parameters: (self)
return_statement: return results
docstring: Run IRMA processing
          @return: full IRMA report.
docstring_summary: Run IRMA processing
docstring_tokens: Run IRMA processing
function: def run(self):
          """Run IRMA processing
          @return: full IRMA report.
          """
          self.key = "irma"
  
          """ Fall off if we don't deal with files """
          if self.results.get("info", {}).get("category") != "file":
              log.debug("IRMA supports only file scanning !")
              return {}
  
          self.url = self.options.get("url")
          self.timeout = int(self.options.get("timeout", 60))
          self.scan = int(self.options.get("scan", 0))
          self.force = int(self.options.get("force", 0))
  
          sha256 = Files.sha256_file(self.file_path)
  
          results = self._get_results(sha256)
  
          if not self.force and not self.scan and not results:
              return {}
          elif self.force or (not results and self.scan):
              log.info("File scan requested: %s", sha256)
              self._scan_file(self.file_path, self.force)
              results = self._get_results(sha256) or {}
  
          # FIXME! could use a proper fix here
          # that probably needs changes on IRMA side aswell
          # --
          # related to  https://github.com/elastic/elasticsearch/issues/15377
          # entropy value is sometimes 0 and sometimes like  0.10191042566270775
          # other issue is that results type changes between string and object :/
          
          for idx, result in enumerate(results["probe_results"]):
              if result["name"] == "PE Static Analyzer":
                  log.debug("Ignoring PE results at index {0}".format(idx))
                  results["probe_results"][idx]["results"] = "... scrapped ..."
  
              """ When VT results comes back with 'detected by 0/58' then it gets
              cached as malicious with signature due to the fact that the result
              exists. This is a workaround to override that tragedy and make it
              compatible with other results.
              """
              if result["name"] == "VirusTotal" \
                      and results["probe_results"][idx]["results"].startswith("detected by 0/"):
                  log.debug("Fixing empty match from VT")
                  results["probe_results"][idx]["status"] = 0
                  results["probe_results"][idx]["results"] = None
  
          return results
function_tokens: def run ( self ) : self . key = "irma" """ Fall off if we don't deal with files """ if self . results . get ( "info" , { } ) . get ( "category" ) != "file" : log . debug ( "IRMA supports only file scanning !" ) return { } self . url = self . options . get ( "url" ) self . timeout = int ( self . options . get ( "timeout" , 60 ) ) self . scan = int ( self . options . get ( "scan" , 0 ) ) self . force = int ( self . options . get ( "force" , 0 ) ) sha256 = Files . sha256_file ( self . file_path ) results = self . _get_results ( sha256 ) if not self . force and not self . scan and not results : return { } elif self . force or ( not results and self . scan ) : log . info ( "File scan requested: %s" , sha256 ) self . _scan_file ( self . file_path , self . force ) results = self . _get_results ( sha256 ) or { } # FIXME! could use a proper fix here # that probably needs changes on IRMA side aswell # -- # related to  https://github.com/elastic/elasticsearch/issues/15377 # entropy value is sometimes 0 and sometimes like  0.10191042566270775 # other issue is that results type changes between string and object :/ for idx , result in enumerate ( results [ "probe_results" ] ) : if result [ "name" ] == "PE Static Analyzer" : log . debug ( "Ignoring PE results at index {0}" . format ( idx ) ) results [ "probe_results" ] [ idx ] [ "results" ] = "... scrapped ..." """ When VT results comes back with 'detected by 0/58' then it gets
              cached as malicious with signature due to the fact that the result
              exists. This is a workaround to override that tragedy and make it
              compatible with other results.
              """ if result [ "name" ] == "VirusTotal" and results [ "probe_results" ] [ idx ] [ "results" ] . startswith ( "detected by 0/" ) : log . debug ( "Fixing empty match from VT" ) results [ "probe_results" ] [ idx ] [ "status" ] = 0 results [ "probe_results" ] [ idx ] [ "results" ] = None return results