Skip to content

Commit

Permalink
Update result_document.py
Browse files Browse the repository at this point in the history
Comments on loading rules_prevalence and warning if file not found
  • Loading branch information
Aayush-Goel-04 committed Nov 20, 2023
1 parent 07553a6 commit 2c4931d
Showing 1 changed file with 20 additions and 0 deletions.
20 changes: 20 additions & 0 deletions capa/render/result_document.py
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
# See the License for the specific language governing permissions and limitations under the License.
import gzip
import json
import logging
import datetime
import collections
from typing import Dict, List, Tuple, Union, Literal, Optional
Expand Down Expand Up @@ -507,9 +508,28 @@ class MaecMetadata(FrozenModel):

@lru_cache(maxsize=None)
def load_rules_prevalence() -> Dict[str, str]:
"""
Load and return a dictionary containing prevalence information for rules defined in capa.
Returns:
Dict[str, str]: A dictionary where keys are rule names, and values are prevalence levels.
Example:
{
"capture screenshot": "rare",
"send data": "common",
"receive and write data from server to client": "common",
"resolve DNS": "common",
"reference HTTP User-Agent string": "rare"
}
Note:
Prevalence levels can be one of the following: "common", "rare"
"""
CD = capa.main.get_default_root()
file = CD / "assets" / "rules_prevalence_data" / "rules_prevalence.json.gz"
if not file.exists():
logging.getLogger("capa").warning("Rules prevalence db was not found. Prevalence data will not be available.")
return {}
with gzip.open(file, "rb") as gzfile:
return json.loads(gzfile.read().decode("utf-8"))
Expand Down

0 comments on commit 2c4931d

Please sign in to comment.