assemblyline 4.4.1.dev49__tar.gz → 4.4.1.dev55__tar.gz

{assemblyline-4.4.1.dev49/assemblyline.egg-info → assemblyline-4.4.1.dev55}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: assemblyline
-Version: 4.4.1.dev49
+Version: 4.4.1.dev55
 Summary: Assemblyline 4 - Automated malware analysis framework
 Home-page: https://github.com/CybercentreCanada/assemblyline-base
 Author: CCCS Assemblyline development team

assemblyline-4.4.1.dev55/assemblyline/VERSION

@@ -0,0 +1 @@
+4.4.1.dev55

{assemblyline-4.4.1.dev49 → assemblyline-4.4.1.dev55}/assemblyline/datastore/helper.py

@@ -879,7 +879,8 @@ class AssemblylineDatastore(object):
                                     'short_type': tag_type.rsplit(".", 1)[-1],
                                     'value': tag,
                                     'key': key,
-                                    'safelisted': False
+                                    'safelisted': False,
+                                    'classification': section['classification'],
                                 })
                                 done_map['tags'].add(cache_key)
 
@@ -896,7 +897,8 @@ class AssemblylineDatastore(object):
                                     'short_type': tag_type.rsplit(".", 1)[-1],
                                     'value': tag,
                                     'key': key,
-                                    'safelisted': True
+                                    'safelisted': True,
+                                    'classification': section['classification'],
                                 })
                                 done_map['tags'].add(cache_key)
 

{assemblyline-4.4.1.dev49 → assemblyline-4.4.1.dev55}/assemblyline/odm/models/config.py

@@ -953,6 +953,35 @@ DEFAULT_ALERTING_META = {
 }
 
 
+@odm.model(index=False, store=False, description="Connection details for external systems/data sources.")
+class ExternalSource(odm.Model):
+    name: str = odm.Keyword(description="Name of the source.")
+    classification = odm.Optional(
+        odm.ClassificationString(
+            description="Minimum classification applied to information from the source"
+                        " and required to know the existance of the source."))
+    max_classification = odm.Optional(
+        odm.ClassificationString(description="Maximum classification of data that may be handled by the source"))
+    url: str = odm.Keyword(description="URL of the upstream source's lookup service.")
+
+
+EXAMPLE_EXTERNAL_SOURCE_VT = {
+    # This is an example on how this would work with VirusTotal
+    "name": "VirusTotal",
+    "url": "vt-lookup.namespace.svc.cluster.local",
+    "classification": "TLP:CLEAR",
+    "max_classification": "TLP:CLEAR",
+}
+
+EXAMPLE_EXTERNAL_SOURCE_MB = {
+    # This is an example on how this would work with Malware Bazaar
+    "name": "Malware Bazaar",
+    "url": "mb-lookup.namespace.scv.cluster.local",
+    "classification": "TLP:CLEAR",
+    "max_classification": "TLP:CLEAR",
+}
+
+
 @odm.model(index=False, store=False, description="UI Configuration")
 class UI(odm.Model):
     alerting_meta: AlertingMeta = odm.Compound(AlertingMeta, default=DEFAULT_ALERTING_META,
@@ -974,6 +1003,9 @@ class UI(odm.Model):
     download_encoding = odm.Enum(values=["raw", "cart"], description="Which encoding will be used for downloads?")
     email: str = odm.Optional(odm.Email(), description="Assemblyline admins email address")
     enforce_quota: bool = odm.Boolean(description="Enforce the user's quotas?")
+    external_sources: List[ExternalSource] = odm.List(
+        odm.Compound(ExternalSource),
+        default=[], description="List of external sources to query")
     fqdn: str = odm.Text(description="Fully qualified domain name to use for the 2-factor authentication validation")
     ingest_max_priority: int = odm.Integer(description="Maximum priority for ingest API")
     read_only: bool = odm.Boolean(description="Turn on read only mode in the UI")
@@ -1015,6 +1047,7 @@ DEFAULT_UI = {
     "download_encoding": "cart",
     "email": None,
     "enforce_quota": True,
+    "external_sources": [],
     "fqdn": "localhost",
     "ingest_max_priority": 250,
     "read_only": False,

{assemblyline-4.4.1.dev49 → assemblyline-4.4.1.dev55}/assemblyline/odm/models/user.py

@@ -45,6 +45,7 @@ ROLES = StringTable('ROLES', [
     ("self_manage", 27),
     ("retrohunt_view", 28),
     ("retrohunt_run", 29),
+    ("external_query", 30),
 ])
 
 
@@ -68,6 +69,7 @@ USER_ROLES_BASIC = {
     ROLES.archive_download,    # Download file from the archive
     ROLES.apikey_access,       # Allow access via API keys
     ROLES.bundle_download,     # Create bundle of a submission
+    ROLES.external_query,      # Allow federated searches against external systems
     ROLES.file_detail,         # View files in the file viewer
     ROLES.file_download,       # Download files from the system
     ROLES.heuristic_view,      # View heuristics of the system
@@ -136,6 +138,7 @@ ACL_MAP = {
         ROLES.archive_view,
         ROLES.archive_download,
         ROLES.bundle_download,
+        ROLES.external_query,
         ROLES.file_detail,
         ROLES.file_download,
         ROLES.heuristic_view,

{assemblyline-4.4.1.dev49 → assemblyline-4.4.1.dev55/assemblyline.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: assemblyline
-Version: 4.4.1.dev49
+Version: 4.4.1.dev55
 Summary: Assemblyline 4 - Automated malware analysis framework
 Home-page: https://github.com/CybercentreCanada/assemblyline-base
 Author: CCCS Assemblyline development team

assemblyline-4.4.1.dev49/assemblyline/VERSION

@@ -1 +0,0 @@
-4.4.1.dev49