airbnb / binaryalert

BinaryAlert: Serverless, Real-time & Retroactive Malware Detection.
https://binaryalert.io
Apache License 2.0
1.4k stars 187 forks source link

Prefixed batching; Improved batcher/analyzer error handling #105

Closed austinbyers closed 6 years ago

austinbyers commented 6 years ago

to: @chunyong-lin size: medium

Background

The introduction of yextend has caused the BinaryAlert batch analysis to be more error-prone. This PR improves error logging and handling.

Changes

Testing

coveralls commented 6 years ago

Coverage Status

Coverage increased (+0.08%) to 93.137% when pulling ebad12f100e7789f510ccedfca4c323be99a8cb1 on austin-error-handling into db857f354b9f2c8b6a155c3c75180a6f07e5d1dd on master.

austinbyers commented 6 years ago
  1. Correct, we can only analyze the whole bucket or one specific prefix. Those are the only options supported by the list_bucket API. If a need arises in the future, we could support multiple prefixes, but that would be a fairly complex change.
  2. The prefix is just the beginning of an S3 key. So for example, you could set OBJECT_PREFIX=carbonblack/ to only batch analyze the downloads from Carbon Black.