malice-plugins / nsrl Goto Github PK
View Code? Open in Web Editor NEWMalice NSRL Plugin
License: MIT License
Malice NSRL Plugin
License: MIT License
Hi, I didn't understand how to build a docker with my nsrl file and load it for use to the full scan of malice.
I ran this command "
sudo docker run --rm malice/nsrl build
"
But I get the output level=fatal msg="open NSRLFile.txt: no such file or directory".
Now I think it needs to download new NSRL zip by shirk bash file am I wrong?
elasticsearch is typed "elasitcsearch" in a few different places
Command issued:
nsrl --elasitcsearch [$PRIVATE_ELASTICSEARCH] -V lookup AABCA0896728846A9D5B841617EBE746
Results Output:
DEBU[0000] Number of lines in NSRLFile.txt: 36061377
DEBU[0000] Mapping: {
"settings": {
"number_of_shards": 1,
"number_of_replicas": 0
},
"mappings": {
"_default_": {
"_all": {
"enabled": true
}
},
"samples": {
"properties": {
"file": {
"properties": {
"md5": {
"type": "string"
},
"mime": {
"type": "string"
},
"name": {
"type": "string"
},
"path": {
"type": "string"
},
"sha1": {
"type": "string"
},
"sha256": {
"type": "string"
},
"sha512": {
"type": "string"
},
"size": {
"type": "string"
}
}
},
"plugins": {
"properties": {
"archive": {
"type": "object"
},
"av": {
"type": "object"
},
"document": {
"type": "object"
},
"exe": {
"type": "object"
},
"intel": {
"type": "object",
"properties": {
"virustotal": {
"dynamic": false,
"type": "object"
}
}
},
"metadata": {
"type": "object"
}
}
},
"scan_date": {
"type": "date"
}
}
}
}
}
DEBU[0000] elastic: Error 404 (Not Found): no such index [type=index_not_found_exception]
{"nsrl":{"found":true}}
I decided to attempt to create the index from scratch.
First issue I ran into was _all has been deprecated since 6.0, which would remove the use of default which has been deprecated as well.
Then found out type "string" has been deprecated.
Ref: https://www.elastic.co/blog/strings-are-dead-long-live-strings
Changing type "string" to type "text" and removing "default" : { "_all": { "enabled": true }} allowed me to successfully create the index.
So I reissued the command.
Command issued:
nsrl --elasitcsearch [$PRIVATE_ELASTICSEARCH] -V lookup AABCA0896728846A9D5B841617EBE746
Results Output:
DEBU[0000] Number of lines in NSRLFile.txt: 36061377
DEBU[0000] Index malice already exists.
DEBU[0000] elastic: Error 404 (Not Found)
{"nsrl":{"found":true}}
After which I'm wondering if the issue may be upstream with
malice-plugins/go-plugin-utils/database/elasticsearch/elasticsearch.go
Micro-service performs only SHA1 lookup, also the command to run in https://github.com/malice-plugins/nsrl/blob/master/docs/web.md doc is not correct (no port forwarding).
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.