service_manifest.yml

# Name of the service
name: Capa
# Version of the service
version: 4.2.0.stable7
# Description of the service
description: Analyze executable with Flare's CAPA

# Regex defining the types of files the service accepts and rejects
accepts: executable/.*
rejects: empty|metadata/.*

# At which stage the service should run (one of FILTER, EXTRACT, CORE, SECONDARY, POST)
# NOTE: Stages are executed in the order defined in the list
stage: CORE
# Which category the service is part of (one of Antivirus, Dynamic Analysis, External, Extraction, Filtering, Networking, Static Analysis)
category: Static Analysis

# Does the service require access to the file to perform its task
# If set to false, the service will only have access to the file metadata (e.g. Hashes, size, type, ...)
file_required: true
# Maximum execution time the service has before it's considered to be timed out
timeout: 300

# is the service enabled by default
enabled: true

# Service heuristic blocks: List of heuristic objects that define the different heuristics used in the service
#heuristics:
  # - description: This is a demo heuristic
  #   filetype: "*"
  #   heur_id: 1
  #   name: Demo
  #   score: 100

# Docker configuration block which defines:
#  - the name of the docker container that will be created
#  - CPU and ram allocation by the container
docker_config:
  image: ghcr.io/azotium/assemblyline-service-capa:v4.2.0.stable7
  cpu_cores: 1.0
  ram_mb: 1024