weslambert
@tomchop, Should this be done through a pull request? I noticed we are not able to modify the wiki. Thanks, Wes
I've used HTML scraping with Python and XPath as an alternative, however, it would still be nice to have this exposed through the API, if possible.
@egd-io , Just following up... Would you be able to share how you accomplished this? Thanks, Wes
I can try giving this a shot when I get some free time -- would love to dig in and learn more about it.
https://github.com/Security-Onion-Solutions/securityonion/pull/4773
- `python3-yara` Maybe something like the following as a standalone script, or added to so-yara-update: ``` #!/usr/bin/python3 import argparse import yara from pathlib import Path parser = argparse.ArgumentParser() parser.add_argument('--path', '-p',...
Maybe a wrapper named`so-disallow`, which we have in the current platform?
Will have PR for [Velociraptor](https://github.com/Velocidex/velociraptor) in soon.
I might be able to help with putting something to together. Let me know!
@objective-see, any thoughts around this issue?