#50 #23 review CSB PR. Update summary() to generate taxonomies

analyzers/CuckooSandbox/cuckoosandbox_analyzer.py

@@ -17,13 +17,30 @@ def __init__(self):
         #self.networktimeout = self.getParam('config.networktimeout', 30, None)
 
     def summary(self, raw):
+        taxonomies = []
+        level = "safe"
+        namespace = "CSB"
+        predicate = "Malscore"
+        value = "\"0\""
+
         result = {
             'service': self.service,
             'dataType': self.data_type
         }
         result["malscore"] = raw.get("malscore", None)
         result["malfamily"] = raw.get("malfamily", None)
-        return result
+
+        if result["malscore"] > 6.5:
+            level = "malicious"
+        elif result["malscore"] > 2:
+            level = "suspicious"
+        elif result["malscore"] > 0:
+            level = "safe"
+
+        taxonomies.append(self.build_taxonomy(level, namespace, predicate, result["malscore"]))
+        taxonomies.append(self.build_taxonomy(level, namespace, "Malfamily", result["malfamily"]))
+
+        return taxonomies
 
     def run(self):
         Analyzer.run(self)

thehive-templates/CuckooSandbox_File_Analysis_Inet_1_0/short.html

@@ -1,5 +1,3 @@
-<span class="label" ng-class="{'label-info': content.malscore<=2, 'label-warning': content.malscore>2 && content.malscore<=6.5, 'label-danger': content.malscore >6.5}">
-                Cuckoo Sandbox=
-        <span ng-if="content.malscore">CSB:Malscore={{content.malscore}}</span>
-        <span ng-if="content.malfamily">CSB:Malfamily=[{{ content.malfamily}}]</span>
-</span>
+<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
+    {{t.namespace}}:{{t.predicate}}={{t.value}}
+</span>&nbsp;