use match-scanner library #90
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| } else { | ||
| m.FileSeverity = updatedSeverity | ||
| } | ||
| m.FileSeverity = updatedSeverity |
There was a problem hiding this comment.
IMO we need to do something about the way we calculated severity. currently we calculate sev per file instead of per malware using the length of total strings that matched. Instead we should be looking at rule to see percentage of $strings that matched or mixing both approaches.
There was a problem hiding this comment.
@ibreakthecloud please propose an algorithm for the sev calculation, looks like you have some ideas in mind, let's review that in a separate PR
noboruma
force-pushed
the
use-scanner-lib
branch
8 times, most recently
from
31f992a to
006deff
Compare
noboruma
force-pushed
the
use-scanner-lib
branch
from
006deff to
4fdb35a
Compare
noboruma
force-pushed
the
use-scanner-lib
branch
2 times, most recently
from
7937e51 to
b7ca09c
Compare
noboruma
force-pushed
the
use-scanner-lib
branch
2 times, most recently
from
b2da95c to
501dbec
Compare
noboruma
force-pushed
the
use-scanner-lib
branch
from
501dbec to
8e4d161
Compare
ibreakthecloud
approved these changes
Jun 27, 2024
There was a problem hiding this comment.
we have good perf numbers regarding cpu and mem.
my todos for later:
- fix the severity logic (have something better than what we have now)
- deepfence's own threatintel for malware, where we'll curate our own rules from multiple sources, this will result in more faster matching.
Currently rules are the only bottle necks we have.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.