search

JPCERTCC / impfuzzy

Fuzzy Hash calculated from import API of PE files
GNU General Public License v2.0
87 stars 18 forks source link

Labeling/Tag the clusters #1

Open garanews opened 6 years ago

garanews commented 6 years ago

Is it possible to add labels or tags to the clusters in Neo4j? Looking at this example and focusing to the cluster with 4 elements: image

:123 cluster: 64 id: 108 impfuzzy: 12:KOFlAJqEccHwu9DK+j7oV4W8IAGAVV4W8xJcD8uw5vn:TTsqEzwu9DK+j0V4WjAVV4WccD8uwBn md5: 4c1017de62ea4788c7c8058a8f825a2d :139 cluster: 64 id: 124 impfuzzy: 12:KOFlAJqEccHwu9DK+j7oV4W8IAGAVV4W8xJcD8uw5vn:TTsqEzwu9DK+j0V4WjAVV4WccD8uwBn md5: 43e896ede6fe025ee90f7f27c6d376a4 :128 cluster: 64 id: 113 impfuzzy: 12:zJFxJqEccHwu9DK+j7oV4W8IAGAKV4W8xJcDvuw5vn:t1qEzwu9DK+j0V4WjAKV4WccDvuwBn md5: 1fb407a20373f3970f08d3f3c086841d :122 cluster: 64 id: 107 impfuzzy: 12:zJFxJqEccHwu9DK+j7oV4W8IAGAKV4W8xJcDvuw5vn:t1qEzwu9DK+j0V4WjAKV4WccDvuwBn md5: 91a5594343b47462ebd6266a9c40abbe ![image](https://user-images.githubusercontent.com/16938405/41587493-a6b64c12-73af-11e8-8eaf-7783f2c06b24.png) I would like to have the possibility to tag the cluster n°64 with "Turla", making the tag also searchable. What do you think?
shu-tom commented 6 years ago

Yes, you can add tags by using the following cypher query.

MATCH (m1:Malware) WHERE m1.cluster=64 
CREATE (m1) set m1.tag="Turla"
RETURN m1
garanews commented 6 years ago

I'm getting this error:

image

I have also another question: when new data are be added into db, the cluster id of previous data can change? I noticed that my old 4 nodes cluster (with id:64) now has id: 63....

shu-tom commented 6 years ago

How about the following cypher query?

MATCH (m1:Malware) WHERE m1.cluster=64 
MERGE (m) set m1.tag="Turla"
RETURN m1

Please use the following query to change the cluster id.

MATCH (m1:Malware) WHERE m1.cluster=64 
MERGE (m) set m1.cluster=63
RETURN m1
garanews commented 6 years ago

No errors with the first cypher query:

image

image

About the second one: why you suggest me that query? I meant if the cluster id is something that can change in the database during the time or if it's a static value.

And can you please suggest me the query to retrieve the tag searching for an hash for example?