-
Notifications
You must be signed in to change notification settings - Fork 0
/
descriptions.yml
30 lines (26 loc) · 1.91 KB
/
descriptions.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
scanner_details_features: >
The features of this scanner are detailed below. These features represent the capabilities
and the type of analysis the scanner can perform. This may include support for Indicators
of Compromise (IOC), the ability to emit files for further analysis, and the presence of
extended documentation for complex analysis techniques.
scanner_details_tastes: >
Strelka's file distribution system assigns scanners to files based on 'flavors' and 'tastes'.
Flavors describe the type of file, typically determined by MIME types from libmagic, matches
from YARA rules, or characteristics of parent files. Tastes are the criteria used within
Strelka to determine which scanners are applied to which files, with positive and negative
tastes defining files to be included or excluded respectively.
scanner_details_fields: >
This section provides a list of fields that are extracted from the files processed by this
scanner. These fields include the data elements that the scanner extracts from each file,
representing the analytical results produced by the scanner. If the test file is missing or
cannot be parsed, this section will not contain any data.
scanner_details_sample_event: >
Below is a sample event generated by this scanner, demonstrating the kind of output that can
be expected when it processes a file. This sample is derived from a mock scan event configured
in the scanner's test file. If no test file is available, this section will not display a
sample event.
scanner_overview_intro: >
Strelka is a scalable file analysis framework that allows for the rapid analysis of files through
a distributed system of scanners. Each scanner within Strelka has a specific role, ranging from
extracting simple file metadata to executing complex detections and analyses. This overview provides
insights into the capabilities and functionalities of each scanner within the Strelka ecosystem.