omnibus icon indicating copy to clipboard operation
omnibus copied to clipboard

Change Hash artifact to "File" artifact

Open deadbits opened this issue 7 years ago • 1 comments

  • File artifact will still be identified by its has but can then contain more additional data such as PE features automatically upon creation if file exists on disk
  • If file not on disk, user can download it from VT (or other sources I'm working on adding for scanning / downloading files and reports)
  • Users can run newly created YARA scan rule against file and store results
  • Users can scan files against external services like VT, Hybrid Analysis, Anlyz, etc.
    • Modules for these need to be created

deadbits avatar Aug 19 '18 18:08 deadbits

In progress.. Artifacts are being re-worked so instead of one Artifact object each type will have it's own object with fields specific to it's type.

deadbits avatar Aug 28 '18 00:08 deadbits