BlackSnufkin
fb52b1432e
Fibratus EDR profile (kind: fibratus). Pull-from-event-log model, same
shape DetonatorAgent's FibratusEdrPlugin.cs uses: operator configures
Fibratus on the EDR VM with alertsenders.eventlog: {enabled: true,
format: json}; rule matches land in the Application log. Whiskers gains
GET /api/alerts/fibratus/since which wevtutil-queries the log,
extracts <TimeCreated SystemTime> + <EventID> + <Data>, ships the raw
JSON blobs back. The new FibratusEdrAnalyzer mirrors Elastic's
two-phase shape — Phase 1 exec, Phase 2 polls Whiskers — and normalizes
Fibratus's actual schema (events[].proc.{name,exe,cmdline,parent_name,
parent_cmdline,ancestors} + bare tactic.id/technique.id/subtechnique.id
labels) into the saved-view renderer's dict.
Whiskers /api/info now reports telemetry_sources: ['fibratus'] when
fibratus.exe is at C:\Program Files\Fibratus\Bin\, so the
orchestrator can preflight before dispatching. wevtutil's single-quoted
attribute output is parsed correctly.
Dashboard reachability cache (services.edr_health). 30s TTL +
background poller every 15s. Per-probe timeouts dropped 4s/5s -> 2s.
First load post-boot waits at most one probe cycle; every subsequent
load <5ms (cache hit).
GrumpyCats package split: 1085-line monolith into:
grumpycat.py — orchestrator (14 lines)
cli/ — parser, handlers, runner
litterbox_client/ — base + per-domain mixins (files, analysis,
doppelganger, results, edr, reports, system)
composed into LitterBoxClient.
LitterBoxMCP.py rewires its one import. New CLI subcommand
fibratus-alerts and matching MCP tool fibratus_alerts_since pull
Fibratus alerts via a LitterBox passthrough endpoint
(/api/edr/fibratus/<profile>/alerts/since) for wire-checking the agent
without dispatching a payload.
CHANGELOG updated.
42 lines
1.7 KiB
Python
42 lines
1.7 KiB
Python
"""Read saved analysis results.
|
|
|
|
Per-tool getters (file_info / static / dynamic / holygrail / risk) plus
|
|
`get_results` which is the legacy multi-purpose handle that backs the
|
|
`results --type` CLI.
|
|
"""
|
|
|
|
from typing import Dict
|
|
|
|
|
|
class ResultsMixin:
|
|
def get_results(self, target: str, analysis_type: str) -> Dict:
|
|
"""Get results for a specific analysis type via the page route."""
|
|
self._validate_analysis_type(analysis_type, ["static", "dynamic", "info"])
|
|
response = self._make_request("GET", f"/results/{analysis_type}/{target}")
|
|
return response.json()
|
|
|
|
def get_file_info(self, target: str) -> Dict:
|
|
"""File metadata: type, size, hashes, entropy, PE structure, etc."""
|
|
response = self._make_request("GET", f"/api/results/info/{target}")
|
|
return response.json()
|
|
|
|
def get_static_results(self, target: str) -> Dict:
|
|
"""Static analysis output (YARA / CheckPlz / Stringnalyzer)."""
|
|
response = self._make_request("GET", f"/api/results/static/{target}")
|
|
return response.json()
|
|
|
|
def get_dynamic_results(self, target: str) -> Dict:
|
|
"""Dynamic analysis output (memory scanners + behavioral telemetry)."""
|
|
response = self._make_request("GET", f"/api/results/dynamic/{target}")
|
|
return response.json()
|
|
|
|
def get_holygrail_results(self, target: str) -> Dict:
|
|
"""HolyGrail BYOVD output for a driver."""
|
|
response = self._make_request("GET", f"/api/results/holygrail/{target}")
|
|
return response.json()
|
|
|
|
def get_risk_assessment(self, target: str) -> Dict:
|
|
"""Computed detection assessment: score, level, triggering indicators."""
|
|
response = self._make_request("GET", f"/api/results/risk/{target}")
|
|
return response.json()
|