tags are tags extracted from Triage.

raw triage reports correspond to each individual sandbox run of an object. https://pkg.go.dev/github.com/hatching/triage@v1.0.0/types#TriageReport

Files which were accessed during the detonation.

Registry keys which were read/written/deleted.

Commands which were executed during the detonation

Mutexes which were used during the detonation.

Any malware signatures which are detected during detonation.

Any mitre signatures which are detected during detonation. Mitre TTPs reference: https://attack.mitre.org/techniques/enterprise/

List of created serviced during detonation.

List of started services during detonation.

Dropped child file hashes.

In-memory child file hashes.

Detections (malware family, yara, suricata...)