intelowlproject / IntelOwl

IntelOwl: manage your Threat Intelligence at scale
https://intelowlproject.github.io
GNU Affero General Public License v3.0
3.79k stars 426 forks source link

detect-it-easy analyzer, closes #1590 #2354

Closed g4ze closed 3 months ago

g4ze commented 4 months ago

closes #1590

Description

Please include a summary of the change and link to the related issue.

Type of change

Please delete options that are not relevant.

Checklist

Important Rules

"analyzer_reports": [ { "name": "DetectItEasy", "process_time": 3.14, "status": "SUCCESS", "end_time": "2024-06-03T19:36:38.562828Z", "parameters": {}, "type": "analyzer", "id": 357, "report": { "arch": "NOEXEC", "mode": "Unknown", "type": "Unknown", "detects": [ { "name": "Zip", "type": "archive", "string": "archive: Zip(2.0)[38.5%,1 file]", "options": "38.5%,1 file", "version": "2.0" } ], "filetype": "Binary", "endianess": "LE" }, "errors": [], "start_time": "2024-06-03T19:36:35.425233Z" } ], image

g4ze commented 4 months ago

Hey! @mlodic @0ssigeno can someone please have a look here? The installation and entrypoint stuff seems to work right. I can't figure out a way to make the file read.

g4ze commented 3 months ago

Yes, I did that. My doubt is: The tool takes in the file location as an argument. For the file location to exist in the container I would have to write it into the container. Is that a correct approach?

mlodic commented 3 months ago

the file is sent to the right container by the framework and your code seems follow the framework. What's the output that you get from launching die? both from the analyzer and from the shell

g4ze commented 3 months ago

it gave me an error related to the variable that had a typo in the review. The error makes more sense now. However, i was confused as to how the correct file is being routed to the correct container using the framework, so thought the error might be arising due to that. I am able to figure out how the flask shell2http here is working and all, but can't seem to find the underlying logic which routes the tools to the concerned file internally. Could you please comment on that?

g4ze commented 3 months ago

image works on the analyzer now! was a typo mistake :') (although I'm still a bit confused wrt the above question :p)

g4ze commented 3 months ago

pls check the tlp CLEAR and kindy review.

mlodic commented 3 months ago

the test need a fix and then we are gtg

g4ze commented 3 months ago

works now :)

g4ze commented 3 months ago

it would be better to merge #2357 before this due to more migrations.

g4ze commented 3 months ago

I have opened #2365 for smoother and combined migrations, if that's helpful.