Static Analysis Flow

Tiered file triage. The agent answers “definitely not known-bad” locally in microseconds and only reaches out to the Static Analysis API when it must. The design bias is fail-open: uncertainty never blocks a file.

Sequence

Tiers

1. Local filter (static_api/filter.rs). MARKANYFILTER is a xorf::BinaryFuse8 over IOC hashes (key = first 8 bytes of the SHA-256, big-endian). A binary fuse filter has no false negatives, so contains() == false means “not a known-bad hash” — answered with zero network. Hot-reloaded every ~30 s via mtime + ArcSwap. Built off-host as an offline ops step (see tier 2).
2. Confirm a possible hit (/lookup). contains() == true is “probably present” (~1/256 false positive), so the agent confirms against the API’s Postgres IOC repo. Malicious → act; Benign → done; Unknown → escalate. Bounded retry, fails open — an unconfirmed positive never blocks. The MARKANYFILTER artifact itself is built offline from the StaticAPI ioc_hashes set (a standalone ops step, not an online service) and hot-reloaded by the agent.
3. Full scan (/scan + poll). A local miss’s Unknown (or a lookup Unknown) escalates to a YARA-X scan: submit the file, poll GET /scan/:id until Done/Failed, then read the verdict.

A Malicious verdict drives Remediation; everything else lets the file proceed. See the Static Analysis API page for the server side of /lookup, /scan, and the Redis/Postgres stores.