mwdb-core
mwdb-core copied to clipboard
CERT-Polska
VT Link
VT Link
Is it possible to add an automatical link to VT ? By this way we can have access to the name of the malware
By example :
Thank you
We are using attributes for this. Once a new sample enters the system we're querying VT and retrieving meaningful information (detections, suggested_threat_label, etc). We're using karton but it can also be done with MWDB plugins.
@petikvx now that an initial version of Rich Attributes was merged (#602) to MWDB, it will be nice to show such things. Anyways, I think it should not be a built-in feature - I truly suggest using suggested_threat_label as an attribute via MWDB API (or Karton-MWDB-Reporter).
@psrok1 what do you think? are you planning of implement this thing as a built-in feature?
I think the most recommended way is to push an attribute with appropriate hash and URL mapping or make a plugin.
I'm revisiting the web plugin engine right now so it will be much better documented in the near future!
