Cortex4py
Cortex4py copied to clipboard
analyzer: Allow for data to be provided
If the user has the file content in a buffer it is more efficient to be able to hand it to the analyzer directly instead of writing it out into a temporary file just to be read back in again by the requests module. Add an observable key 'dataProvided' which can be set to True to change behaviour of run_by_id() and in turn run_by_name() so it uses the 'data' key as observable data directly instead of interpreting it as a file name and opening that file.
I didn't want to change behaviour for compatibility which is why I added that new flag key 'dataProvided'. I don't much like it though and would be happy to implement any other logic that'd be acceptable, e.g. using isinstance() to detect if 'data' is a file-like.
I plan to use this functionality here: https://github.com/michaelweiser/PeekabooAV/blob/cf02ed3a891058c669fe8e54b35d352f197f617e/peekaboo/toolbox/cortex.py#L152