no files / no screenshot : reporting.conf

spender-sandbox / cuckoo-modified

Modified edition of cuckoo

392 stars 178 forks source link

no files / no screenshot : reporting.conf #169

Open limited-root opened 8 years ago

limited-root commented 8 years ago

i am analyzing a big dataset of 23000 malwares and i only need json and pcap reports. i tried to set dropped = 0 , screencaps = 0 to stop receiving shots and files in reports from cuckoo as the size for 23000 samples would be huge. but ams till getting files and shots folders. how can i stop cuckoo to report anything, beside json and pcap?‌( i dont want make the processing limited as i want a full json report, i jst want not to get those in report).

thank you

seifreed commented 8 years ago

Cuckoo don't have this option, you can setup in the report.conf which files you want to have after every analysis. The best approach for you is:

Submit the files -Get the results using the API (JSON report) -Execute python clean for delete all the analysis.

limited-root commented 8 years ago

there should be analysis done to get json result using API, isnt it? i first tried get json reports from virustotal, but reports are too limited in dynamic analysis. thats why i downloaded files and am analysing using my cuckoo. how can i set it to just download json and pcap ? in reporting, i set screenshot and files to 0, but didnt work. what is setting screehsot 0 does if not stopping reports?