William Ballenthin
fbbc8a573f
main: remove old render code
2020-06-29 12:28:01 -06:00
William Ballenthin
b1374f2dd0
submodule: rules: update
2020-06-29 12:26:31 -06:00
William Ballenthin
c5a718d5ba
main: emit json even if there are file limitations
...
closes #53
2020-06-29 12:06:31 -06:00
Willi Ballenthin
7d644fd86b
Merge pull request #38 from fireeye/ana-fix-keyerror
...
Fix KeyError when deleting nonexistent keys
2020-06-30 15:21:12 -06:00
Willi Ballenthin
59beee6b4a
Merge pull request #44 from fireeye/doclint/unsigned
...
Doclint/unsigned
2020-06-30 15:19:45 -06:00
Moritz Raabe
5cee0d9b80
add lint negative numbers and cleanup tests
2020-06-30 22:17:42 +02:00
Moritz Raabe
afe5dba92a
document signed vs unsigned
2020-06-30 22:11:57 +02:00
Ana María Martínez Gómez
8e78d8de53
Fix KeyError when deleting nonexistent keys
...
`hidden_meta` saves not only the existing hidden meta keys, but also
those who don't exist with value `None`. For example:
```
{'capa/path': None, 'capa/nursery': None}
```
Deleting nonexistent keys raises a `KeyError` exception.
2020-06-30 14:24:06 +02:00
Willi Ballenthin
5cbfbc4997
Merge pull request #34 from fireeye/rule-organization
...
update output rendering
2020-06-29 13:07:51 -06:00
William Ballenthin
0a5947290b
main: add --version flag
...
closes ghe#402
2020-06-28 13:10:17 -06:00
William Ballenthin
39a49fb4b9
submodule: rules: bump to master
2020-06-28 13:01:56 -06:00
William Ballenthin
96158c6ca5
main: update detection for unsupported files via namespace matches
2020-06-28 12:58:34 -06:00
William Ballenthin
3b8f686243
readme: update example and describe namespace, removing rule-category
2020-06-28 12:52:45 -06:00
William Ballenthin
ed12c4758b
render: group ATT&CK tags in a single table
2020-06-28 12:23:07 -06:00
William Ballenthin
a12bcf238b
pep8
2020-06-28 12:13:31 -06:00
William Ballenthin
112ddb43c9
render: hint min width of tables
2020-06-28 12:13:17 -06:00
William Ballenthin
c9ab5f9dda
render: fix handling of file-scope rules
2020-06-28 12:05:15 -06:00
William Ballenthin
7c51fd4890
render: fix rendering of file scope results
2020-06-28 12:04:53 -06:00
William Ballenthin
f77e1f4946
render: include rule source in the json
2020-06-28 11:55:33 -06:00
William Ballenthin
c34578b80c
render: hint number of matches in verbose and vverbose mode
2020-06-28 11:52:03 -06:00
William Ballenthin
ef4be10543
render: show logic under not nodes
2020-06-28 11:48:23 -06:00
William Ballenthin
5f598e8a08
render: learn to render Range/Count statements
2020-06-28 11:30:23 -06:00
William Ballenthin
cb8fedc1b9
engine: Range should never return children results
2020-06-28 11:29:36 -06:00
William Ballenthin
a355f2f0c6
render: hint the number of matches
2020-06-28 10:33:28 -06:00
William Ballenthin
c55ce3c1f0
render: hint number of hidden locations
2020-06-28 09:55:08 -06:00
William Ballenthin
1d00f188f1
render: format numbers and offsets as hex
2020-06-28 09:53:14 -06:00
William Ballenthin
d04c9db399
render: ellipsis formatting
2020-06-28 09:39:52 -06:00
William Ballenthin
617b55ae3c
render: only show 4 locations before using an ellipsis
2020-06-28 09:37:48 -06:00
William Ballenthin
71177c9d77
pep8
2020-06-28 09:32:16 -06:00
William Ballenthin
4c4b538a6a
render: emit bytes uppercase, separated
2020-06-28 09:31:15 -06:00
William Ballenthin
9be448a900
render: dont display implied True for characteristic
2020-06-28 09:20:34 -06:00
William Ballenthin
bdc635a0f9
render: capture and display matched regex string
2020-06-28 09:20:25 -06:00
William Ballenthin
50dc945103
render: dont forget about bytes feature
2020-06-28 08:54:46 -06:00
William Ballenthin
cad438a9bd
render: remove dead code
2020-06-28 08:53:41 -06:00
William Ballenthin
e3245385c1
linter: use posixpath to normalize slashes
2020-06-28 08:52:30 -06:00
William Ballenthin
eca87ab976
render: verbose: only show some meta keys
2020-06-28 08:50:05 -06:00
William Ballenthin
67c511e085
render: display lists of things as comma separated
2020-06-28 08:47:50 -06:00
William Ballenthin
9f2c4248e5
render: display addresses as upper case hex
2020-06-28 08:44:32 -06:00
William Ballenthin
21e3b75a3a
linter: show expected/found filenames
2020-06-28 08:41:31 -06:00
William Ballenthin
6bf63f72fd
render: document import loop and fix
2020-06-28 08:30:43 -06:00
William Ballenthin
0f18ce23b8
render: remove some doc that wasn't useful
2020-06-28 08:28:23 -06:00
William Ballenthin
cfb4a9177b
main: add -j for --json
2020-06-28 08:26:44 -06:00
William Ballenthin
df333042bf
render: wire up vverbose mode
2020-06-28 01:29:03 -06:00
William Ballenthin
4914019503
render: utils: add second level bold style
2020-06-28 01:28:42 -06:00
William Ballenthin
20dffcdd5b
render: verbose: don't display locations for file scope matches
2020-06-28 01:28:13 -06:00
William Ballenthin
70c590dfc6
render: translate match nodes from features to statements
2020-06-28 01:27:30 -06:00
William Ballenthin
58f3d105c2
pep8
2020-06-28 01:26:53 -06:00
William Ballenthin
cd8446b7cd
render: add vverbose mode impl
2020-06-28 01:26:18 -06:00
William Ballenthin
bee29e4d3d
render: add examples of output
2020-06-27 18:21:22 -06:00
William Ballenthin
4479b9da96
render: implement verbose mode
2020-06-27 18:17:48 -06:00