airbnb / airbnb/binaryalert

Provide a means of automatically building yara rules

Open
#164 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
1.5k
Forks
179
PR merge metrics
No merged PRs in 30d

Description

## Background

Typical usage of this module is build once, deploy once. And given that yara rules are compiled at build time, over time the lambda analyser that has been deployed will be out of date with new yara rules.

## Desired Change

As an example implementation, we could deploy a lambda function that would periodically build the yara rules and store them in a location that the analyser lambda can retrieve them from to run the analyser against.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing the build-time YARA rule compilation and the deployed analyser Lambda described in the issue. Define how a periodic builder Lambda would store refreshed rules and how the analyser would retrieve them, then verify that newly built rules are used without redeploying the analyser.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python, terraform
Domain
backend, cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.