Merge pull request #445 from CybercentreCanada/Yara_actions

Prescript signature matching[dev]
CybercentreCanada · Aug 29, 2024 · 1f6209c · 1f6209c
2 parents 038b75a + 7141a05
commit 1f6209c
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/cape/cape_main.py b/cape/cape_main.py
@@ -493,7 +493,7 @@ def _general_flow(
                     for match in matches:
                         strings = match.strings
                         rule_name = match.rule
-                        _ = add_tag(prescipt_detection_section, "rule.yara.prescript", rule_name) 
+                        _ = add_tag(prescipt_detection_section, "file.rule.prescript", f"prescript_cape.{rule_name}") 
                         matched_strings = ""
                         for matched_string in strings:
                             for matched_instance in matched_string.instances:

diff --git a/cape/update_server.py b/cape/update_server.py
@@ -134,7 +134,7 @@ def import_update(self, files_sha256, source_name: str, default_classification=c
                     except Exception as e:
                         self.log.error(f"Error validating {compiled_file.name}: {e}")
                         raise e
-                    yara_importer._save_signatures(signatures=upload_list, source=source_name)
+                    yara_importer._save_signatures(signatures=upload_list, source="prescript_cape")
                     dest_dir = os.path.join(self.latest_updates_dir, source_name)
                     os.makedirs(dest_dir, exist_ok=True)
                     dest_file = os.path.join(dest_dir, f"{source_name}.yar")