERE_CODE
  • Docs none

agreement.rewrite_drops_citation

A rewrite that leaves out an id the sentence it replaces cites.

  • Raised at maljan.reporting.section_agreement:_grounding_violations
  • Constant maljan.reporting.section_agreement:REWRITE_DROPS_CITATION_CODE
  • Docs none

agreement.rewrite_ungrounded

A rewrite that cites none of the ids its sources cite, or rests only on sources that cite none; for a section 5 sentence, one resting only on facts about nothing the sentence names (the routine or its caller, the address, the value or the call), or, for a routine or bound-value fact on a sentence stating that the run's own reading (the ledger, its entries, the listings or the function index) does not establish, show, settle, trace or list something and naming no address, nothing its passage names, or with no clause of their own.

  • Raised at maljan.reporting.section_agreement:_grounding_violations, maljan.reporting.section_agreement:_row_violations
  • Constant maljan.reporting.section_agreement:REWRITE_UNGROUNDED_CODE
  • Docs none

agreement.rewritten

A sentence the agreement question rewrote: what stood, what replaced it and on which sources, recorded as the model's answer.

  • Raised at maljan.reporting.section_agreement:apply_rows
  • Constant maljan.reporting.section_agreement:REWRITTEN_CODE
  • Docs none

agreement.schema

No comment names its meaning, and maljan.pipeline.validation:schema_violations passes more than one message for it: see the messages there.

  • Raised at maljan.pipeline.validation:schema_violations, maljan.reporting.section_agreement:_ask
  • Constant maljan.reporting.section_agreement:SCHEMA_CODE
  • Docs none

agreement.sentence_not_found

A row's sentence does not stand in its passage as copied.

  • Raised at maljan.reporting.section_agreement:_row_violations
  • Constant maljan.reporting.section_agreement:SENTENCE_NOT_FOUND_CODE
  • Docs none

agreement.unknown_passage

A row names a passage the round was not shown as one it may answer for.

  • Raised at maljan.reporting.section_agreement:_row_violations
  • Constant maljan.reporting.section_agreement:UNKNOWN_PASSAGE_CODE
  • Docs none

agreement.unknown_source

A row names a source the round was not shown, or answers a section 5 passage with a source that is not a platform fact.

  • Raised at maljan.reporting.section_agreement:_row_violations
  • Constant maljan.reporting.section_agreement:UNKNOWN_SOURCE_CODE
  • Docs none

attck

attck.absence_claim

No comment names its meaning; the message at maljan.pipeline.validation:absence_claim_violation reads: "CLAIM <text> reads as saying the behaviour is absent, and carries TECHNIQUE <tid>. A technique on a claim is read as something the sample does, so <tid> is published as a finding of this run. If the behaviour is absent, <absent>; if the sample does do it, keep the technique and say what the sample does."

  • Raised at maljan.pipeline.validation:absence_claim_violation
  • Constant maljan.pipeline.validation:ABSENCE_CLAIM_CODE
  • Docs Architecture

attck.claim_does_not_describe

No comment names its meaning, and maljan.pipeline.validation:claim_does_not_describe_violation passes more than one message for it: see the messages there.

attck.missing_id

A technique named with no id. Its own code because the answer is different from an id that does not resolve: there is nothing to look up, and a behaviour the model could not map is still a behaviour the report can carry.

  • Raised at maljan.pipeline.validation:validate_verdict_bundle
  • Constant maljan.pipeline.validation:MISSING_ID_CODE
  • Docs Architecture

attck.platform_mismatch

No comment names its meaning, and maljan.pipeline.validation:validate_isr passes more than one message for it: see the messages there.

attck.unknown_id

No comment names its meaning; the message at maljan.pipeline.validation:validate_isr reads: "TECHNIQUE <tid> is not in the MITRE ATT&CK catalogue<retired_note>.<hint> Use one of them, or omit the technique id."

attck.weak_alignment

No comment names its meaning; the message at maljan.pipeline.validation:validate_isr reads: "TECHNIQUE <tid> aligns weakly with the claim's own text (gate score <gate_score>, threshold <threshold>), and the ATT&CK index ranks <technique_id> (<score_gate>) and other techniques from this sample's own domain above it: <ranked>. Keep <tid> if the evidence says so and say why in the claim, choose one of the ranked techniques, or drop the technique id."

  • Raised at maljan.pipeline.validation:validate_isr
  • Constant maljan.pipeline.validation:WEAK_ALIGNMENT_CODE
  • Docs Architecture

attribution

attribution.ungrounded_family

No comment names its meaning; the message at maljan.pipeline.validation:validate_verdict_bundle reads: "family <name> cites no evidence ids; list the ledger entries the name came from, or drop the attribution."

  • Raised at maljan.pipeline.validation:validate_verdict_bundle
  • Constant none: the code is written as a literal
  • Docs none

composer

composer.command_values

A command table whose numbered ids leave out a value the code it was shown compares the command value with, or name a value that code compares it with nowhere. A row whose id was converted between bases by hand can name another case's value, and a case the table leaves out is a command the reader never learns of. Asked once with the values the platform read from the code; the model decides which branch is a command and what it does, and the table is kept as written with the finding beside it.

  • Raised at maljan.pipeline.validation:command_value_violations
  • Constant maljan.pipeline.validation:COMMAND_VALUES_CODE
  • Docs none

composer.cut_at_output_cap

A report section answer the output cap ended. Its JSON is cut before it closes, so the schema check could only say "not JSON at all" — and a model told that writes the same long answer again, into the same cap. Both answers of a benchmark report's host-identifier section ran to exactly 8,192 tokens.

  • Raised at maljan.pipeline.validation:section_cut_violation
  • Constant maljan.pipeline.validation:SECTION_CUT_CODE
  • Docs Architecture

composer.repeated_items

A report section answer that writes one item again. Every list section's contract says each item is written once; a host-identifier answer began 161 items of which at most 19 differed. The answer is kept as written with the finding beside it: the platform removes no item the model wrote.

composer.schema

No comment names its meaning, and maljan.pipeline.validation:schema_violations passes more than one message for it: see the messages there.

isr

isr.claim_without_confidence

No comment names its meaning; the message at maljan.pipeline.validation:confidence_violation reads: "<parts>, so they are not claims. Give each the confidence you hold it at, as a number from 0.0 to 1.0, or leave it out."

isr.claims_repeated

An analyst's answer that writes the same claims again and again: the same whole-answer question is asked of it, once, with the part written before the repetition shown back.

  • Raised at maljan.pipeline.validation:analyst_repeated_violation
  • Constant maljan.pipeline.validation:ANALYST_REPEATED_CODE
  • Docs Architecture, Configuration

isr.claims_under_disputes

Claim headings under the DISPUTES section, beside the analyst's own claims. Not read as its own: they may be a peer's claims it quotes, or its own written below the label. The analyst is asked once which; the code does not read the label's words to decide.

  • Raised at maljan.pipeline.validation:claims_kept_under_disputes_finding, maljan.pipeline.validation:claims_under_disputes_violation
  • Constant maljan.pipeline.validation:CLAIMS_UNDER_DISPUTES_CODE
  • Docs Architecture

isr.confidence_range

No comment names its meaning; the message at maljan.pipeline.validation:validate_isr reads: "CONFIDENCE is <confidence>; it must be a number between 0.0 and 1.0."

  • Raised at maljan.pipeline.validation:validate_isr
  • Constant none: the code is written as a literal
  • Docs none

isr.cut_at_output_cap

An analyst's answer the output cap ended. The judge and the composer were asked about theirs; an analyst whose answer stopped at the cap — 42 claims, the last one cut — was asked its other questions over the cut answer, spent the retry's whole cap again, and returned no claim at all.

  • Raised at maljan.pipeline.validation:analyst_cut_violation
  • Constant maljan.pipeline.validation:ANALYST_CUT_CODE
  • Docs Architecture

isr.decompiled_not_described

A reverser decompiled two routines that held half of what the analysis needed, kept both in its own ledger, and no claim of its answer described either. The functions its ledger entries decompiled are listed to it, once.

  • Raised at maljan.pipeline.validation:decompiled_not_described_violation
  • Constant maljan.pipeline.validation:DECOMPILED_NOT_DESCRIBED_CODE
  • Docs Architecture

isr.empty_evidence

No comment names its meaning; the message at maljan.pipeline.validation:validate_isr reads: "the claim cites no evidence; give the concrete artifact it rests on, or drop the claim."

  • Raised at maljan.pipeline.validation:validate_isr
  • Constant none: the code is written as a literal
  • Docs none

isr.function_claim_unheld

A claim naming a call or a string for a function whose own facts hold none.

  • Raised at maljan.pipeline.function_claims:_question
  • Constant maljan.pipeline.function_claims:FUNCTION_CLAIM_UNHELD_CODE, maljan.pipeline.validation:FUNCTION_CLAIM_UNHELD
  • Docs Architecture

isr.library_only_claims

A reverser's answer was mostly one-line claims of the form "uses x.dll APIs for y", each citing only the hash-resolution listing.

  • Raised at maljan.pipeline.validation:library_only_claims_violation
  • Constant maljan.pipeline.validation:LIBRARY_ONLY_CLAIMS_CODE
  • Docs Architecture

isr.retry_dropped

A retry kept as the analyst's answer that no longer states claims or findings its first answer had. The platform states which, per analyst, and asks the analyst once to keep or withdraw each with a reason; its answer stands. Unanswered, the first answer's items stay, their state said.

  • Raised at maljan.agents.base_agent:BaseAnalyst._ask_retry_drops._emit, maljan.pipeline.events:emit_validation_feedback
  • Constant maljan.pipeline.validation:RETRY_DROPPED_CODE
  • Docs Architecture, Replaying a stored run

isr.retry_restated_few

A whole retry that restates fewer of the first answer's claims than it leaves out (by the claim's values: restated when the retry states every value it holds; a claim that holds none, or whose only values left out are technique ids the retry was asked about, is counted neither way) is more another answer than a fix of this one, written in a turn of its own. It does not replace the first answer: what it left out stands beside the retry's own claims, which stand for the claims they restate. The one question about those items says so, and also names each claim with no value whose sentence the retry does not write; it is asked under this code beside the drops code, with the same events. Each item the analyst withdraws stays out, every other stays as first written.

  • Raised at maljan.agents.base_agent:BaseAnalyst._ask_retry_drops._emit, maljan.pipeline.events:emit_validation_feedback
  • Constant maljan.pipeline.validation:RETRY_RESTATED_FEW_CODE
  • Docs Architecture

isr.technique_line_unread

A claim whose TECHNIQUE line is more than ids or NONE. No id is read from it, and the analyst is asked once for ids alone. A list of ids separated by commas, "and", slashes or semicolons is read (base_agent.read_technique_line) and not asked, and so is an id with a closing note in brackets that decides nothing or says the id is not asserted.

  • Raised at maljan.pipeline.validation:technique_line_violation
  • Constant maljan.pipeline.validation:TECHNIQUE_LINE_UNREAD_CODE
  • Docs Architecture

isr.ungrounded_technique

No comment names its meaning; the message at maljan.pipeline.validation:validate_isr reads: "TECHNIQUE <tid> cites no evidence id from this run.<said> Name the ledger entry it was read from, for example <shown>, or drop the technique: a technique nothing in the run establishes is read downstream as a finding."

  • Raised at maljan.pipeline.validation:validate_isr
  • Constant maljan.pipeline.validation:UNGROUNDED_TECHNIQUE_CODE
  • Docs Architecture

isr.unparsed_answer

No comment names its meaning, and maljan.pipeline.validation:parse_violations passes more than one message for it: see the messages there.

narrative

narrative.schema

No comment names its meaning, and maljan.pipeline.validation:schema_violations passes more than one message for it: see the messages there.

  • Raised at maljan.pipeline.validation:schema_violations, maljan.reporting.narrative_agent:NarrativeAgent.generate
  • Constant none: the code is written as a literal
  • Docs none

narrative.ungrounded_capability

No comment names its meaning; the message at maljan.pipeline.validation:ungrounded_capabilities reads: "the text claims <label>, which nothing in this run establishes — no <techniques> technique, no matching evidence section, and no analyst said it (in: <sentences>).<rule_line> <summary> Describe what was found, or drop the claim."

narrative.ungrounded_finding

No comment names its meaning; the message at maljan.pipeline.validation:key_finding_citation_violations reads: "key finding <index> cites <unknown>, which no entry in this run's evidence carries. Cite the ev_ ids of the entries the finding stands on, or leave evidence_ids empty."

  • Raised at maljan.pipeline.validation:key_finding_citation_violations
  • Constant maljan.pipeline.validation:UNGROUNDED_FINDING_CODE
  • Docs Architecture

narrative.unpublished_indicator

A recommendation or hunting note that acts on a value this run does not publish. Asked once with the IOC table's own answer; a value kept after it is recorded beside the recommendation.

  • Raised at maljan.pipeline.validation:recommendation_indicator_violations
  • Constant maljan.pipeline.validation:UNPUBLISHED_RECOMMENDATION_CODE
  • Docs Architecture

narrative.unpublished_technique

No comment names its meaning; the message at maljan.pipeline.validation:recommendation_technique_violations reads: "recommendation <index> names a technique this run does not publish: <ids>. The report's ATT&CK table does not carry it. A recommendation acts on the techniques this run publishes. Write it with a published technique, or without the id."

  • Raised at maljan.pipeline.validation:recommendation_technique_violations
  • Constant maljan.pipeline.validation:UNPUBLISHED_RECOMMENDATION_TECHNIQUE_CODE
  • Docs Architecture

question

question.answered_twice

A question got more than one reply; the first is kept.

  • Raised at maljan.reporting.question_round:question_violations
  • Constant maljan.reporting.question_round:ANSWERED_TWICE_CODE
  • Docs none

question.established_ungrounded

"established" with no entry of a call that answered among the ids cited; printed as not determinable if it stands.

  • Raised at maljan.reporting.question_round:_judge
  • Constant maljan.reporting.question_round:ESTABLISHED_UNGROUNDED_CODE
  • Docs none

question.negative_on_open_question

"limited negative" resting on an open question, which is an unknown, not an absence; printed as not determinable if it stands.

  • Raised at maljan.reporting.question_round:_judge
  • Constant maljan.reporting.question_round:NEGATIVE_ON_OPEN_QUESTION_CODE
  • Docs none

question.negative_without_coverage

"limited negative" with no coverage record (no call that answered in looked_at); printed as not determinable if it stands.

  • Raised at maljan.reporting.question_round:_judge
  • Constant maljan.reporting.question_round:NEGATIVE_WITHOUT_COVERAGE_CODE
  • Docs none

question.schema

The round's answer, or one reply of it, does not fit the object asked for.

  • Raised at maljan.pipeline.validation:schema_violations, maljan.reporting.question_round:answer_questions
  • Constant maljan.reporting.question_round:SCHEMA_CODE
  • Docs none

question.unanswered

No comment names its meaning; the message at maljan.reporting.question_round:question_violations reads: "question(s) <missing> got no answer. Answer every question, not_determinable where this run cannot settle it."

  • Raised at maljan.reporting.question_round:question_violations
  • Constant maljan.reporting.question_round:UNANSWERED_CODE
  • Docs none

question.unissued_id

A reply cites an id the run did not issue; it counts for nothing.

  • Raised at maljan.reporting.question_round:_judge
  • Constant maljan.reporting.question_round:UNISSUED_ID_CODE
  • Docs none

question.unknown_number

A reply is for a question number that was not asked.

  • Raised at maljan.reporting.question_round:question_violations
  • Constant maljan.reporting.question_round:UNKNOWN_NUMBER_CODE
  • Docs none

question.unknown_open_question

A reply names an open question the analysts did not leave.

  • Raised at maljan.reporting.question_round:_judge
  • Constant maljan.reporting.question_round:UNKNOWN_OPEN_QUESTION_CODE
  • Docs none

report

report.absence_contradicts_ledger

A report sentence that says a routine was not read (or its decompile not obtained, or its body not in the evidence), or that something is not in the ledger, or that a cited entry does not confirm (or verify) a value, or that an address is unresolved, while an answered entry of this run holds it (ledger_absence_contradictions). Asked once, naming the entry and showing what it holds (the routine's code, the object that names the address); a sentence kept after it is recorded.

  • Raised at maljan.pipeline.validation:ledger_absence_contradictions
  • Constant maljan.pipeline.validation:ABSENCE_CONTRADICTS_LEDGER_CODE
  • Docs Architecture

report.category_type_unstated

The report's category names a STIX malware type the judge's malware object, published as written, does not carry; marked beside the category line.

  • Raised at maljan.reporting.prose_decisions:category_types_unstated
  • Constant maljan.reporting.prose_decisions:CATEGORY_TYPE_UNSTATED_CODE
  • Docs none

report.channel_binding

No comment names its meaning, and maljan.reporting.composer_pro:channel_binding_violations passes more than one message for it: see the messages there.

  • Raised at maljan.reporting.composer_pro:channel_binding_violations
  • Constant maljan.pipeline.validation:CHANNEL_BINDING_CODE
  • Docs none

report.citation_not_evidence

No comment names its meaning, and the message at maljan.pipeline.validation:citation_violations is made only of values it fills in: see the message there.

  • Raised at maljan.pipeline.validation:citation_violations
  • Constant maljan.pipeline.validation:CITATION_NOT_EVIDENCE_CODE
  • Docs Architecture

report.citation_wrong_entry

No comment names its meaning, and maljan.pipeline.validation:wrong_entry_citations passes more than one message for it: see the messages there.

  • Raised at maljan.pipeline.validation:wrong_entry_citations
  • Constant maljan.pipeline.validation:CITATION_WRONG_ENTRY_CODE
  • Docs Architecture

report.configuration_uncited

No comment names its meaning; the message at maljan.pipeline.validation:configuration_citation_violations reads: "configuration item <index> (<key>) is marked <how> but cites no entry in this run's evidence. Cite the entry the value was read from, or mark how it was obtained as inferred."

  • Raised at maljan.pipeline.validation:configuration_citation_violations
  • Constant maljan.pipeline.validation:UNCITED_CONFIGURATION_CODE
  • Docs Architecture, The console

report.entry_contents_misstated

No comment names its meaning; the message at maljan.pipeline.validation:misstated_entry_contents reads: "The text says <named> <said> (<marked_cut>); <named> holds <held> values in this run. State what the entry holds, or cite the entry the statement is about."

  • Raised at maljan.pipeline.validation:misstated_entry_contents
  • Constant maljan.pipeline.validation:ENTRY_CONTENTS_MISSTATED_CODE
  • Docs Architecture

report.flow_voice

No comment names its meaning, and maljan.pipeline.validation:flow_voice_violations passes more than one message for it: see the messages there.

  • Raised at maljan.pipeline.validation:flow_voice_violations, maljan.pipeline.validation:persistence_not_observed_violations
  • Constant maljan.pipeline.validation:FLOW_VOICE_CODE
  • Docs Architecture, The console

report.identifier_uncited

No comment names its meaning; the message at maljan.pipeline.validation:identifier_citation_violations reads: "identifier <index> (<value>) cites no entry in this run's evidence. Cite the ev_ id of the entry the value was read in, or leave the identifier out."

  • Raised at maljan.pipeline.validation:identifier_citation_violations
  • Constant maljan.pipeline.validation:UNCITED_IDENTIFIER_CODE
  • Docs Architecture, The console

report.numeric_confidence

No comment names its meaning; the message at maljan.reporting.composer_pro:style_violations reads: "<path> writes a confidence as a number (<said>). Say how confident the assessment is in words (high, moderate, low), never as a number."

  • Raised at maljan.reporting.composer_pro:style_violations
  • Constant maljan.pipeline.validation:NUMERIC_CONFIDENCE_CODE
  • Docs none

report.persistence_not_observed

A section's prose states persistence where the sandbox, watching the registry and the files, recorded none: the report prints "no persistence observed" under that same section. Asked once; the prose kept is recorded.

  • Raised at maljan.pipeline.validation:persistence_not_observed_violations
  • Constant maljan.pipeline.validation:PERSISTENCE_NOT_OBSERVED_CODE
  • Docs Architecture

report.process_words

No comment names its meaning; the message at maljan.reporting.composer_pro:style_violations reads: "<path> names how this report was made (<said>). State the finding itself, in the sample's terms: no ledger, judge, mediator, producer, model, agent or tool call, and no analyst's name or claim number."

  • Raised at maljan.reporting.composer_pro:style_violations
  • Constant maljan.pipeline.validation:PROCESS_WORDS_CODE
  • Docs none

report.prose_shape

No comment names its meaning; the message at maljan.reporting.composer_pro:conclusion_shape_violations reads: "The conclusion is <count> paragraph<…>; write <low> or <high> short paragraphs, separated by a blank line."

  • Raised at maljan.reporting.composer_pro:conclusion_shape_violations, maljan.reporting.composer_pro:limitations_shape_violations, maljan.reporting.composer_pro:procedure_violations, maljan.reporting.composer_pro:summary_shape_violations
  • Constant maljan.pipeline.validation:PROSE_SHAPE_CODE
  • Docs none

report.published_technique_doubted

No comment of its own names its meaning; the comment over the group of constants it belongs to, on maljan.reporting.prose_decisions:PUBLISHED_TECHNIQUE_DOUBTED_CODE, reads: "A sentence of the report model's prose that calls a technique this run publishes a candidate or not confirmed; marked in place with the publication."

  • Raised at maljan.reporting.prose_decisions:statements_against_publication
  • Constant maljan.reporting.prose_decisions:PUBLISHED_TECHNIQUE_DOUBTED_CODE
  • Docs none

report.rule_match_as_action

No comment names its meaning; the message at maljan.pipeline.validation:rule_match_statement_violations reads: "<sentences> states <tid> <name> as something the sample does; this run publishes it on a <note>. Say that a rule matched and what it matched, or drop the sentence."

report.technique_name

No comment names its meaning; the message at maljan.pipeline.validation:technique_name_violations reads: "<tid> is <name> in the ATT&CK catalogue, not <written>.<belongs> Write the catalogue's name beside the id, or the id the name belongs to."

  • Raised at maljan.pipeline.validation:technique_name_violations
  • Constant maljan.pipeline.validation:TECHNIQUE_NAME_CODE
  • Docs Architecture

report.unpublished_value

No comment names its meaning; the message at maljan.pipeline.validation:unpublished_value_violations reads: "the text names values this run does not publish, without their state: <said>. A value this run does not publish is written only with its publish state beside it. Write the state beside each value, or write the text without the value."

  • Raised at maljan.pipeline.validation:unpublished_value_violations
  • Constant maljan.pipeline.validation:UNPUBLISHED_VALUE_CODE
  • Docs Architecture

report.value_not_carried

No comment names its meaning; the message at maljan.reporting.composer_pro:procedure_value_violations reads: "The procedure for <tid> drops <dropped>, which its claim names of the technique's behaviour. Carry the value that shows the procedure."

  • Raised at maljan.reporting.composer_pro:procedure_value_violations, maljan.reporting.composer_pro:summary_value_violations
  • Constant maljan.pipeline.validation:VALUE_NOT_CARRIED_CODE
  • Docs none

report.value_not_in_cited_entry

A table row whose whole value is in none of the entries it cites (stated_value_violations). Asked once; a row kept after it is marked beside its evidence.

  • Raised at maljan.pipeline.validation:stated_value_violations
  • Constant maljan.pipeline.validation:STATED_VALUE_UNHELD_CODE
  • Docs Architecture

stix

stix.annotation_out_of_schema

No comment names its meaning; the message at maljan.pipeline.validation:annotation_out_of_schema_violations reads: "the relationship at <where>: <problems>. Write it that way, or leave the property out; a value you keep is published as written and read as no number."

  • Raised at maljan.pipeline.validation:annotation_out_of_schema_violations
  • Constant maljan.pipeline.validation:ANNOTATION_OUT_OF_SCHEMA_CODE
  • Docs Architecture

stix.credit_without_claim

No comment names its meaning; the message at maljan.pipeline.validation:credit_without_claim_violations reads: "the relationship at <where> credits <n> with <tid>, and <who> — the evidence summary lists who named each technique. Credit only sources that named it, by the names the summary gives them, or leave x_maljan_contributing_agents empty. A credit you keep that names no source is not published."

stix.duplicate_label

No comment names its meaning; the message at maljan.agents.judge_postprocess:duplicate_label_violations reads: "<where> share the id <label>, so a reference to it could mean either and none is read as meaning one. Give each object its own id and name, in every reference, the one it means."

  • Raised at maljan.agents.judge_postprocess:duplicate_label_violations
  • Constant maljan.agents.judge_postprocess:DUPLICATE_LABEL_CODE
  • Docs Architecture

stix.evidence_ref_not_in_ledger

A ledger id the run's record cites for an exported object that the run's ledger does not hold. The export writes only ids a reader can follow.

  • Raised at maljan.reporting.renderers.stix_renderer:ExtendedSTIXRenderer._family_refs
  • Constant maljan.reporting.renderers.stix_renderer:EVIDENCE_REF_NOT_IN_LEDGER_CODE
  • Docs Architecture

stix.file_unidentified

No comment names its meaning; the message at maljan.pipeline.validation:validate_verdict_bundle reads: "the file at <where> has neither hashes nor name, and STIX needs at least one of them to say which file it is. Give it the hashes or the name a tool in this run reported, or leave it out; a file kept with neither is not exported."

  • Raised at maljan.pipeline.validation:validate_verdict_bundle
  • Constant maljan.pipeline.validation:FILE_UNIDENTIFIED_CODE
  • Docs none

stix.indicator_not_published

A judge indicator naming a value the one publish rule refuses — a host only the file's strings carry, a command line. Not exported, recorded, and unchanged in the judge's own bundle; the IOC table and /iocs print the same answer for the value.

  • Raised at maljan.reporting.renderers.stix_renderer:_judge_indicator_unpublished
  • Constant maljan.reporting.renderers.stix_renderer:UNPUBLISHED_VALUE_CODE
  • Docs Architecture

stix.indicator_type_contradicts_verdict

No comment names its meaning; the message at maljan.pipeline.validation:indicator_type_contradicts_verdict reads: "the indicator <named> is typed <_MALICIOUS_ACTIVITY> while the verdict you stated is <BENIGN_VERDICT>, so this bundle publishes the value as malicious activity to whoever reads it. The indicator-type vocabulary also has <_MILDER_INDICATOR_TYPES>. Retype it, or restate the verdict, or keep the type as it is — whichever you answer is what this run publishes, and a type you keep is recorded beside the bundle as raised and kept."

  • Raised at maljan.pipeline.validation:indicator_type_contradicts_verdict
  • Constant maljan.pipeline.validation:INDICATOR_TYPE_CONTRADICTS_VERDICT_CODE
  • Docs Architecture

stix.indicator_type_vocabulary

No comment names its meaning; the message at maljan.pipeline.validation:indicator_type_vocabulary_violations reads: "the indicator <named> is typed <t>; indicator_types says what the value indicates, not what kind of value it is, and STIX's vocabulary for it is <INDICATOR_TYPES>. Use one of those, or keep the type — whichever you answer is what this run publishes."

  • Raised at maljan.pipeline.validation:indicator_type_vocabulary_violations
  • Constant maljan.pipeline.validation:INDICATOR_TYPE_VOCABULARY_CODE
  • Docs Architecture

stix.indicator_unattributed_flow

A judge indicator naming a value the sandbox recorded and attributes no flow, or no process, of the sample to. The judge is asked once, with the sandbox's own fact beside the value; what it answers decides whether the value is published. A keep it was never asked about publishes nothing (stix_renderer.sandbox_row_kwargs).

  • Raised at maljan.pipeline.validation:unattributed_indicator_violations
  • Constant maljan.pipeline.validation:UNATTRIBUTED_INDICATOR_CODE
  • Docs HTTP API, Architecture

stix.is_family_contradicts_family

No comment names its meaning; the message at maljan.pipeline.validation:malware_object_violations reads: "the malware object <named> says is_family false, and its name is the family you attributed (<family>). is_family is true when the object stands for a family and false when it stands for this one sample. Set is_family true, or name the object for this sample, or keep it as written — whichever you answer is what this run publishes."

  • Raised at maljan.pipeline.validation:malware_object_violations
  • Constant maljan.pipeline.validation:IS_FAMILY_CONTRADICTS_FAMILY_CODE
  • Docs Architecture

stix.is_family_missing

No comment names its meaning; the message at maljan.pipeline.validation:validate_verdict_bundle reads: "the malware object <named> does not say is_family, which STIX requires: false when the object stands for this one sample, true when it stands for a family. Nothing is filled in for you."

  • Raised at maljan.pipeline.validation:validate_verdict_bundle
  • Constant maljan.pipeline.validation:IS_FAMILY_MISSING_CODE
  • Docs Architecture

stix.malformed_hash

A digest literal that is not a digest of the algorithm it is written under.

  • Raised at maljan.reporting.renderers.stix_renderer:_judge_indicator_problem
  • Constant maljan.reporting.renderers.stix_renderer:MALFORMED_HASH_CODE
  • Docs Architecture

stix.malware_object_under_benign

No comment names its meaning; the message at maljan.reporting.renderers.stix_renderer:ExtendedSTIXRenderer._render reads: "the malware object <named> is not in the exported bundle: this run's verdict is Benign. The object is unchanged in the judge's own bundle and the disagreement is in this run's validation findings."

  • Raised at maljan.reporting.renderers.stix_renderer:ExtendedSTIXRenderer._render
  • Constant maljan.reporting.renderers.stix_renderer:MALWARE_UNDER_BENIGN_CODE
  • Docs Architecture

stix.malware_type_vocabulary

No comment names its meaning, and maljan.pipeline.validation:malware_object_violations passes more than one message for it: see the messages there.

  • Raised at maljan.pipeline.validation:malware_object_violations
  • Constant maljan.pipeline.validation:MALWARE_TYPE_VOCABULARY_CODE
  • Docs Architecture

stix.pattern_refused

No comment names its meaning; the message at maljan.pipeline.validation:unknown_observable_type_violations reads: "the indicator <named> is not a pattern the STIX grammar reads: <refusal>. A consumer's parser refuses it whole. Write the comparison whole — an object path, an operator and a quoted value, in brackets — or drop the indicator; an indicator that keeps it is not exported."

  • Raised at maljan.pipeline.validation:unknown_observable_type_violations
  • Constant maljan.pipeline.validation:PATTERN_REFUSED_CODE
  • Docs Architecture

stix.property_not_carried

A property of a judge object that the platform's model for its type does not declare, so the export does not carry it. Recorded, not asked about: nothing is wrong with the judge's answer, and the retry is not spent on it.

  • Raised at maljan.agents.judge_postprocess:lift_misplaced_extensions, maljan.reporting.renderers.stix_renderer:ExtendedSTIXRenderer._normalize_judge_timestamps
  • Constant maljan.agents.judge_postprocess:PROPERTY_NOT_CARRIED_CODE, maljan.schemas.stix_models:PROPERTY_NOT_CARRIED_CODE
  • Docs Architecture

stix.shape_names_a_value

No comment names its meaning; the message at maljan.pipeline.validation:shape_names_a_value_violations reads: "the indicator <named> compares <path> with <operator> <literal>, which names every value that fits it; the export publishes values, so it is not exported as written. This run holds <value> as a value of its own: if you mean that value, write <suggestion>; or keep the <operator>, and it is not exported."

  • Raised at maljan.pipeline.validation:shape_names_a_value_violations
  • Constant maljan.pipeline.validation:SHAPE_NAMES_A_VALUE_CODE
  • Docs Architecture

stix.unescaped_backslash

No comment names its meaning; the message at maljan.pipeline.validation:unknown_observable_type_violations reads: "the indicator <named> quotes <stray> value(s) with a backslash the pattern grammar cannot read: inside a quoted value a STIX pattern escapes the quote and the backslash and nothing else, so every backslash of the value is written twice in the pattern (four times in the JSON string that carries it). Write it so, or drop the indicator; an indicator that keeps it is not exported."

  • Raised at maljan.pipeline.validation:unknown_observable_type_violations
  • Constant maljan.pipeline.validation:STRAY_BACKSLASH_CODE
  • Docs Architecture

stix.ungrounded_indicator

No comment names its meaning; the message at maljan.pipeline.validation:validate_verdict_bundle reads: "<problem> Emit indicators only for values a tool in this run actually saw, and prefer zero indicators to an invented one.<caveat>"

  • Raised at maljan.pipeline.validation:validate_verdict_bundle
  • Constant none: the code is written as a literal
  • Docs Architecture

stix.unknown_object

An object inside objects that no STIX type in the bundle's union matches. Set aside rather than rewritten: what the judge meant by it is the judge's, and a bundle is not worth losing over one of them.

  • Raised at maljan.agents.judge_postprocess:lift_misplaced_extensions
  • Constant maljan.agents.judge_postprocess:UNKNOWN_OBJECT_CODE
  • Docs Architecture

stix.unknown_object_path

No comment names its meaning; the message at maljan.pipeline.validation:unknown_observable_type_violations reads: "the indicator <named> compares a path its type does not have: <problem>. A pattern over it matches nothing a consumer holds. Write the comparison over a property the type defines, or drop the indicator; an indicator that keeps it is not exported."

  • Raised at maljan.pipeline.validation:unknown_observable_type_violations
  • Constant maljan.pipeline.validation:UNKNOWN_OBJECT_PATH_CODE
  • Docs Architecture

stix.unknown_observable_type

No comment names its meaning; the message at maljan.pipeline.validation:unknown_observable_type_violations reads: "the indicator <named> compares <written>, which is not a STIX Cyber-observable type, so no consumer holds an object this pattern could match. <answer> An indicator that keeps it is not exported."

  • Raised at maljan.pipeline.validation:unknown_observable_type_violations
  • Constant maljan.pipeline.validation:UNKNOWN_OBSERVABLE_TYPE_CODE
  • Docs Architecture

stix.unknown_technique

No comment names its meaning, and maljan.pipeline.validation:validate_verdict_bundle passes more than one message for it: see the messages there.

  • Raised at maljan.pipeline.validation:validate_verdict_bundle
  • Constant none: the code is written as a literal
  • Docs none

stix.unlinked_technique

What the run summary calls a judge annotation whose technique did not survive validation. Its own code: the technique's own rejection is recorded under its own, and this row says what that rejection cost the export.

  • Raised at maljan.pipeline.nodes:_note_unlinked_techniques
  • Constant maljan.pipeline.nodes:UNLINKED_TECHNIQUE_CODE
  • Docs Architecture

stix.unpublishable_artefact

An indicator over something that is not an endpoint: a mailbox that is not one, a file name that names a directory or a root.

  • Raised at maljan.reporting.renderers.stix_renderer:_judge_indicator_problem
  • Constant maljan.reporting.renderers.stix_renderer:UNPUBLISHABLE_ARTEFACT_CODE
  • Docs Architecture

stix.unpublishable_credit

A judge credit naming an agent that did not name the technique, which the judge was asked about (stix.credit_without_claim) and kept.

  • Raised at maljan.reporting.renderers.stix_renderer:_without_unconfirmed_credit
  • Constant maljan.reporting.renderers.stix_renderer:UNPUBLISHABLE_CREDIT_CODE
  • Docs Architecture

stix.unpublishable_domain

No comment of its own names its meaning; the comment over the group of constants it belongs to, on maljan.reporting.renderers.stix_renderer:LEGACY_UNPUBLISHABLE_CODES, reads: "What a run stored before stix.unpublishable_endpoint replaced them carries for the same decision. Nothing is migrated: a stored row is what that run recorded. The console reads these as the same decision, and apps/web/src/lib/validationRows.ts holds the list it reads them from."

  • Raised at nothing: kept for stored runs, as maljan.reporting.renderers.stix_renderer:LEGACY_UNPUBLISHABLE_CODES says
  • Listed in maljan.reporting.renderers.stix_renderer:LEGACY_UNPUBLISHABLE_CODES
  • Docs Architecture

stix.unpublishable_endpoint

One endpoint question, one code. A URL, a name and an address that fail the same host question are one class of decline, and a reader filtering on the code used to find that class under two names — with the second of them covering addresses too, which is not what it is called. The kind is in the sentence, where it says something.

  • Raised at maljan.reporting.renderers.stix_renderer:ExtendedSTIXRenderer._render, maljan.reporting.renderers.stix_renderer:_judge_indicator_problem
  • Constant maljan.reporting.renderers.stix_renderer:UNPUBLISHABLE_ENDPOINT_CODE
  • Docs Architecture, Latrodectus score: iteration 6, default model

stix.unpublishable_object

A judge object without a property the standard requires of it — a malware object with no is_family, a file with neither hashes nor name — that the judge was asked about and kept absent. Published, the bundle is one a consumer may refuse; filled in, it says something the judge did not.

  • Raised at maljan.reporting.renderers.stix_renderer:ExtendedSTIXRenderer._render, maljan.reporting.renderers.stix_renderer:ExtendedSTIXRenderer._without_empty_references
  • Constant maljan.reporting.renderers.stix_renderer:UNPUBLISHABLE_OBJECT_CODE
  • Docs none

stix.unpublishable_pattern

A pattern over an object type STIX does not have, which the judge was asked about under stix.unknown_observable_type and kept. This row is the export's decision rather than the judge's answer, so it has a code of its own.

  • Raised at maljan.reporting.renderers.stix_renderer:_judge_indicator_problem
  • Constant maljan.reporting.renderers.stix_renderer:UNPUBLISHABLE_PATTERN_CODE
  • Docs Architecture

stix.unpublishable_producer

A created_by_ref naming an identity the bundle does not hold, which the export replaced with this platform's identity.

  • Raised at maljan.reporting.renderers.stix_renderer:_produced_by
  • Constant maljan.reporting.renderers.stix_renderer:UNPUBLISHABLE_PRODUCER_CODE
  • Docs none

stix.unpublishable_url

No comment of its own names its meaning; the comment over the group of constants it belongs to, on maljan.reporting.renderers.stix_renderer:LEGACY_UNPUBLISHABLE_CODES, reads: "What a run stored before stix.unpublishable_endpoint replaced them carries for the same decision. Nothing is migrated: a stored row is what that run recorded. The console reads these as the same decision, and apps/web/src/lib/validationRows.ts holds the list it reads them from."

  • Raised at nothing: kept for stored runs, as maljan.reporting.renderers.stix_renderer:LEGACY_UNPUBLISHABLE_CODES says
  • Listed in maljan.reporting.renderers.stix_renderer:LEGACY_UNPUBLISHABLE_CODES
  • Docs Architecture

tool

tool.argument_names_its_parameter

The question a call is answered with when an argument's value is the name of its own parameter. A static analyst sent strings the pattern "\"pattern\"" twice — the parameter's name, quoted — which searched for the word "pattern", matched eleven noise runs past the page it asked for, and spent two of its repeats on it. The call is not run and the argument is not rewritten: the model is asked for the value it meant.

  • Raised at maljan.agents.evidence_recorder:_record_tool._names_its_own_parameter
  • Constant maljan.agents.evidence_recorder:SELF_NAMED_ARGUMENT_CODE
  • Docs Architecture

validation

validation.check_failed

A check that raised on an answer. Its findings are missing from the run, and the run says so: an advisory row naming the check and the exception's class, never shown to the producer (it cannot fix the check), never a reason to drop anything, and the check's name in run_summary.validation.not_run.

  • Raised at maljan.pipeline.validation:_collect
  • Constant maljan.pipeline.validation:CHECK_FAILED_CODE
  • Docs none

verdict

verdict.agent_ceiling

What is recorded when the judge's own ceiling (llm.agents.judge) refused the verdict call: no answer, as with a timeout, so nothing is asked again and the verdict is this pipeline's own fallback bundle. The row's message is the ceiling's sentence; the degradation reason naming the agent and its ceiling comes from the spend meter (SpendMeter.agent_reasons).

  • Raised at maljan.agents.judge_agent:JudgeAgent.give_verdict
  • Passes on maljan.pipeline.nodes:make_judge_node.node_fn
  • Constant maljan.agents.judge_agent:VERDICT_AGENT_CEILING_CODE
  • Docs Configuration

verdict.assessment_conflict

No comment names its meaning, and maljan.pipeline.validation:assessment_conflict_violations passes more than one message for it: see the messages there.

  • Raised at maljan.pipeline.validation:assessment_conflict_violations
  • Constant maljan.pipeline.validation:ASSESSMENT_CONFLICT_CODE
  • Docs Architecture

verdict.assessment_missing

No comment names its meaning; the message at maljan.pipeline.validation:assessment_violations reads: "Add x_maljan_assessment at the top level of the bundle, as a sibling of "objects" and not inside it, with verdict, severity {rating, rationale}, malware_category, family {name, confidence, evidence_ids} and confidence. Omit only a field the evidence cannot support."

  • Raised at maljan.pipeline.validation:assessment_violations
  • Constant maljan.pipeline.validation:ASSESSMENT_MISSING_CODE
  • Docs none

verdict.assessment_read_loosely

A leaf of the judge's assessment written in a type it does not take, and with one reading in the type it does (schemas.judgement.read_assessment): read so and recorded as settled, like the relocation; nothing is left to ask.

  • Raised at maljan.agents.judge_postprocess:assessment_rows
  • Constant maljan.agents.judge_postprocess:ASSESSMENT_READ_LOOSELY_CODE
  • Docs none

verdict.assessment_relocated

No comment names its meaning; the message at maljan.agents.judge_postprocess:lift_misplaced_extensions reads: "<ASSESSMENT_PROPERTY> was written inside objects[<index>] and belongs beside the list; it was moved there unchanged and read from there. Write it as a sibling of "objects" next time."

  • Raised at maljan.agents.judge_postprocess:lift_misplaced_extensions
  • Constant maljan.agents.judge_postprocess:ASSESSMENT_RELOCATED_CODE
  • Docs Architecture

verdict.assessment_unreadable

A leaf of the judge's assessment that cannot be read in the type it takes. Left absent — never guessed — and the judge is asked about it once with its own value quoted; one still unreadable after that is published absent, and the report reader is told so.

  • Raised at maljan.agents.judge_postprocess:assessment_rows
  • Constant maljan.agents.judge_postprocess:ASSESSMENT_UNREADABLE_CODE
  • Docs none

verdict.cut_at_output_cap

The correction for an answer the output cap cut off. The benchmark's large model wrote a bundle of about 25,000 characters on one sample, twice: both answers stopped at exactly the 8,192 tokens judge_max_tokens allows, before the bundle closed, and the only correction it was given said the answer "was not a JSON STIX bundle" — so it wrote the same bundle again.

  • Raised at maljan.agents.judge_agent:verdict_cut_violation
  • Constant maljan.agents.judge_agent:VERDICT_CUT_CODE
  • Docs Architecture

verdict.fallback

What is recorded when even the retry was not a bundle. The code lands in run_summary.validation.unresolved; the reason joins the report's degradation reasons, where a reader looking at a verdict with no severity will find out why it has none.

  • Raised at maljan.agents.judge_agent:JudgeAgent.give_verdict, maljan.pipeline.nodes:with_verdict_fallback
  • Passes on maljan.pipeline.nodes:make_judge_node.node_fn
  • Constant maljan.agents.judge_agent:VERDICT_FALLBACK_CODE
  • Docs Architecture

verdict.not_json

No comment names its meaning; the message at maljan.agents.judge_agent:JudgeAgent.give_verdict._validate reads: "Your previous answer was not a JSON STIX bundle. Your answer is the JSON bundle alone, with no prose around it."

  • Raised at maljan.agents.judge_agent:JudgeAgent.give_verdict._validate
  • Constant none: the code is written as a literal
  • Docs none

verdict.retry_failed

What is recorded when the judge's one retry failed — it timed out, answered prose, or answered JSON that was not a bundle — after a first answer that was a bundle. The first bundle is kept, with what was still wrong with it: a failed correction says nothing about the sample, and a valid verdict replaced by the text fallback or by a timeout published what the judge never wrote. The row says the retry was spent and how it failed.

  • Raised at maljan.agents.judge_agent:JudgeAgent.give_verdict
  • Constant maljan.agents.judge_agent:VERDICT_RETRY_FAILED_CODE
  • Docs none

verdict.severity_enum

No comment names its meaning; the message at maljan.pipeline.validation:validate_verdict_bundle reads: "severity.rating is <rating>; it must be one of <SEVERITY_RATINGS>."

  • Raised at maljan.pipeline.validation:validate_verdict_bundle
  • Constant none: the code is written as a literal
  • Docs none

verdict.timeout

What is recorded when the judge never answered at all. A retry would cost a second full judge timeout and could only produce the same fallback bundle, so nothing is asked again — but a verdict extracted from the analysts' text because the judge timed out is not a verdict the judge gave, and the run summary says so rather than showing a clean validation block.

  • Raised at maljan.agents.judge_agent:JudgeAgent.give_verdict
  • Passes on maljan.pipeline.nodes:make_judge_node.node_fn
  • Constant maljan.agents.judge_agent:VERDICT_TIMEOUT_CODE
  • Docs Architecture

verdict.unrecognised

No comment names its meaning; the message at maljan.pipeline.validation:stated_verdict_violations reads: "x_maljan_assessment.verdict says <written>, which is not one of <listed>. Answer with exactly one of those three words and nothing else — no qualifier, no parenthesis, no sentence; put anything you want to qualify it with in severity.rationale. Until it is one of them this run publishes <INCONCLUSIVE_VERDICT> and no confidence, and your own answer is printed beside it."

  • Raised at maljan.pipeline.validation:stated_verdict_violations
  • Constant maljan.pipeline.validation:UNRECOGNISED_VERDICT_CODE
  • Docs Architecture

verdict.unstated

No comment names its meaning; the message at maljan.pipeline.validation:stated_verdict_violations reads: "x_maljan_assessment states no verdict. State it: set x_maljan_assessment.verdict to one of <listed>, and set x_maljan_assessment.confidence to how sure you are of it. Write a malware object only for a sample you conclude is malware; without the field the verdict is read off the objects, which is a guess at what you meant."

  • Raised at maljan.pipeline.validation:stated_verdict_violations
  • Constant maljan.pipeline.validation:UNSTATED_VERDICT_CODE
  • Docs Architecture

verdict.unsupported_benign

No comment names its meaning; the message at maljan.pipeline.validation:unsupported_benign_violations reads: "This verdict is Benign and no analyst made a single claim about the sample, so nothing examined it. Benign is a finding and needs evidence: cite the ledger entry that establishes it — a valid signature from signing_info is the usual one — or return Suspicious and say in the rationale that the run was inconclusive. The entries this run recorded include <listed>."

  • Raised at maljan.pipeline.validation:unsupported_benign_violations
  • Constant maljan.pipeline.validation:UNSUPPORTED_BENIGN_CODE
  • Docs Architecture

verdict.unsupported_malware

No comment names its meaning; the message at maljan.pipeline.validation:unsupported_malware_violations reads: "This verdict is Malware and no analyst made a single claim about the sample, so nothing examined it. Malware is a finding and needs evidence: cite the ledger entries that establish it — a reputation entry, a signature or capability rule hit, an event rule match — or return Suspicious and say in the rationale that the run was inconclusive. The entries this run recorded include <listed>."

  • Raised at maljan.pipeline.validation:unsupported_malware_violations
  • Constant maljan.pipeline.validation:UNSUPPORTED_MALWARE_CODE
  • Docs Architecture

Unresolved code positions

Each of these is a code position whose value the register could not follow to a literal or a constant: mostly a finding built from a code it was handed, out of a row or another finding. It may carry a code this page does not list.

  • maljan.agents.delegation:_hand_over_the_record: code=str(row.get('code', '')), the result of a call.
  • maljan.core.team_lint:TeamFinding.to_dict: "code": self.code, an attribute of a value.
  • maljan.pipeline.nodes:_note_export_findings: "code": code, code, bound by unpacking, +=, with or except.
  • maljan.pipeline.nodes:_violations_from_rows: code=str(row.get('code')), the result of a call.
  • maljan.pipeline.validation:ValidationTally.record_unresolved: "code": v.code, an attribute of a value.
  • maljan.pipeline.validation:Violation.to_dict: "code": self.code, an attribute of a value.
  • maljan.pipeline.validation:_FeedbackFeed._emit: code=str(violation.code), an attribute of a value.
  • maljan.pipeline.validation:record_flagged_statements: code=violation.code, an attribute of a value.
  • maljan.pipeline.validation:validation_metrics: "code": violation.code, an attribute of a value.
  • maljan.providers.sandbox.upload:UploadSandboxProvider.__init__: 'report.json', a code-shaped string where no code position is, nor a read.
  • maljan.providers.sandbox.upload:UploadSandboxProvider.set_pending_blob: 'report.json', a code-shaped string where no code position is, nor a read.
  • maljan.reporting.evidence_bundles:function_table: FunctionCode(part.code, …), an attribute of a value.
  • maljan.reporting.renderers.markdown:_Context.__init__: "code": str(row.get('code', '')), the result of a call.
  • maljan.tools.errors:normalise_error: "code": code, the result of a call.
Edit on GitHub

Architecture

Components, the request and job lifecycle, teams as stages, agents and their tools, the evidence ledger, validation loops and report assembly.

Security

Authentication, roles, API keys, secret encryption, what an export leaves out, CORS and cookie flags, vulnerability reporting.

On this page

agreementagreement.failure_redoneagreement.listedagreement.rewrite_cites_elsewhereagreement.rewrite_drops_citationagreement.rewrite_ungroundedagreement.rewrittenagreement.schemaagreement.sentence_not_foundagreement.unknown_passageagreement.unknown_sourceattckattck.absence_claimattck.claim_does_not_describeattck.missing_idattck.platform_mismatchattck.unknown_idattck.weak_alignmentattributionattribution.ungrounded_familycomposercomposer.command_valuescomposer.cut_at_output_capcomposer.repeated_itemscomposer.schemaisrisr.claim_without_confidenceisr.claims_repeatedisr.claims_under_disputesisr.confidence_rangeisr.cut_at_output_capisr.decompiled_not_describedisr.empty_evidenceisr.function_claim_unheldisr.library_only_claimsisr.retry_droppedisr.retry_restated_fewisr.technique_line_unreadisr.ungrounded_techniqueisr.unparsed_answernarrativenarrative.schemanarrative.ungrounded_capabilitynarrative.ungrounded_findingnarrative.unpublished_indicatornarrative.unpublished_techniquequestionquestion.answered_twicequestion.established_ungroundedquestion.negative_on_open_questionquestion.negative_without_coveragequestion.schemaquestion.unansweredquestion.unissued_idquestion.unknown_numberquestion.unknown_open_questionreportreport.absence_contradicts_ledgerreport.category_type_unstatedreport.channel_bindingreport.citation_not_evidencereport.citation_wrong_entryreport.configuration_uncitedreport.entry_contents_misstatedreport.flow_voicereport.identifier_uncitedreport.numeric_confidencereport.persistence_not_observedreport.process_wordsreport.prose_shapereport.published_technique_doubtedreport.rule_match_as_actionreport.technique_namereport.unpublished_valuereport.value_not_carriedreport.value_not_in_cited_entrystixstix.annotation_out_of_schemastix.credit_without_claimstix.duplicate_labelstix.evidence_ref_not_in_ledgerstix.file_unidentifiedstix.indicator_not_publishedstix.indicator_type_contradicts_verdictstix.indicator_type_vocabularystix.indicator_unattributed_flowstix.is_family_contradicts_familystix.is_family_missingstix.malformed_hashstix.malware_object_under_benignstix.malware_type_vocabularystix.pattern_refusedstix.property_not_carriedstix.shape_names_a_valuestix.unescaped_backslashstix.ungrounded_indicatorstix.unknown_objectstix.unknown_object_pathstix.unknown_observable_typestix.unknown_techniquestix.unlinked_techniquestix.unpublishable_artefactstix.unpublishable_creditstix.unpublishable_domainstix.unpublishable_endpointstix.unpublishable_objectstix.unpublishable_patternstix.unpublishable_producerstix.unpublishable_urltooltool.argument_names_its_parametervalidationvalidation.check_failedverdictverdict.agent_ceilingverdict.assessment_conflictverdict.assessment_missingverdict.assessment_read_looselyverdict.assessment_relocatedverdict.assessment_unreadableverdict.cut_at_output_capverdict.fallbackverdict.not_jsonverdict.retry_failedverdict.severity_enumverdict.timeoutverdict.unrecognisedverdict.unstatedverdict.unsupported_benignverdict.unsupported_malwareUnresolved code positions