WithSecureLabs / snake-core

snake-core - the real snake
BSD 3-Clause "New" or "Revised" License
15 stars 6 forks source link

Allow manual editing of parent/child relationships #13

Open alexkornitzer opened 4 years ago

alexkornitzer commented 4 years ago

Currently as parent/child relationships were a last minute add, they can only be created through scales. This means we cannot make manual links and we cannot edit them either. The hacky code in question is here: https://github.com/countercept/snake-core/blob/master/snake/utils/submitter.py#L61

alexkornitzer commented 4 years ago

Here is a crude script to manually add relationships to the samples in the db:

import sys

import pymongo

if len(sys.argv) != 3:
    sys.exit(1)

db = pymongo.MongoClient().snake
relationship = "manual:user"

parent = db.files.find_one({"sha256_digest": sys.argv[1]})
if not parent:
    sys.exit(1)
child = db.files.find_one({"sha256_digest": sys.argv[2]})
if not child:
    sys.exit(1)

if sys.argv[2] in parent['children']:
    if not relationship in parent['children'][sys.argv[2]]:
        parent['children'][sys.argv[2]] += [relationship]
else:
    parent['children'][sys.argv[2]] = [relationship]

if sys.argv[1] in child['parents']:
    if not relationship in child['parents'][sys.argv[1]]:
        child['parents'][sys.argv[1]] += [relationship]
else:
    child['parents'][sys.argv[1]] = [relationship]

db.files.update_one({"sha256_digest": sys.argv[1]}, {'$set': parent})
db.files.update_one({"sha256_digest": sys.argv[2]}, {'$set': child})

I have also updated snake-skin, because I somehow managed to lose the p/c indicators when going from vue to svelte, clearly I am getting senile!