config

Documentation

Index

• func LoadScoringConfig()
• func ReadConfigFile(configFile string)
• func SaveConfig() error
• type CAPAScoringConfig
• type ICAPScoringConfig
• type MSOfficeScoringConfig
• type ScoringConfig
• type YARAScoringConfig

Functions

func LoadScoringConfig

func LoadScoringConfig()

LoadScoringConfig reads the scoring TOML file or falls back to defaults.

func ReadConfigFile

func ReadConfigFile(configFile string)

ReadConfigFile loads configuration from file and environment variables.

func SaveConfig

func SaveConfig() error

SaveConfig writes the current configuration to disk.

Types

type CAPAScoringConfig

type CAPAScoringConfig struct {
	PerCapability int            `mapstructure:"per_capability"`
	Max           int            `mapstructure:"max"`
	PerTactic     int            `mapstructure:"per_tactic"`
	MaxTactics    int            `mapstructure:"max_tactics"`
	PerMBC        int            `mapstructure:"per_mbc"`
	MaxMBC        int            `mapstructure:"max_mbc"`
	Specific      map[string]int `mapstructure:"specific"`
}

CAPAScoringConfig defines points per capability/tactic/MBC and per-name overrides with maximum caps.

type ICAPScoringConfig

type ICAPScoringConfig struct {
	Infected int `mapstructure:"infected"`
}

ICAPScoringConfig defines points added when an ICAP server flags a file as infected.

type MSOfficeScoringConfig

type MSOfficeScoringConfig struct {
	VerdictSuspicious int `mapstructure:"verdict_suspicious"`
	VbaStomping       int `mapstructure:"vba_stomping"`
	PerAutoexec       int `mapstructure:"per_autoexec"`
	MaxAutoexec       int `mapstructure:"max_autoexec"`
	PerSuspicious     int `mapstructure:"per_suspicious"`
	MaxSuspicious     int `mapstructure:"max_suspicious"`
	PerIOC            int `mapstructure:"per_ioc"`
	MaxIOC            int `mapstructure:"max_ioc"`
	Encrypted         int `mapstructure:"encrypted"`
	VbaMacros         int `mapstructure:"vba_macros"`
	XlmMacros         int `mapstructure:"xlm_macros"`
	Max               int `mapstructure:"max"`
}

MSOfficeScoringConfig defines fine-grained scoring for Microsoft Office analysis indicators.

type ScoringConfig

type ScoringConfig struct {
	YARA     YARAScoringConfig     `mapstructure:"yara"`
	CAPA     CAPAScoringConfig     `mapstructure:"capa"`
	ICAP     ICAPScoringConfig     `mapstructure:"icap"`
	MSOffice MSOfficeScoringConfig `mapstructure:"msoffice"`
}

ScoringConfig holds scoring parameters for each analysis engine.

var Scoring ScoringConfig

Scoring holds the globally loaded scoring configuration.

type YARAScoringConfig

type YARAScoringConfig struct {
	PerRule int `mapstructure:"per_rule"`
	Max     int `mapstructure:"max"`
}

YARAScoringConfig defines points per YARA rule match and a maximum cap.