CybercentreCanada / assemblyline

AssemblyLine 4: File triage and malware analysis
https://cybercentrecanada.github.io/assemblyline4_docs/
MIT License
249 stars 15 forks source link

Classification feature with standalone docker deployment ? #251

Closed githule closed 3 months ago

githule commented 3 months ago

Describe the bug

I am not sure to understand well but it seems that the classification feature is only available to K8s deployments, not to docker deployments.

Please can you clarify if that feature is or is not available for docker setup ?

To Reproduce Steps to reproduce the behavior:

  1. Setup a docker install
  2. Try to configure TLP as described in the documentation (but it only mentions to K8s as seen on https://cybercentrecanada.github.io/assemblyline4_docs/installation/classification_engine/)
  3. TLP is shown on API results but it only reports TLP Clear whatever was configured during sample submission

Environment (please complete the following information if pertinent):

Am I missing something in the documentation or should I be able to deploy the classification feature on Docker Standalone environment ?

Thank you for your help.

cccs-rs commented 3 months ago

Not necessarily true, all that would be required is to mount your classification definition to the containers under /etc/assemblyline/classification.yml

In fact, there is a PR that seems to stage the classification file to be mounted but it hasn't been merged yet: https://github.com/CybercentreCanada/assemblyline-docker-compose/pull/33.

I can review this PR and see if we can get it merged and that would help enable classification on Docker deployments

githule commented 3 months ago

It's working on my side. Just updated my docker compose file like specified in that PR. Thank you.