Cortex4py icon indicating copy to clipboard operation
Cortex4py copied to clipboard

analyzer: Allow for data to be provided

Open michaelweiser opened this issue 4 years ago • 0 comments

If the user has the file content in a buffer it is more efficient to be able to hand it to the analyzer directly instead of writing it out into a temporary file just to be read back in again by the requests module. Add an observable key 'dataProvided' which can be set to True to change behaviour of run_by_id() and in turn run_by_name() so it uses the 'data' key as observable data directly instead of interpreting it as a file name and opening that file.

I didn't want to change behaviour for compatibility which is why I added that new flag key 'dataProvided'. I don't much like it though and would be happy to implement any other logic that'd be acceptable, e.g. using isinstance() to detect if 'data' is a file-like.

I plan to use this functionality here: https://github.com/michaelweiser/PeekabooAV/blob/cf02ed3a891058c669fe8e54b35d352f197f617e/peekaboo/toolbox/cortex.py#L152

michaelweiser avatar Nov 24 '21 10:11 michaelweiser