AI Verdict

curl -X POST https://api.dfir-lab.ch/v1/phishing/analyze/ai \
  -H "Authorization: Bearer sk-dfir-your-key-here" \
  -H "Content-Type: application/json" \
  -d '{
    "senderEmail": "suspicious@example.com",
    "senderDomain": "example.com",
    "subject": "Urgent: Verify Your Account",
    "authResults": {
      "spf": { "result": "fail", "domain": "example.com" },
      "dkim": { "result": "fail", "domain": "example.com" },
      "dmarc": { "result": "fail", "domain": "example.com" }
    },
    "suspiciousIndicators": [
      { "category": "auth_failure", "description": "SPF check failed", "severity": "high" }
    ],
    "extractedIOCs": [
      { "type": "domain", "value": "evil-login.com", "enrichmentVerdict": "malicious", "enrichmentScore": 85 }
    ],
    "hopCount": 4,
    "heuristicScore": 72,
    "heuristicVerdict": "malicious"
  }'

import requests

url = "https://api.dfir-lab.ch/v1/phishing/analyze/ai"
headers = {
    "Authorization": "Bearer sk-dfir-your-key-here",
    "Content-Type": "application/json",
}
payload = {
    "senderEmail": "suspicious@example.com",
    "senderDomain": "example.com",
    "subject": "Urgent: Verify Your Account",
    "authResults": {
        "spf": {"result": "fail", "domain": "example.com"},
        "dkim": {"result": "fail", "domain": "example.com"},
        "dmarc": {"result": "fail", "domain": "example.com"},
    },
    "suspiciousIndicators": [
        {"category": "auth_failure", "description": "SPF check failed", "severity": "high"}
    ],
    "extractedIOCs": [
        {"type": "domain", "value": "evil-login.com", "enrichmentVerdict": "malicious", "enrichmentScore": 85}
    ],
    "hopCount": 4,
    "heuristicScore": 72,
    "heuristicVerdict": "malicious",
}

response = requests.post(url, json=payload, headers=headers)
data = response.json()

# AI verdict may be null if Claude is unavailable
ai = data["data"]["ai_verdict"]
if ai:
    print(f"Risk Level: {ai['risk_level']}")
    print(f"Confidence: {ai['confidence_score']}%")
    print(f"Summary: {ai['executive_summary']}")
    print(f"Model: {ai['model']}")
    print("\nKey Findings:")
    for finding in ai["key_findings"]:
        print(f"  - {finding}")
    print("\nRecommended Actions:")
    for action in ai["recommended_actions"]:
        print(f"  - {action}")
    # Persuasion analysis
    if ai.get("persuasion_analysis"):
        pa = ai["persuasion_analysis"]
        print(f"\nDominant Persuasion Principle: {pa['dominantPrinciple']}")
        print(f"Manipulation Score: {pa['manipulationScore']}/100")
else:
    print("AI analysis unavailable — credits were still charged")

print(f"\nCredits used: {data['meta']['credits_used']}")
print(f"Credits remaining: {data['meta']['credits_remaining']}")

const response = await fetch("https://api.dfir-lab.ch/v1/phishing/analyze/ai", {
  method: "POST",
  headers: {
    Authorization: "Bearer sk-dfir-your-key-here",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    senderEmail: "suspicious@example.com",
    senderDomain: "example.com",
    subject: "Urgent: Verify Your Account",
    authResults: {
      spf: { result: "fail", domain: "example.com" },
      dkim: { result: "fail", domain: "example.com" },
      dmarc: { result: "fail", domain: "example.com" },
    },
    suspiciousIndicators: [
      { category: "auth_failure", description: "SPF check failed", severity: "high" },
    ],
    extractedIOCs: [
      { type: "domain", value: "evil-login.com", enrichmentVerdict: "malicious", enrichmentScore: 85 },
    ],
    hopCount: 4,
    heuristicScore: 72,
    heuristicVerdict: "malicious",
  }),
});

interface PersuasionAnalysis {
  principles: {
    reciprocity: number;
    commitment: number;
    socialProof: number;
    authority: number;
    liking: number;
    scarcity: number;
  };
  dominantPrinciple: string;
  manipulationScore: number;
  tactics: string[];
}

interface ManipulationScoring {
  dimensions: {
    urgency: number;
    fear: number;
    reward: number;
    authority: number;
    curiosity: number;
    trust: number;
  };
  overallRisk: "low" | "medium" | "high" | "critical";
  patterns: string[];
}

interface VisualAnalysis {
  brandImpersonation: boolean;
  impersonatedBrand: string | null;
  visualTechniques: string[];
  confidence: number;
}

interface AIVerdict {
  risk_level: "safe" | "suspicious" | "malicious" | "highly_malicious";
  confidence_score: number;
  executive_summary: string;
  key_findings: string[];
  recommended_actions: string[];
  model: string;
  persuasion_analysis: PersuasionAnalysis | null;
  manipulation_scoring: ManipulationScoring | null;
  visual_analysis: VisualAnalysis | null;
}

const result = await response.json();
const { data, meta } = result;

console.log(`Credits used: ${meta.credits_used}, remaining: ${meta.credits_remaining}`);

const ai: AIVerdict | null = data.ai_verdict;
if (ai) {
  console.log(`Risk: ${ai.risk_level} (confidence: ${ai.confidence_score}%)`);
  console.log(`Summary: ${ai.executive_summary}`);
  ai.key_findings.forEach((f: string) => console.log(`  Finding: ${f}`));
  ai.recommended_actions.forEach((a: string) => console.log(`  Action: ${a}`));

  if (ai.persuasion_analysis) {
    console.log(`Dominant principle: ${ai.persuasion_analysis.dominantPrinciple}`);
    console.log(`Manipulation score: ${ai.persuasion_analysis.manipulationScore}/100`);
  }
} else {
  console.log("AI analysis unavailable — credits were still charged");
}