search

malice-plugins / nsrl

Malice NSRL Plugin
MIT License
7 stars 6 forks source link

how to build docker with my db? #4

Open whydee86 opened 5 years ago

whydee86 commented 5 years ago

Hi, I didn't understand how to build a docker with my nsrl file and load it for use to the full scan of malice. I ran this command "

sudo docker run --rm malice/nsrl build

" But I get the output level=fatal msg="open NSRLFile.txt: no such file or directory". Now I think it needs to download new NSRL zip by shirk bash file am I wrong?

blacktop commented 5 years ago

Do you have a special custom NSRL file? Or do you just want to build with the latest NSRL database files?

whydee86 commented 5 years ago

Do you have a special custom NSRL file? Or do you just want to build with the latest NSRL database files?

I need to know how I can build a docker with a special one(my NSRL file) and how I build docker with latest NSRL file. thank you very much.

blacktop commented 5 years ago

So the image should be using the LATESTs DB from nsrl, it picks the latest when it is built. If you wanted to make a new one you could run make build see here: https://github.com/malice-plugins/nsrl/blob/master/Makefile#L13

blacktop commented 5 years ago

Here is the script that builds the DB from the NSRL.txt file: https://github.com/malice-plugins/nsrl/blob/master/shrink_nsrl.sh

If you wanted to use your own you could change this to point at your text file and run make build. However, the WHOLE point to this docker image and why in my opinion it is cool is that it takes the BIG txt file and changes it into a little bloom filter that is a few orders of magnitude smaller.