(self)
return results
Run IRMA processing
        @return: full IRMA report.
Run IRMA processing
Run IRMA processing
def run(self):
        """Run IRMA processing
        @return: full IRMA report.
        """
        self.key = "irma"

        """ Fall off if we don't deal with files """
        if self.results.get("info", {}).get("category") != "file":
            log.debug("IRMA supports only file scanning !")
            return {}

        self.url = self.options.get("url")
        self.timeout = int(self.options.get("timeout", 60))
        self.scan = int(self.options.get("scan", 0))
        self.force = int(self.options.get("force", 0))

        sha256 = Files.sha256_file(self.file_path)

        results = self._get_results(sha256)

        if not self.force and not self.scan and not results:
            return {}
        elif self.force or (not results and self.scan):
            log.info("File scan requested: %s", sha256)
            self._scan_file(self.file_path, self.force)
            results = self._get_results(sha256) or {}

        # FIXME! could use a proper fix here
        # that probably needs changes on IRMA side aswell
        # --
        # related to  https://github.com/elastic/elasticsearch/issues/15377
        # entropy value is sometimes 0 and sometimes like  0.10191042566270775
        # other issue is that results type changes between string and object :/
        
        for idx, result in enumerate(results["probe_results"]):
            if result["name"] == "PE Static Analyzer":
                log.debug("Ignoring PE results at index {0}".format(idx))
                results["probe_results"][idx]["results"] = "... scrapped ..."

            """ When VT results comes back with 'detected by 0/58' then it gets
            cached as malicious with signature due to the fact that the result
            exists. This is a workaround to override that tragedy and make it
            compatible with other results.
            """
            if result["name"] == "VirusTotal" \
                    and results["probe_results"][idx]["results"].startswith("detected by 0/"):
                log.debug("Fixing empty match from VT")
                results["probe_results"][idx]["status"] = 0
                results["probe_results"][idx]["results"] = None

        return results
def run ( self ) : self . key = "irma" """ Fall off if we don't deal with files """ if self . results . get ( "info" , { } ) . get ( "category" ) != "file" : log . debug ( "IRMA supports only file scanning !" ) return { } self . url = self . options . get ( "url" ) self . timeout = int ( self . options . get ( "timeout" , 60 ) ) self . scan = int ( self . options . get ( "scan" , 0 ) ) self . force = int ( self . options . get ( "force" , 0 ) ) sha256 = Files . sha256_file ( self . file_path ) results = self . _get_results ( sha256 ) if not self . force and not self . scan and not results : return { } elif self . force or ( not results and self . scan ) : log . info ( "File scan requested: %s" , sha256 ) self . _scan_file ( self . file_path , self . force ) results = self . _get_results ( sha256 ) or { } # FIXME! could use a proper fix here # that probably needs changes on IRMA side aswell # -- # related to  https://github.com/elastic/elasticsearch/issues/15377 # entropy value is sometimes 0 and sometimes like  0.10191042566270775 # other issue is that results type changes between string and object :/ for idx , result in enumerate ( results [ "probe_results" ] ) : if result [ "name" ] == "PE Static Analyzer" : log . debug ( "Ignoring PE results at index {0}" . format ( idx ) ) results [ "probe_results" ] [ idx ] [ "results" ] = "... scrapped ..." """ When VT results comes back with 'detected by 0/58' then it gets
            cached as malicious with signature due to the fact that the result
            exists. This is a workaround to override that tragedy and make it
            compatible with other results.
            """ if result [ "name" ] == "VirusTotal" and results [ "probe_results" ] [ idx ] [ "results" ] . startswith ( "detected by 0/" ) : log . debug ( "Fixing empty match from VT" ) results [ "probe_results" ] [ idx ] [ "status" ] = 0 results [ "probe_results" ] [ idx ] [ "results" ] = None return results