Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add the information about match context to the database #395

Open
msm-cert opened this issue Sep 16, 2024 · 0 comments
Open

Add the information about match context to the database #395

msm-cert opened this issue Sep 16, 2024 · 0 comments
Assignees
Labels
next-sprint zone:backend Backend oriented tasks

Comments

@msm-cert
Copy link
Member

msm-cert commented Sep 16, 2024

To implement #38, we'll need to add the information about match context to the database. AFAIK it's not possible to get it directly from Yara-Python (but do check), so it must be worked around by using offset: VirusTotal/yara#1335

This information should be stored for every string in every matched rule (there may be more than one rule). So maybe matches array should be changed to a dict. We can just store hexencoded context in the matches field then (as long as it's not too big).

for example if the rule is

rule test_romanum {
    strings:
        $a = "a"
        $b = "b"
    condition:
        all of them
}
rule test_romanum {
    strings:
        $c = "c"
        $d = "d"
    condition:
        all of them
}

There may be as much as 4 matches. If there are more than one match per string then only the first should be stored, and the rest ignored.

Finally, this information should be exposed via the API (included in the serialized object) like /api/job/{job_id}.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
next-sprint zone:backend Backend oriented tasks
Projects
None yet
Development

No branches or pull requests

2 participants