CybercentreCanada / assemblyline

AssemblyLine 4: File triage and malware analysis
https://cybercentrecanada.github.io/assemblyline4_docs/
MIT License
249 stars 15 forks source link

Priority seems to be off by 1 #253

Open lfreijo opened 2 months ago

lfreijo commented 2 months ago

Describe the bug When submitting a file for processing using the ingest (https://YourServer/api/v4/ingest/) and passing a priority of 100 the job get's marked as "Medium" instead of "Low". In addition passing priority of 1 cases the Dispatcher to crash.

To Reproduce Steps to reproduce the behavior:

  1. Create a POST to https://YourServer/api/v4/ingest/ with body containing bin=[your file bytes] and json={"Params": {"priority":100}}
  2. Look in the UI at the file submitted
  3. See that the Priority is marked Medium (can verify it is recorded as 100 by hovering)

Expected behavior The docs do not describe what the priority thresholds should be as far as I could find, but in the contsants.py file here it seems to indicate that 1-100 should be Low. https://github.com/CybercentreCanada/assemblyline-base/blob/34cddbd7bbb739f2d82109bd6bce2543e13a3933/assemblyline/common/constants.py#L48-L56

Screenshots Currently configured Priorities from the UI: Screenshot 2024-08-29 at 12 46 30 PM

Environment (please complete the following information if pertinent):

Additional context My guess is that something is subtracting 1 from the priority somewhere in the pipeline for decisions, but still storing the right number. Also setting priority to 1 caused the dispatcher to totally stop working. I cannot provide system logs for that, but wanted to let you know. I could not find the exact AssemblyLine version in the UI, it might be helpful to add that to the dashboard or somewhere.