Commit Graph

137 Commits

Author SHA1 Message Date
William Ballenthin
fbbc8a573f main: remove old render code 2020-06-29 12:28:01 -06:00
William Ballenthin
b1374f2dd0 submodule: rules: update 2020-06-29 12:26:31 -06:00
William Ballenthin
c5a718d5ba main: emit json even if there are file limitations
closes #53
2020-06-29 12:06:31 -06:00
Willi Ballenthin
7d644fd86b Merge pull request #38 from fireeye/ana-fix-keyerror
Fix KeyError when deleting nonexistent keys
2020-06-30 15:21:12 -06:00
Willi Ballenthin
59beee6b4a Merge pull request #44 from fireeye/doclint/unsigned
Doclint/unsigned
2020-06-30 15:19:45 -06:00
Moritz Raabe
5cee0d9b80 add lint negative numbers and cleanup tests 2020-06-30 22:17:42 +02:00
Moritz Raabe
afe5dba92a document signed vs unsigned 2020-06-30 22:11:57 +02:00
Ana María Martínez Gómez
8e78d8de53 Fix KeyError when deleting nonexistent keys
`hidden_meta` saves not only the existing hidden meta keys, but also
those who don't exist with value `None`. For example:
```
{'capa/path': None, 'capa/nursery': None}
```

Deleting nonexistent keys raises a `KeyError` exception.
2020-06-30 14:24:06 +02:00
Willi Ballenthin
5cbfbc4997 Merge pull request #34 from fireeye/rule-organization
update output rendering
2020-06-29 13:07:51 -06:00
William Ballenthin
0a5947290b main: add --version flag
closes ghe#402
2020-06-28 13:10:17 -06:00
William Ballenthin
39a49fb4b9 submodule: rules: bump to master 2020-06-28 13:01:56 -06:00
William Ballenthin
96158c6ca5 main: update detection for unsupported files via namespace matches 2020-06-28 12:58:34 -06:00
William Ballenthin
3b8f686243 readme: update example and describe namespace, removing rule-category 2020-06-28 12:52:45 -06:00
William Ballenthin
ed12c4758b render: group ATT&CK tags in a single table 2020-06-28 12:23:07 -06:00
William Ballenthin
a12bcf238b pep8 2020-06-28 12:13:31 -06:00
William Ballenthin
112ddb43c9 render: hint min width of tables 2020-06-28 12:13:17 -06:00
William Ballenthin
c9ab5f9dda render: fix handling of file-scope rules 2020-06-28 12:05:15 -06:00
William Ballenthin
7c51fd4890 render: fix rendering of file scope results 2020-06-28 12:04:53 -06:00
William Ballenthin
f77e1f4946 render: include rule source in the json 2020-06-28 11:55:33 -06:00
William Ballenthin
c34578b80c render: hint number of matches in verbose and vverbose mode 2020-06-28 11:52:03 -06:00
William Ballenthin
ef4be10543 render: show logic under not nodes 2020-06-28 11:48:23 -06:00
William Ballenthin
5f598e8a08 render: learn to render Range/Count statements 2020-06-28 11:30:23 -06:00
William Ballenthin
cb8fedc1b9 engine: Range should never return children results 2020-06-28 11:29:36 -06:00
William Ballenthin
a355f2f0c6 render: hint the number of matches 2020-06-28 10:33:28 -06:00
William Ballenthin
c55ce3c1f0 render: hint number of hidden locations 2020-06-28 09:55:08 -06:00
William Ballenthin
1d00f188f1 render: format numbers and offsets as hex 2020-06-28 09:53:14 -06:00
William Ballenthin
d04c9db399 render: ellipsis formatting 2020-06-28 09:39:52 -06:00
William Ballenthin
617b55ae3c render: only show 4 locations before using an ellipsis 2020-06-28 09:37:48 -06:00
William Ballenthin
71177c9d77 pep8 2020-06-28 09:32:16 -06:00
William Ballenthin
4c4b538a6a render: emit bytes uppercase, separated 2020-06-28 09:31:15 -06:00
William Ballenthin
9be448a900 render: dont display implied True for characteristic 2020-06-28 09:20:34 -06:00
William Ballenthin
bdc635a0f9 render: capture and display matched regex string 2020-06-28 09:20:25 -06:00
William Ballenthin
50dc945103 render: dont forget about bytes feature 2020-06-28 08:54:46 -06:00
William Ballenthin
cad438a9bd render: remove dead code 2020-06-28 08:53:41 -06:00
William Ballenthin
e3245385c1 linter: use posixpath to normalize slashes 2020-06-28 08:52:30 -06:00
William Ballenthin
eca87ab976 render: verbose: only show some meta keys 2020-06-28 08:50:05 -06:00
William Ballenthin
67c511e085 render: display lists of things as comma separated 2020-06-28 08:47:50 -06:00
William Ballenthin
9f2c4248e5 render: display addresses as upper case hex 2020-06-28 08:44:32 -06:00
William Ballenthin
21e3b75a3a linter: show expected/found filenames 2020-06-28 08:41:31 -06:00
William Ballenthin
6bf63f72fd render: document import loop and fix 2020-06-28 08:30:43 -06:00
William Ballenthin
0f18ce23b8 render: remove some doc that wasn't useful 2020-06-28 08:28:23 -06:00
William Ballenthin
cfb4a9177b main: add -j for --json 2020-06-28 08:26:44 -06:00
William Ballenthin
df333042bf render: wire up vverbose mode 2020-06-28 01:29:03 -06:00
William Ballenthin
4914019503 render: utils: add second level bold style 2020-06-28 01:28:42 -06:00
William Ballenthin
20dffcdd5b render: verbose: don't display locations for file scope matches 2020-06-28 01:28:13 -06:00
William Ballenthin
70c590dfc6 render: translate match nodes from features to statements 2020-06-28 01:27:30 -06:00
William Ballenthin
58f3d105c2 pep8 2020-06-28 01:26:53 -06:00
William Ballenthin
cd8446b7cd render: add vverbose mode impl 2020-06-28 01:26:18 -06:00
William Ballenthin
bee29e4d3d render: add examples of output 2020-06-27 18:21:22 -06:00
William Ballenthin
4479b9da96 render: implement verbose mode 2020-06-27 18:17:48 -06:00