search

mandiant / flare-fakenet-ng

FakeNet-NG - Next Generation Dynamic Network Analysis Tool
Apache License 2.0
1.78k stars 358 forks source link

Provide option to exclude irrelevant traffic in HTML report #183

Open tinajn opened 5 months ago

tinajn commented 5 months ago

This issue is related to the latest HTML report feature. As of now, all captured traffic by FakeNet including traffic from known Windows services and applications are listed in the HTML report. It would be good give the user an option in the form of preset filters to filter out this kind of traffic to reduce the scope of their analysis.

emtuls commented 5 months ago

This sort of also applies to https://github.com/mandiant/flare-fakenet-ng/issues/172

After our discussion, it seems like a good route to take for this may be to do some research into which processes are emitting (usually) irrelevant traffic and if we can filter out specific processes from the get go. Some thought will need to be put into if this is a viable path to take.

The thought is that we can potentially provide a configuration file to FakeNet in order to pre-filter out some of these processes in order to clean up the CLI output that we view during analysis as well as clean up the HTML report that is generated after the fact.