drakvuf-sandbox
drakvuf-sandbox copied to clipboard
External Karton integration
Previously - Karton was strictly integrated with Drakvuf Sandbox as it used this project for queuing analyses and sending results both to the final S3 storage and other consumers. That model was pretty difficult to maintain as Karton is meant to work in microservice model and it's much easier to maintain such environment when microservice is easily replaceable.
Such Karton service should consume analysis requests and use Drakvuf Sandbox API to schedule an analysis and poll for the results. If analysis was sucessful, Karton service should send a task indicating the end of the analysis, including some artifacts (e.g. memory dumps) in compatible way with https://github.com/CERT-Polska/karton-config-extractor.
Karton should also handle the multinode model by indicating on which node the analysis was performed. Proper Drakvuf Sandbox analysis reference can be send in payload.attribute in compatible way with https://github.com/CERT-Polska/karton-mwdb-reporter.