Os tagging #112
Os tagging #112
Conversation
- Added Signature for Cisco IOS - Added generic add tag method to PluginBase
Added tagging of OS Information in Plugin: software components
Codecov Report
@@ Coverage Diff @@
## master #112 +/- ##
==========================================
+ Coverage 94.33% 94.35% +0.01%
==========================================
Files 294 296 +2
Lines 14498 14581 +83
==========================================
+ Hits 13677 13758 +81
- Misses 821 823 +2
Continue to review full report at Codecov.
|
| scanned_software = get_scanned_software('./signatures/os.yara') | ||
| first = True | ||
|
|
||
| with open('./code/__init__.py', 'w') as init_file: |
There was a problem hiding this comment.
it would be better to store this in bin/
| @@ -0,0 +1,13 @@ | |||
| def get_scanned_software(yara_signature_file): | |||
There was a problem hiding this comment.
function is to complex.
consider use of common_helper_files.get_string_list_from_file to avoid errors
and export parsing to another function (s.a.).
|
|
||
|
|
||
| def scan(): | ||
| scanned_software = get_scanned_software('./signatures/os.yara') |
There was a problem hiding this comment.
Please do not mix up string formating and read/write operations in one function.
There was a problem hiding this comment.
you might want to use common_helper_files.write_binary_to_file function to avoid errors and create folders automatically
| self.add_analysis_tag(file_object, 'OS', os, TagColor.GREEN, False) | ||
| self.add_analysis_tag(file_object, 'OS Version', entry, TagColor.GREEN, True) | ||
|
|
||
| @staticmethod |
There was a problem hiding this comment.
This method is not tested. Seems trivial to do it?
| def add_os_key(self, file_object): | ||
| for entry in file_object.processed_analysis[self.NAME]['summary']: | ||
| for os in OS_LIST: | ||
| if entry.find(os) != -1: |
There was a problem hiding this comment.
These cases are not tested. Does not seem to be hard to test.
| } | ||
| if 'tags' not in file_object.processed_analysis[self.NAME]: | ||
| file_object.processed_analysis[self.NAME]['tags'] = new_tag | ||
| else: |
There was a problem hiding this comment.
This case it not tested. It does not look hard to test it.
[1] https://github.com/rkonertz/FACT_core