assemblyline 4.7.4.dev9__tar.gz → 4.7.4.1__tar.gz

{assemblyline-4.7.4.dev9/assemblyline.egg-info → assemblyline-4.7.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: assemblyline
-Version: 4.7.4.dev9
+Version: 4.7.4.1
 Summary: Assemblyline 4 - Automated malware analysis framework
 Home-page: https://github.com/CybercentreCanada/assemblyline-base
 Author: CCCS Assemblyline development team

assemblyline-4.7.4.1/assemblyline/VERSION

@@ -0,0 +1 @@
+4.7.4.1

{assemblyline-4.7.4.dev9 → assemblyline-4.7.4.1}/assemblyline/common/constants.py

@@ -10,6 +10,12 @@ SCALER_TIMEOUT_QUEUE = 'scaler-timeout-queue'
 CONFIG_HASH = 'al-config'
 POST_PROCESS_CONFIG_KEY = 'post-process-actions'
 SERVICE_API_KEY_HASH = "dynamic-service-keys"
+NOTIFICATION_QUEUE_PREFIX = 'nq-'
+
+
+def notification_queue_name(user: str, name: str) -> str:
+    """Create a non-colliding queue name for a user's named notification queue."""
+    return NOTIFICATION_QUEUE_PREFIX + user.encode().hex().upper() + '-' + name
 
 
 # Some pure functions for getting queue lengths (effectively for appending/prepending constants to strings)

{assemblyline-4.7.4.dev9 → assemblyline-4.7.4.1}/assemblyline/common/custom.magic

@@ -24,6 +24,10 @@
 # Open XML files with Microsoft Word
 0   string
 >0  search/0x100 =<?mso-application\ progid="Word.Document"?>    custom: document/office/word
+# MSBuild Project Files
+0      string
+>0     search/0x40    \<Project
+>>&0   search/0x40    http://schemas.microsoft.com/developer/msbuild    custom: code/xml/msbuild
 # VBE files
 0 string #@~^
 >&0 regex/9 \^[^=]{6}== custom: code/vbe

{assemblyline-4.7.4.dev9 → assemblyline-4.7.4.1}/assemblyline/odm/models/config.py

@@ -3,10 +3,7 @@ from typing import Any, Dict, List
 from assemblyline import odm
 from assemblyline.common.constants import PRIORITIES
 from assemblyline.common.forge import get_classification
-from assemblyline.odm.models.service import (
-    SUPPORTED_REGISTRY_TYPES,
-    EnvironmentVariable,
-)
+from assemblyline.odm.models.service import EnvironmentVariable
 from assemblyline.odm.models.service_delta import DockerConfigDelta
 from assemblyline.odm.models.submission import DEFAULT_SRV_SEL, ServiceSelection
 
@@ -116,6 +113,7 @@ class LDAP(odm.Model):
     enabled: bool = odm.Boolean(description="Should LDAP be enabled or not?")
     ip_filter: List[str] = odm.Optional(odm.List(odm.ValidatedKeyword(CIDR_REGEX)),
                                         description="List of CIDRs allowed to access internal authentication")
+    admin_dn: str = odm.Optional(odm.Keyword(), description="DN of the group or the user who will get admin privileges")
     bind_user: str = odm.Optional(odm.Keyword(), description="User use to query the LDAP server")
     bind_pass: str = odm.Optional(odm.Keyword(), description="Password used to query the LDAP server")
     auto_create: bool = odm.Boolean(description="Auto-create users if they are missing")
@@ -922,12 +920,20 @@ class RegistryConfiguration(odm.Model):
                                      description="Token server name to facilitate anonymous pull access")
 
 
+@odm.model(index=False, store=False)
+class InstallRequest(odm.Model):
+    name = odm.keyword()
+    image = odm.keyword()
+
+
 @odm.model(index=False, store=False)
 class Updater(odm.Model):
-    job_dockerconfig: DockerConfigDelta = odm.Compound(
+    job_dockerconfig: DockerConfigDelta = odm.compound(
         DockerConfigDelta, description="Container configuration used for service registration/updates")
-    registry_configs: List = odm.List(odm.Compound(RegistryConfiguration),
-                                      description="Configurations to be used with container registries")
+    registry_configs = odm.sequence(odm.compound(RegistryConfiguration),
+                                    description="Configurations to be used with container registries")
+    auto_install = odm.sequence(odm.compound(InstallRequest),
+                                description="Services to install automatically when the Updater starts.")
 
 
 DEFAULT_UPDATER = {
@@ -939,7 +945,54 @@ DEFAULT_UPDATER = {
     'registry_configs': [{
         'name': 'registry.hub.docker.com',
         'proxies': {}
-    }]
+    }],
+    'auto_install': [
+        {"name": "APIVector", "image": "${REGISTRY}cccs/assemblyline-service-apivector"},
+        {"name": "APKaye", "image": "${REGISTRY}cccs/assemblyline-service-apkaye"},
+        {"name": "AntiVirus", "image": "${REGISTRY}cccs/assemblyline-service-antivirus"},
+        {"name": "Ancestry", "image": "${REGISTRY}cccs/assemblyline-service-ancestry"},
+        {"name": "AVClass", "image": "${REGISTRY}cccs/assemblyline-service-avclass"},
+        {"name": "Badlist", "image": "${REGISTRY}cccs/assemblyline-service-badlist"},
+        {"name": "Batchdeobfuscator", "image": "${REGISTRY}cccs/assemblyline-service-batchdeobfuscator"},
+        {"name": "CAPA", "image": "${REGISTRY}cccs/assemblyline-service-capa"},
+        {"name": "CAPE", "image": "${REGISTRY}cccs/assemblyline-service-cape"},
+        {"name": "Characterize", "image": "${REGISTRY}cccs/assemblyline-service-characterize"},
+        {"name": "ConfigExtractor", "image": "${REGISTRY}cccs/assemblyline-service-configextractor"},
+        {"name": "deobfuscripter", "image": "${REGISTRY}cccs/assemblyline-service-deobfuscripter"},
+        {"name": "DocumentPreview", "image": "${REGISTRY}cccs/assemblyline-service-document-preview"},
+        {"name": "ELF", "image": "${REGISTRY}cccs/assemblyline-service-elf"},
+        {"name": "ELFPARSER", "image": "${REGISTRY}cccs/assemblyline-service-elfparser"},
+        {"name": "EmlParser", "image": "${REGISTRY}cccs/assemblyline-service-emlparser"},
+        {"name": "Espresso", "image": "${REGISTRY}cccs/assemblyline-service-espresso"},
+        {"name": "Extract", "image": "${REGISTRY}cccs/assemblyline-service-extract"},
+        {"name": "Floss", "image": "${REGISTRY}cccs/assemblyline-service-floss"},
+        {"name": "Frankenstrings", "image": "${REGISTRY}cccs/assemblyline-service-frankenstrings"},
+        {"name": "Intezer", "image": "${REGISTRY}cccs/assemblyline-service-intezer"},
+        {"name": "IPArse", "image": "${REGISTRY}cccs/assemblyline-service-iparse"},
+        {"name": "JsJaws", "image": "${REGISTRY}cccs/assemblyline-service-jsjaws"},
+        {"name": "MetaPeek", "image": "${REGISTRY}cccs/assemblyline-service-metapeek"},
+        {"name": "Oletools", "image": "${REGISTRY}cccs/assemblyline-service-oletools"},
+        {"name": "Overpower", "image": "${REGISTRY}cccs/assemblyline-service-overpower"},
+        {"name": "PDFId", "image": "${REGISTRY}cccs/assemblyline-service-pdfid"},
+        {"name": "PE", "image": "${REGISTRY}cccs/assemblyline-service-pe"},
+        {"name": "PeePDF", "image": "${REGISTRY}cccs/assemblyline-service-peepdf"},
+        {"name": "Pixaxe", "image": "${REGISTRY}cccs/assemblyline-service-pixaxe"},
+        {"name": "Safelist", "image": "${REGISTRY}cccs/assemblyline-service-safelist"},
+        {"name": "Sigma", "image": "${REGISTRY}cccs/assemblyline-service-sigma"},
+        {"name": "Suricata", "image": "${REGISTRY}cccs/assemblyline-service-suricata"},
+        {"name": "Swiffer", "image": "${REGISTRY}cccs/assemblyline-service-swiffer"},
+        {"name": "TagCheck", "image": "${REGISTRY}cccs/assemblyline-service-tagcheck"},
+        {"name": "TorrentSlicer", "image": "${REGISTRY}cccs/assemblyline-service-torrentslicer"},
+        {"name": "Unpacker", "image": "${REGISTRY}cccs/assemblyline-service-unpacker"},
+        {"name": "UNPACKME", "image": "${REGISTRY}cccs/assemblyline-service-unpacme"},
+        {"name": "URLCreator", "image": "${REGISTRY}cccs/assemblyline-service-urlcreator"},
+        {"name": "URLDownloader", "image": "${REGISTRY}cccs/assemblyline-service-urldownloader"},
+        {"name": "ViperMonkey", "image": "${REGISTRY}cccs/assemblyline-service-vipermonkey"},
+        {"name": "VirusTotal", "image": "${REGISTRY}cccs/assemblyline-service-virustotal"},
+        {"name": "XLMMacroDeobfuscator", "image": "${REGISTRY}cccs/assemblyline-service-xlmmacrodeobfuscator"},
+        {"name": "Yara", "image": "${REGISTRY}cccs/assemblyline-service-yara"},
+        {"name": "Zeek", "image": "${REGISTRY}cccs/assemblyline-service-zeek"},
+    ]
 }
 
 
@@ -1132,6 +1185,7 @@ SERVICE_STAGES = [
 ]
 
 SAFELIST_HASH_TYPES = ['sha1', 'sha256', 'md5']
+REGISTRY_TYPES = ['docker', 'harbor']
 
 
 @odm.model(index=False, store=False, description="Service's Safelisting Configuration")
@@ -1148,7 +1202,7 @@ class ServiceSafelist(odm.Model):
 @odm.model(index=False, store=False, description="Pre-Configured Registry Details for Services")
 class ServiceRegistry(odm.Model):
     name: str = odm.Keyword(description="Name of container registry")
-    type: str = odm.Enum(values=SUPPORTED_REGISTRY_TYPES, default='docker', description="Type of container registry")
+    type: str = odm.Enum(values=REGISTRY_TYPES, default='docker', description="Type of container registry")
     username: str = odm.Optional(odm.Keyword(description="Username for container registry"))
     password: str = odm.Optional(odm.Keyword(description="Password for container registry"))
     use_fic: bool = odm.Boolean(
@@ -1172,7 +1226,7 @@ class Services(odm.Model):
     allow_insecure_registry: bool = odm.Boolean(description="Allow fetching container images from insecure registries")
 
     preferred_registry_type: str = odm.Enum(
-        values=SUPPORTED_REGISTRY_TYPES,
+        values=REGISTRY_TYPES,
         default='docker',
         description="Global registry type to be used for fetching updates for a service (overridable by a service)")
     prefer_service_privileged: bool = odm.Boolean(

{assemblyline-4.7.4.dev9 → assemblyline-4.7.4.1}/assemblyline/odm/models/service.py

@@ -12,7 +12,6 @@ from assemblyline.common.constants import (
 Classification = forge.get_classification()
 
 FETCH_METHODS = ["GET", "POST", "GIT"]
-SUPPORTED_REGISTRY_TYPES = ["docker", "harbor", "jfrog"]
 
 SIGNATURE_DELIMITERS = {
     'new_line': '\n',
@@ -45,7 +44,7 @@ class DockerConfig(odm.Model):
                                                description="The username to use when pulling the image")
     registry_password: Opt[str] = odm.Optional(odm.Keyword(default=""),
                                                description="The password or token to use when pulling the image")
-    registry_type: str = odm.Enum(values=SUPPORTED_REGISTRY_TYPES, default='docker',
+    registry_type: str = odm.Enum(values=["docker", "harbor"], default='docker',
                                   description="The type of container registry")
     ports: list[str] = odm.List(odm.Keyword(), default=[], description="What ports of container to expose?")
     ram_mb: int = odm.Integer(default=512, description="Container RAM limit")

{assemblyline-4.7.4.dev9 → assemblyline-4.7.4.1}/assemblyline/odm/models/service_delta.py

@@ -1,11 +1,7 @@
 from __future__ import annotations
 
 from assemblyline import odm
-from assemblyline.odm.models.service import (
-    FETCH_METHODS,
-    SIGNATURE_DELIMITERS,
-    SUPPORTED_REGISTRY_TYPES,
-)
+from assemblyline.odm.models.service import FETCH_METHODS, SIGNATURE_DELIMITERS
 
 REF_DEPENDENCY_CONFIG = "Refer to:<br>[Service - DependencyConfig](../service/#dependencyconfig)"
 REF_DOCKER_CONFIG = "Refer to:<br>[Service - DockerConfig](../service/#dockerconfig)"
@@ -32,7 +28,7 @@ class DockerConfigDelta(odm.Model):
     image = odm.Optional(odm.Keyword(), description=REF_DOCKER_CONFIG)
     registry_username = odm.Optional(odm.Keyword(default=""), description=REF_DOCKER_CONFIG)
     registry_password = odm.Optional(odm.Keyword(default=""), description=REF_DOCKER_CONFIG)
-    registry_type = odm.Optional(odm.Enum(values=SUPPORTED_REGISTRY_TYPES), description=REF_DOCKER_CONFIG)
+    registry_type = odm.Optional(odm.Enum(values=["docker", "harbor"]), description=REF_DOCKER_CONFIG)
     ports = odm.Optional(odm.List(odm.Keyword()), description=REF_DOCKER_CONFIG)
     ram_mb = odm.Optional(odm.Integer(), description=REF_DOCKER_CONFIG)
     ram_mb_min = odm.Optional(odm.Integer(), description=REF_DOCKER_CONFIG)

{assemblyline-4.7.4.dev9 → assemblyline-4.7.4.1/assemblyline.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: assemblyline
-Version: 4.7.4.dev9
+Version: 4.7.4.1
 Summary: Assemblyline 4 - Automated malware analysis framework
 Home-page: https://github.com/CybercentreCanada/assemblyline-base
 Author: CCCS Assemblyline development team

assemblyline-4.7.4.dev9/assemblyline/VERSION

@@ -1 +0,0 @@
-4.7.4.dev9