airbnb / binaryalert

BinaryAlert: Serverless, Real-time & Retroactive Malware Detection.
https://binaryalert.io
Apache License 2.0
1.41k stars 187 forks source link

Feature Request - Summary returns a list of matches rather than a dict? #178

Open slw07g opened 3 years ago

slw07g commented 3 years ago

https://github.com/airbnb/binaryalert/blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/lambda_functions/analyzer/binary_info.py#L123 ^ Rather than using keys for each match, have you considered just using a list/array - or making this configurable?

  matched_rules = {
            'Rule{}'.format(index): {
                'MatchedData': list(sorted(match.matched_data)),  # E.g. "HelloWorld"
                'MatchedStrings': list(sorted(match.matched_strings)),  # E.g. "$string1"
                'Meta': match.rule_metadata,
                'RuleFile': match.rule_namespace,
                'RuleName': match.rule_name
            }   
            for index, match in enumerate(self.yara_matches, start=1)
      }    

versus

  matched_rules = 
            [ {
                'MatchedData': list(sorted(match.matched_data)),  # E.g. "HelloWorld"
                'MatchedStrings': list(sorted(match.matched_strings)),  # E.g. "$string1"
                'Meta': match.rule_metadata,
                'RuleFile': match.rule_namespace,
                'RuleName': match.rule_name
            }
            for _, match in enumerate(self.yara_matches, start=1)
      ]