darwin icon indicating copy to clipboard operation
darwin copied to clipboard

[IDEA] Implement callbacks for specific signal handling in filters

Open frikilax opened this issue 4 years ago • 0 comments

What is your feature about ? It would be nice to be able to register callback functions to trigger specific functionalities when signals are received.

Describe what you'd like the handling of signals is currently handled by the core, to reopen file descriptors in the Logger after a log rotate. There are some (many) use-cases when it would be interesting to reopen other files/update models and internal memory maps when a signal is sent to a filter:

  • reload hostlookup maps
  • reload DGA tensorflow model
  • reload yara rules
  • ...

This would prevent users from restarting filters when a file is updated.

Additional context The functionality could take the form of a Core interface defining and using a list of callbacks to call on each signal, with the ability to add callbacks depending on the needs.

frikilax avatar Oct 01 '20 13:10 frikilax