CalvinBackup/mvt
1
0
Fork 0
mirror of https://github.com/mvt-project/mvt.git synced 2026-07-31 00:27:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge refactor/structured-alerting into v2

Browse Source 
Resolved conflicts:
- pyproject.toml: Used v2 pinned dependency versions
- Removed cmd_check_adb.py (deleted in refactor branch)
- Updated all command files to include disable_version_check and disable_indicator_check flags
- Adopted new AlertStore system from refactor branch
- Updated version to 3.0.0
- Kept VirusTotal functionality commented out
- Consolidated imports and module lists
- Adopted refactor branch's simplified JSON loading
- Updated iOS modules to use new alertstore approach
This commit is contained in:
Janik Besendorf
2025-11-07 16:38:53 +01:00
parent 981371bd8b e9e621640b
commit 2302e74a86
142 changed files with 1815 additions and 1903 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/android/test_artifact_dumpsys_accessibility.py
+2 -2
View File
@@ -49,6 +49,6 @@ class TestDumpsysAccessibilityArtifact:
ind.parse_stix2(indicator_file)
ind.ioc_collections[0]["app_ids"].append("com.sec.android.app.camera")
da.indicators = ind
assert len(da.detected) == 0
assert len(da.alertstore.alerts) == 0
da.check_indicators()
assert len(da.detected) == 1
assert len(da.alertstore.alerts) == 1
tests/android/test_artifact_dumpsys_appops.py
+8 -6
View File
@@ -42,22 +42,24 @@ class TestDumpsysAppopsArtifact:
ind.parse_stix2(indicator_file)
ind.ioc_collections[0]["app_ids"].append("com.facebook.katana")
da.indicators = ind
assert len(da.detected) == 0
assert len(da.alertstore.alerts) == 0
da.check_indicators()
detected_by_ioc = [
detected for detected in da.detected if detected.get("matched_indicator")
alert
for alert in da.alertstore.alerts
if "matched_indicator" in alert.event
]
detected_by_permission_heuristic = [
detected
for detected in da.detected
alert
for alert in da.alertstore.alerts
if all(
[
perm["name"] == "REQUEST_INSTALL_PACKAGES"
for perm in detected["permissions"]
for perm in alert.event["permissions"]
]
)
]
assert len(da.detected) == 3
assert len(da.alertstore.alerts) == 3
assert len(detected_by_ioc) == 1
assert len(detected_by_permission_heuristic) == 2
tests/android/test_artifact_dumpsys_battery_daily.py
+2 -2
View File
@@ -32,6 +32,6 @@ class TestDumpsysBatteryDailyArtifact:
ind.parse_stix2(indicator_file)
ind.ioc_collections[0]["app_ids"].append("com.facebook.system")
dba.indicators = ind
assert len(dba.detected) == 0
assert len(dba.alertstore.alerts) == 0
dba.check_indicators()
assert len(dba.detected) == 1
assert len(dba.alertstore.alerts) == 1
tests/android/test_artifact_dumpsys_battery_history.py
+2 -2
View File
@@ -39,6 +39,6 @@ class TestDumpsysBatteryHistoryArtifact:
ind.parse_stix2(indicator_file)
ind.ioc_collections[0]["app_ids"].append("com.samsung.android.app.reminder")
dba.indicators = ind
assert len(dba.detected) == 0
assert len(dba.alertstore.alerts) == 0
dba.check_indicators()
assert len(dba.detected) == 2
assert len(dba.alertstore.alerts) == 2
tests/android/test_artifact_dumpsys_dbinfo.py
+2 -2
View File
@@ -37,6 +37,6 @@ class TestDumpsysDBinfoArtifact:
ind.parse_stix2(indicator_file)
ind.ioc_collections[0]["app_ids"].append("com.wssyncmldm")
dbi.indicators = ind
assert len(dbi.detected) == 0
assert len(dbi.alertstore.alerts) == 0
dbi.check_indicators()
assert len(dbi.detected) == 5
assert len(dbi.alertstore.alerts) == 5
tests/android/test_artifact_dumpsys_package_activities.py
+2 -2
View File
@@ -39,6 +39,6 @@ class TestDumpsysPackageActivitiesArtifact:
ind.parse_stix2(indicator_file)
ind.ioc_collections[0]["app_ids"].append("com.google.android.gms")
dpa.indicators = ind
assert len(dpa.detected) == 0
assert len(dpa.alertstore.alerts) == 0
dpa.check_indicators()
assert len(dpa.detected) == 1
assert len(dpa.alertstore.alerts) == 1
tests/android/test_artifact_dumpsys_packages.py
+2 -2
View File
@@ -37,6 +37,6 @@ class TestDumpsysPackagesArtifact:
ind.parse_stix2(indicator_file)
ind.ioc_collections[0]["app_ids"].append("com.sec.android.app.DataCreate")
dpa.indicators = ind
assert len(dpa.detected) == 0
assert len(dpa.alertstore.alerts) == 0
dpa.check_indicators()
assert len(dpa.detected) == 1
assert len(dpa.alertstore.alerts) == 1
tests/android/test_artifact_dumpsys_platform_compat.py
+2 -2
View File
@@ -35,6 +35,6 @@ class TestDumpsysPlatformCompatArtifact:
ind.ioc_collections[0]["app_ids"].append("org.torproject.torbrowser")
ind.ioc_collections[0]["app_ids"].append("org.article19.circulo.next")
dbi.indicators = ind
assert len(dbi.detected) == 0
assert len(dbi.alertstore.alerts) == 0
dbi.check_indicators()
assert len(dbi.detected) == 2
assert len(dbi.alertstore.alerts) == 2
tests/android/test_artifact_dumpsys_receivers.py
+2 -2
View File
@@ -42,6 +42,6 @@ class TestDumpsysReceiversArtifact:
ind.parse_stix2(indicator_file)
ind.ioc_collections[0]["app_ids"].append("com.android.storagemanager")
dr.indicators = ind
assert len(dr.detected) == 0
assert len(dr.alertstore.alerts) == 0
dr.check_indicators()
assert len(dr.detected) == 1
assert len(dr.alertstore.alerts) == 1
tests/android/test_artifact_getprop.py
+2 -2
View File
@@ -36,6 +36,6 @@ class TestGetPropArtifact:
"dalvik.vm.appimageformat"
)
gp.indicators = ind
assert len(gp.detected) == 0
assert len(gp.alertstore.alerts) == 0
gp.check_indicators()
assert len(gp.detected) == 1
assert len(gp.alertstore.alerts) == 1
tests/android/test_artifact_processes.py
+2 -2
View File
@@ -33,6 +33,6 @@ class TestProcessesArtifact:
ind.parse_stix2(indicator_file)
ind.ioc_collections[0]["processes"].append("lru-add-drain")
p.indicators = ind
assert len(p.detected) == 0
assert len(p.alertstore.alerts) == 0
p.check_indicators()
assert len(p.detected) == 1
assert len(p.alertstore.alerts) == 1
tests/android/test_backup_parser.py
-1
View File
@@ -60,7 +60,6 @@ class TestBackupParsing:
== "33e73df2ede9798dcb3a85c06200ee41c8f52dd2f2e50ffafcceb0407bc13e3a"
)
sms = parse_tar_for_sms(ddata)
print(sms)
assert isinstance(sms, list)
assert len(sms) == 1
assert len(sms[0]["links"]) == 1