Frequently asked questions
Plain-language notes about the workspace, analysis flow, and the limits of the information it presents.
DRAFT — This FAQ describes the current product interface. It is review copy, not a service-level promise or a statement that every output will be available for every file.
What does MalSight analyze?
The workspace accepts a suspicious file and keeps its analysis status, findings, and available outputs together. Results depend on the evidence recovered from that file; a completed job does not guarantee that every kind of detection output exists.
Which outputs can I use?
An analysis can provide a readable report and, when supported by the evidence, YARA or network-detection rules. Downloaded rules are starting points for analyst review and validation, not automatic assurances that a file or connection is malicious.
How is account usage shown?
Submission and storage limits remain separately labeled. Credit and provider-token information must come from configured, measured sources; when those sources are unavailable, the interface should say so rather than inventing a balance, allowance, price, or usage total.
Where do I manage an investigation?
Use Workspace to submit files and revisit retained jobs. Account contains account and subscription controls. Access to reports and other protected actions continues to follow the existing authentication and subscription rules.