Skip to content

Commit

Permalink
Merge pull request #76 from CybercentreCanada/bugfix/bool
Browse files Browse the repository at this point in the history
Fixing bool bug, add recommendation to README, updating requested ima… [dev]
  • Loading branch information
cccs-kevin authored Aug 31, 2022
2 parents 8c2afbe + 215d8aa commit 2618ad3
Show file tree
Hide file tree
Showing 4 changed files with 13 additions and 6 deletions.
3 changes: 3 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,9 @@ default_subscription_ratelimit = 99999999999999/s
token_auth_enabled = yes
```

### Recommendations for Monitoring
The CAPE service will submit a file and wait for the file to complete analysis and post-analysis processing, up until the service timeout of 800 seconds. At this point, the service will retry (2 more times) to get a result. In most cases, the only reason that the service will retry is if there is an issue with the CAPE nest. The CAPE service outputs useful error logs that you can set up Kibana alerting on for these cases when the CAPE REST API or Processor services are down or erroring. This is the recommended approach to monitor your CAPE nest.

### Service Options
#### Host Configurations
* **remote_host_details**: A list of JSON objects, where each JSON object represents a CAPE Host. Details regarding the CAPE API can be found [here](https://capev2.readthedocs.io/en/latest/usage/api.html). Each JSON object must have the following keys and values:
Expand Down
5 changes: 3 additions & 2 deletions cape/cape_main.py
Original file line number Diff line number Diff line change
Expand Up @@ -1791,11 +1791,12 @@ def _handle_specific_image(self) -> Tuple[bool, Dict[str, List[str]]]:
else:
self._set_hosts_that_contain_image(specific_image, relevant_images)
if not relevant_images:
self.log.error(f"The requested image '{specific_image}' is currently unavailable.")
msg = specific_image if specific_image not in [RELEVANT_IMAGE_TAG, ALL_RELEVANT_IMAGES_TAG] else f"{specific_image} ({relevant_images_list})"
self.log.error(f"The requested image '{msg}' is currently unavailable.")
all_machines = [machine for host in self.hosts for machine in host["machines"]]
available_images = self._get_available_images(all_machines, self.allowed_images)
no_image_sec = ResultSection('Requested Image Does Not Exist')
no_image_sec.add_line(f"The requested image '{specific_image}' is currently unavailable.")
no_image_sec.add_line(f"The requested image '{msg}' is currently unavailable.")
no_image_sec.add_line("General Information:")
no_image_sec.add_line(
f"At the moment, the current image options for this CAPE deployment include {available_images}.")
Expand Down
7 changes: 5 additions & 2 deletions cape/cape_result.py
Original file line number Diff line number Diff line change
Expand Up @@ -1379,6 +1379,11 @@ def _create_signature_result_section(
if (isinstance(v, str) or isinstance(v, bytes)) and len(v) > 512:
v = truncate(v, 512)
mark_body.set_item(k, v)

if not isinstance(v, str) and isinstance(v, list):
v = ','.join(v)
elif not isinstance(v, str):
v = str(v)
_tag_mark_values(sig_res, k, v)
if mark_body.body:
sig_res.add_section_part(mark_body)
Expand All @@ -1398,8 +1403,6 @@ def _tag_mark_values(sig_res: ResultSection, key: str, value: str) -> None:
"""
delimiters = [":", "->", ",", " ", "("]
if key.lower() in ["cookie", "process", "binary", "data", "copy", "office_martian", "file", "service", "getasynckeystate", "setwindowshookexw"]:
if not isinstance(value, str) and isinstance(value, list):
value = ','.join(value)
if "process: " in value.lower():
value = value.lower().replace("process: ", "")
if any(delimiter in value for delimiter in delimiters):
Expand Down
4 changes: 2 additions & 2 deletions tests/test_cape_main.py
Original file line number Diff line number Diff line change
Expand Up @@ -1915,11 +1915,11 @@ def test_handle_specific_platform(
("auto", False, [],
[],
(True, {}),
'The requested image \'auto\' is currently unavailable.\nGeneral Information:\nAt the moment, the current image options for this CAPE deployment include [].'),
'The requested image \'auto ([])\' is currently unavailable.\nGeneral Information:\nAt the moment, the current image options for this CAPE deployment include [].'),
("auto", False, ["blah"],
[],
(True, {}),
'The requested image \'auto\' is currently unavailable.\nGeneral Information:\nAt the moment, the current image options for this CAPE deployment include [].'),
'The requested image \'auto ([\'blah\'])\' is currently unavailable.\nGeneral Information:\nAt the moment, the current image options for this CAPE deployment include [].'),
("auto", True, ["blah"],
[],
(True, {"blah": ["blah"]}),
Expand Down

0 comments on commit 2618ad3

Please sign in to comment.