Docker Analytics for VirusTotal API - Githubissues

opencybersecurityalliance / kestrel-analytics

This repository hosts community contributed Kestrel analytics

Apache License 2.0

15 stars 12 forks source link

Docker Analytics for VirusTotal API #5

Open subbyte opened 3 years ago

subbyte commented 3 years ago

Wanna create a Kestrel analytics that other hunters will clone and reuse? Try to do one for VirusTotal.

Useful information:

How to install Kestrel: https://kestrel.readthedocs.io/en/stable/installation/
Basic concepts of the language (especially the APPLY command): https://kestrel.readthedocs.io/en/latest/language.html
Checking the example uses of analytics in a hunt:
- Kestrel tutorial (in a Kestrel sandbox): https://mybinder.org/v2/gh/opencybersecurityalliance/kestrel-huntbook/HEAD?filepath=tutorial
- open 5. Apply a Kestrel Analytics.ipynb in the Kestrel sandbox
Excellent blog on how to write your own analytics: https://opencybersecurityalliance.org/posts/kestrel-custom-analytics/
An similar existing analytics using SANS API: https://github.com/opencybersecurityalliance/kestrel-analytics/tree/release/analytics/sansipenrich
Example VirusTotal API to use: https://github.com/subbyte/virustotal

This will resolve https://github.com/opencybersecurityalliance/kestrel-lang/issues/124

@charliewutw is happy to be the mentor for contributors if needed.

AcousticCh commented 3 years ago

I know nothing about this but would like to learn

subbyte commented 3 years ago

@AcousticCh Great! I updated the issue to give you more information and starter links. @charliewutw will guide you if needed.

charliewutw1 commented 3 years ago

@AcousticCh Please let me know if there's any questions.