-
Notifications
You must be signed in to change notification settings - Fork 1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Impovements for SMS module #438
Conversation
LGTM |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good!
@@ -55,6 +55,11 @@ def serialize(self, record: dict) -> Union[dict, list]: | |||
|
|||
def check_indicators(self) -> None: | |||
for attachment in self.results: | |||
# Check for known malicious filenames. | |||
if self.indicators.check_file_path(attachment["filename"]): | |||
print("Found malicious filename", attachment["filename"]) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should this use a logger instance?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Doh, yes thanks! Not sure how I missed theprint()
when committing. The indicators.check_file_path()
already logs the detection. We can just append the attachment to the detections without adding an additional log line.
The SMS module was creating noisy entries in the timeline as it would output timeline
sms_read
entries for SMS messages even when nosms_read
timeline was set. This branch fixes the module so that messages which were not read do not produce an extra entry.This branch also adds basic indicator checking in the SMS module.