[YARA] propagating Malware relationships and labels from Indicators to matching Artifacts #5193
+49
−2
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed changes
*if YARA_PROPAGATE_LABELS = true, and a Yara indicator has any lables, those labels are added to any matching Artifacts
Checklist
Further comments
The current Yara connector matches Yara indicators to Artifacts and then creates a 'related-to' relationship between the Indicator and Artifact. This only identifies which Yara signature matches a file, but since a Yara signature is an indicator of something else, to add real threat intel value, we need a way to identify what the Yara signature is indicating. This update helps by propagating relationships between malware and signatures to the matching artifact, or by propagating labels from the Yara indicator to the Artifact, thus taking the connector to the next step and actually using it to identify malware samples. I could see some extra value in propagating some other relationships, such as Techniques, but we'll save that for future updates.