CalvinBackup/mvt
1
0
Fork 0
mirror of https://github.com/mvt-project/mvt.git synced 2026-02-13 00:52:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added check_indicators to profile_events

Browse Source
This commit is contained in:
Nex
2022-07-20 13:24:20 +02:00
parent 3fccebe132
commit 2e1243864c
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
mvt/ios/modules/backup/profile_events.py
View File

@@ -31,9 +31,20 @@ class ProfileEvents(IOSExtraction):
"timestamp": record.get("timestamp"),
"module": self.__class__.__name__,
"event": "profile_operation",
"data": f"Process {record.get('process')} started operation {record.get('operation')} of profile {record.get('profile_id')}"
"data": f"Process {record.get('process')} started operation " \
f"{record.get('operation')} of profile {record.get('profile_id')}"
}
def check_indicators(self) -> None:
if not self.indicators:
return
for result in self.results:
ioc = self.indicators.check_process(result.get("process"))
if ioc:
result["matched_indicator"] = ioc
self.detected.append(result)
def run(self) -> None:
for events_file in self._get_backup_files_from_manifest(relative_path=CONF_PROFILES_EVENTS_RELPATH):
events_file_path = self._get_backup_file_from_id(events_file["file_id"])