airbnb / airbnb/binaryalert

Support for multiple parser/analyzer types

Open
#68 1 comment 1 reaction 0 assignees View on GitHub
Dominant language
Python
Stars
1.5k
Forks
179
PR merge metrics
No merged PRs in 30d

Description

Enhance the Dispatcher to support multiple types of "Analyser" lambdas based on the type of file to be processed. This would support a generalized file analysis platform that could handle binary files in multiple ways (YARA or other static/dynamic analysis) as well as other forensic artifacts (configuration files, memory captures, etc).

One possible approach would be to have the Dispatcher retrieve S3 metadata for each object. A key:value pair would define the specific parser to use (by name, or perhaps substring of arn). Dispatcher would use the Lambda API (ListFunctions) to discover which lambdas it had access to and could support. It would then dispatch the file to one (or multiple) lambdas that matched the metadata and were available.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.