Tendrl

Docs / Surface / overview

Surface

Surface is a file and payload scanning service that detects malware, exploits, prompt injections, sensitive data exposure, and other threats in real-time before content reaches your systems.

Surface runs as a first-class service on the Tendrl platform, using the same account and auth infrastructure as Contact and Strand.

How you can use it

What Surface scans

Threat detection engines

File engines

Engine What it catches
Signatures & Threat Feeds Known malware by hash, malicious URLs/IPs/domains, and thousands of YARA pattern rules
ML Classifier Purpose-built models for executables, Office documents, PDFs, and scripts; catches new and modified threats that signatures miss
Document & Script Analysis Macro-based threats, embedded objects, obfuscated content, and suspicious script behavior
Executable Analysis Packed or protected binaries, suspicious capabilities, and hidden strings
IOC Extraction URLs, IPs, domains, and hashes found inside the file, cross-referenced against threat feeds
Fuzzy Matching Detects repacked or modified variants of known threats even when the exact hash has changed
Archive Scanning Unpacks and individually scans each entry in ZIP, RAR, 7-Zip, and tar archives
CVE Enrichment Links detected threats to CVE records where available, with severity scores

Payload engines (agentic security)

Payload scans run four additional engines for AI and agentic workflows:

Engine What it detects
Prompt Injection Adversarial instructions embedded in text
Sensitive Data Exposed API keys, credentials, and PII
Code Extraction Embedded shell commands and scripts hidden in text payloads
Tool Call Analysis Suspicious function call patterns

Safety scores

Every scan returns a score from 0 to 100. Higher is safer.

Score range Threat level Recommended action
86–100 Clean Allow
71–85 Informational Allow
31–70 Suspicious Review
0–30 Malicious Block

Informational means minor or low-severity signals were noted but the content is still treated as safe to allow, which is useful for surfacing context without blocking.

Scores combine signals from all engines. Content flagged by multiple independent engines scores lower than content flagged by a single check.

Result shape (Strand connector)

When you use the surface.platform connector in Strand workflows, the platform normalizes the response into this shape:

json

{
  "score": 95,
  "threat_level": "Clean",
  "primary_threat": "No threats detected",
  "recommended_action": "Allow",
  "iocs": [],
  "safe": true,
  "request_id": "550e8400-e29b-41d4-a716-446655440000"
}
Field Description
score 0–100 safety score (higher = safer)
threat_level Clean, Informational, Suspicious, or Malicious
primary_threat Top matched threat label
recommended_action Allow, Review, or Block
iocs Indicators of compromise (URLs, IPs, domains, hashes)
safe true when threat_level is not in the node's reject_on list
request_id Correlation ID for this scan

Field names use snake_case because the platform normalizes them from the Surface API's camelCase response.

Privacy

Files and payloads are loaded into memory for scanning and discarded immediately after. Surface stores scan results, metadata, and content hashes, never the file or payload contents themselves. When using the scanner binary, content never leaves your machine at all.

Get started

← Back to Surface docs