CybercentreCanada / assemblyline

AssemblyLine 4: File triage and malware analysis
https://cybercentrecanada.github.io/assemblyline4_docs/
MIT License
248 stars 15 forks source link

Configurable resubmit workflows #266

Open kam193 opened 2 months ago

kam193 commented 2 months ago

Is your feature request related to a problem? Please describe. The "Resubmit for Dynamic Analysis" button (especially in file details) is very useful. However, I have another resubmissions I very often do on a file level. Now, I need to click on "Adjust parameters before submission" and manually adjust the service list as well as re-type custom metadata.

Describe the solution you'd like I'd love to define my own "resubmit" buttons, especially on the file details view, e.g. "resubmit for check in VirusTotal". I'd like to define the set of services, that should be executed in such a flow.

Describe alternatives you've considered "Post-process" actions looks like some good starting point - and yeah, some of my actions may be in the future automated there. However, they work on the submission level, and this is not what I want. E.g. using the free VirusTotal API, I do not want to send the whole submission composed of an archive with mutiple files there, as I quickly exceed the quota. Instead, I send there only specific files I find suspicious based on other service results.

However, maybe the post-process actions (or just its syntax) could be a place to define additional resubmission workflows.

Additional context