Skip to content
This repository has been archived by the owner on Feb 27, 2024. It is now read-only.

Add ability to load user defined rules/parsers at runtime #25

Open
loredous opened this issue May 30, 2023 · 0 comments
Open

Add ability to load user defined rules/parsers at runtime #25

loredous opened this issue May 30, 2023 · 0 comments
Labels
enhancement New feature or request

Comments

@loredous
Copy link
Contributor

Is your feature request related to a problem? Please describe.
Some rules and parsers may be specific to a company's use cases, for example flagging all downloads from non-trusted URLs/IPs. In order to accomplish this without requiring each user to rebuild the container image and maintain their own internal fork, Build Inspector needs to be able to take in new rules and parsers from mapped folders.

Describe the solution you'd like
The solution should ideally be a part of the initial loading of the rules and parsers. Logic should be able to take an argument for the location of the rules and parsers (with a sane default value), and should dynamically load the YARA rules files and any Python modules that fit the proper interface for a parser. An example can be found here

Describe alternatives you've considered
Alternative would be to have users maintain downstream forks with their own rules built in. This is sub-optimal as it requires maintenance and feeding of changes and build systems.

Additional context

  • Should have example module
  • Should have documentation on module creation
  • Should have checks to confirm loaded modules subclass the ParserBase module
  • Should have arguments for parser/rule folders with defaults and ENV variables for Docker deployment
@loredous loredous added the enhancement New feature or request label May 30, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant