Added support for context-aware indicators.

This way when a detection is logged, the user can know which STIX2
file was matched by the module
This commit is contained in:
Nex
2022-01-21 16:26:58 +01:00
parent 1b4f99a31d
commit b35cd4bc73
12 changed files with 209 additions and 151 deletions
+1 -1
View File
@@ -25,7 +25,7 @@ class TestDatausageModule:
ind = Indicators(log=logging)
ind.parse_stix2(indicator_file)
# Adds a file that exists in the manifest.
ind.ioc_processes[0] = "CumulativeUsageTracker"
ind.ioc_files[0]["processes"].append("CumulativeUsageTracker")
m.indicators = ind
run_module(m)
assert len(m.detected) == 2