mirror of
https://github.com/mvt-project/mvt.git
synced 2026-08-15 23:50:56 +02:00
Added support for context-aware indicators.
This way when a detection is logged, the user can know which STIX2 file was matched by the module
This commit is contained in:
@@ -25,7 +25,7 @@ class TestDatausageModule:
|
||||
ind = Indicators(log=logging)
|
||||
ind.parse_stix2(indicator_file)
|
||||
# Adds a file that exists in the manifest.
|
||||
ind.ioc_processes[0] = "CumulativeUsageTracker"
|
||||
ind.ioc_files[0]["processes"].append("CumulativeUsageTracker")
|
||||
m.indicators = ind
|
||||
run_module(m)
|
||||
assert len(m.detected) == 2
|
||||
|
||||
@@ -24,8 +24,7 @@ class TestManifestModule:
|
||||
m = Manifest(base_folder=get_backup_folder(), log=logging, results=[])
|
||||
ind = Indicators(log=logging)
|
||||
ind.parse_stix2(indicator_file)
|
||||
# Adds a file that exists in the manifest
|
||||
ind.ioc_files[0] = "com.apple.CoreBrightness.plist"
|
||||
ind.ioc_files[0]["file_names"].append("com.apple.CoreBrightness.plist")
|
||||
m.indicators = ind
|
||||
run_module(m)
|
||||
assert len(m.detected) == 1
|
||||
|
||||
Reference in New Issue
Block a user