Reference
Verify a verdict
When ONYX marks a link as malicious, you can check the signature yourself and see what it was based on.
Checked without contacting ONYXVER-0374
Every verdict is signed with Ed25519. The public key ships inside the connector, so the check is local.
If you had to ask us whether a verdict is genuine, there would be nothing to verify.
Fields of a verdictCMP-0375
| field | contents |
|---|---|
h | Identifier of the address analysed |
veredicto | malicious · suspicious · clean · unknown |
categoria | Type of threat |
confianza | 0 to 100, so you can set your own threshold |
expira | Date after which you must ask again |
evidencia | Identifier of the case file |
sig | Ed25519 signature |
A verdict with fields outside this list is rejected whole. The signature covers these fields, not the object, so anything else could be added without breaking it.
The case fileEXP-0376
The evidence field points to a document with the redirect chain, the hash of the screenshot, the rule that fired and the source it came from.
The signed verdict is stored in your installation's log. If someone's message is deleted, you can see why and check the signature. If the verdict was wrong, the record stays, dated.
Not implemented
The format is fixed. Issuing arrives with ONX-13.