yaratest

Documentation

Index

• type Config
• type Match
• type Result
  • func Scan(c Config) (*Result, error)
• type Severity

Types

type Config

type Config struct {
	ReferencePaths      []string
	ScanPaths           []string
	RulePaths           []string
	Rules               *yara.Rules
	ProgramsOnly        bool
	ExcludeProgramKinds []string
	ExitOnFailure       bool
	Quiet               bool
	PlaySounds          bool

	CachedReferenceHit map[string]bool
	CachedScanMiss     map[string]bool
	// contains filtered or unexported fields
}

type Match

type Match struct {
	Path     string
	SHA256   string
	RuleName string
}

type Result

type Result struct {
	Duration        time.Duration
	RuleCount       int
	FilesSeen       int
	HashCount       int
	HashesConfirmed int
	HashFailures    int
	ScanErrors      []string

	ReferenceFilesSeen    int
	ReferenceFilesSkipped int
	ScanFilesSeen         int
	ScanFilesSkipped      int

	NewHashMatches []Match
	TruePositive   map[string]bool
	TrueNegative   map[string]bool
	FalsePositive  map[string]bool
	FalseNegative  map[string]bool

	SHA256 map[string]string

	FailedHashCheck map[string][]string
}

func Scan

func Scan(c Config) (*Result, error)

type Severity

type Severity struct {
	Score int
	Name  string

	MatchingRules   int
	MatchingStrings int
}