Updated YARA rules do not re-alert
@austinbyers is already working on this.
Since Jul 31, 2017.
Assessment
This issue has not been assessed yet.
Description
All YARA matches are saved to DynamoDB, but alerts are only sent to SNS if the YARA rule name has not matched before on the given binary. There are two problems with this:
- Rules which are renamed or reorganized will re-trigger alerts
- Rules whose content changes (e.g. a different rule condition) will not re-trigger an alert
Instead of looking up based on the rule name, there should be a comparison against some kind of hash of the YARA rule contents
- Dominant language
- Python
- Stars
- 1.5k
- Forks
- 178
- PR merge metrics
- No merged PRs in 30d
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from airbnb/binaryalert
-
Add descriptions to variablesPossibly taken @phretor claimed this 2081 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
airbnb/binaryalert#166 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
airbnb/binaryalert#186 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
airbnb/binaryalert#180 ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
airbnb/binaryalert#172 · 1 reaction ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
airbnb/binaryalert#171 ·
All issues in airbnb/binaryalert
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
EvaluationSuite.run fails with default args_for_task and mutates supplied kwargsPossibly taken @ktz03 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
huggingface/evaluate#825 ·
Maintainers usually reply within 1 day
-
dependencies feature github_actions good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
wemake-services/wemake-django-template#3149 ·
Maintainers usually reply within 1 day
-
[request] vsg/1.1.16Openupstream update
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
conan-io/conan-center-index#31142 ·
Maintainers usually reply within 1 day
-
area:core bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day