Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add the information about match context to the database #395

Open
msm-cert opened this issue Sep 16, 2024 · 0 comments
Open

Add the information about match context to the database #395

msm-cert opened this issue Sep 16, 2024 · 0 comments
Assignees
Labels
next-sprint Scheduled for work (CERT.PL internal) zone:backend Backend oriented tasks
Milestone

Comments

@msm-cert
Copy link
Member

msm-cert commented Sep 16, 2024

To implement #38, we'll need to add the information about match context to the database. AFAIK it's not possible to get it directly from Yara-Python (but do check), so it must be worked around by using offset: VirusTotal/yara#1335

This information should be stored for every string in every matched rule (there may be more than one rule). So maybe matches array should be changed to a dict. We can just store hexencoded context in the matches field then (as long as it's not too big).

for example if the rule is

rule test_romanum {
    strings:
        $a = "a"
        $b = "b"
    condition:
        all of them
}
rule test_romanum {
    strings:
        $c = "c"
        $d = "d"
    condition:
        all of them
}

There may be as much as 4 matches. If there are more than one match per string then only the first should be stored, and the rest ignored.

Finally, this information should be exposed via the API (included in the serialized object) like /api/job/{job_id}.

@msm-cert msm-cert added the zone:backend Backend oriented tasks label Sep 16, 2024
@msm-cert msm-cert added the next-sprint Scheduled for work (CERT.PL internal) label Sep 17, 2024
@msm-cert msm-cert added this to the v1.5.0 milestone Sep 29, 2024
@msm-cert msm-cert modified the milestones: v1.5.0, Sprint 1 Oct 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
next-sprint Scheduled for work (CERT.PL internal) zone:backend Backend oriented tasks
Projects
None yet
Development

When branches are created from issues, their pull requests are automatically linked.

2 participants