what is the purpose for parse_files

[priamai]

I am not sure about the parse_files function utility:

• it loads all the files via recursive glob
• it saves them into another folder

I am guessing what this function should do: a) validate the file against the official json schema b) accumulate some basic statistics like tag distribution c) filter out some potential low quality files base don author's reputation

Cheers.

[ananyalahiri2003]

Just made the changes for the below - a) validate the file against the official json schema b) accumulate some basic statistics like tag distribution

For c), what is the way to assess author reputation pls? "author" and "falsepositives"? I'll make the change based on your input. Thanks

[priamai]

Author reputation, I would say for now if the author is Nextron Systems this should be high quality. Any other authors we shall use some human review to assess.

Sent from Outlook for Androidhttps://aka.ms/AAb9ysg

---

From: ananyalahiri2003 @.> Sent: Sunday, July 28, 2024 11:59:30 am To: ananyalahiri2003/sigma_attack @.> Cc: Paolo Di Prodi @.>; Author @.> Subject: Re: [ananyalahiri2003/sigma_attack] what is the purpose for parse_files (Issue #3)

Just made the changes for the below - a) validate the file against the official json schema b) accumulate some basic statistics like tag distribution

For c), what is the way to assess author reputation pls? "author" and "falsepositives"? I'll make the change based on your input. Thanks

— Reply to this email directly, view it on GitHubhttps://github.com/ananyalahiri2003/sigma_attack/issues/3#issuecomment-2254457224, or unsubscribehttps://github.com/notifications/unsubscribe-auth/ANVNMBSFC2RKMNTRST536CTZOS6H5AVCNFSM6AAAAABLHBKOS2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENJUGQ2TOMRSGQ. You are receiving this because you authored the thread.Message ID: @.***>

[priamai]

The inclusion of false positives is usually a good sign as no signature is perfect. It just indicates some level of maturity.

[priamai]

I would say for now my heuristics is to just select the ones from Nextron Systems and the one that has at least a false positive description @ananyalahiri2003