airbnb / airbnb/binaryalert

Updated YARA rules do not re-alert

Open
#5 2 comments 0 reactions 1 assignee Claimed by @austinbyers View on GitHub
analyzer YARA
Dominant language
Python
Stars
1.5k
Forks
179
PR merge metrics
No merged PRs in 30d

Description

All YARA matches are saved to DynamoDB, but alerts are only sent to SNS if the YARA rule name has not matched before on the given binary. There are two problems with this:

1. Rules which are renamed or reorganized will re-trigger alerts
2. Rules whose content changes (e.g. a different rule condition) will *not* re-trigger an alert

Instead of looking up based on the rule name, there should be a comparison against some kind of hash of the YARA rule contents

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.