Skip to content

Integrate master IOC unifier engine and refactor container paths#2

Open
sergiofoz wants to merge 2 commits into
reverseame:mainfrom
sergiofoz:main
Open

Integrate master IOC unifier engine and refactor container paths#2
sergiofoz wants to merge 2 commits into
reverseame:mainfrom
sergiofoz:main

Conversation

@sergiofoz

Copy link
Copy Markdown

Overview

This Pull Request introduces the Master IOC Unifier Engine and ensures a production-ready, clean data lifecycle across all analysis phases. It also resolves path inconsistencies in the main orchestrator by aligning them with the infrastructure Wiki guidelines.

Key Changes

  • Unified Reporting Engine: Implemented and integrated the IOCReportUnifier module (utils/report_unifier.py). It automatically aggregates telemetry from Phase 1 (Static Analysis), Phase 2 (Dynamic Analysis via CAPEv2), and Phase 3 (Memory Forensics via Volatility 3) into a single structured master report named unified_maestro_report.json.
  • Path Translation & Refactoring: Standardized and refactored Docker Compose service interactions within ioc_extractor.py, switching paths and internal naming conventions to English as specified in the team's deployment architecture documentation.
  • Repository Sanitation: Updated the local .gitignore to strictly exclude malware samples (bin_samples/), local execution outputs (bin_outputs/), and Python cache files (__pycache__), ensuring no data leaks hit the public repository.

Verification & Testing (Smoke Tests)

Comprehensive end-to-end testing was performed locally on the CAPE VM (vm-cape) with 100% success:

  1. CLI Integrity: Verified proper argument handling and module indexing via ./ioc_extractor.py --help.
  2. Control Sample (EICAR): Executed a full pipeline run using eicar.com. The engine successfully parsed the static data and handled edge cases properly (e.g., gracefully logging empty process listings or missing PIDs in ephemeral payloads without crashing).
  3. Live Malware Sample (SmokeLoader): Executed a live validation test using second_stage.exe. The script completed all orchestration phases safely, accurately mapped the dynamic registry and file system hooks, and successfully generated a pristine unified_maestro_report.json compiling the multi-phase IoCs.

Related Artifacts Created

  • utils/__init__.py
  • utils/report_unifier.py
  • Updated ioc_extractor.py
  • Updated .gitignore

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant