Nedim Šabić²
Nedim Šabić²
The command should launch the default editor and open the fibratus `.yml` configuration file.
This transformer should be in charge of encoding the event params by using the specific data encoding algorithm. Users should be able to choose between `hex`, `base64`, and maybe `asn1`...
### Description Fibratus already knows how to parse the [PE](https://www.fibratus.io/#/pe/introduction) data and extract valuable insights from it. I've been peeking at [pe-sieve](https://github.com/hasherezade/pe-sieve), and I have a feeling it would be...
These functions would cooperate with the [Yara](https://www.fibratus.io/#/yara/scanning) scanner to trigger rule execution within the filament. The functions should return which rules and strings were matched along with other useful information....
The `encrypt` transformer should encrypt event parameters with a specified crypto algorithm (e.g. AES). The original parameter value should get replaced with its respective hash string. Example config: ``` transformers:...
The mask transformer should take care of masking sensitive data living in event parameters. Example config: ``` transformers: mask: char: * enabled: true kparams: - sip - dip ```
`fibratus logs` command should provide a user-friendly interface for grepping/exploring Fibratus log files that reside in the`%PROGRAMFILES%\Fibratus\Logs` directory. The command would have various options: `-f` for tailing the log file...
[MongoDB](https://www.mongodb.com) output would be responsible for storing the events in the Mongo collections. We should consider introducing the `BSON` serializer if the native Mongo client `BSON` encoder doesn't satisfy the...
These helper functions would allow consulting the handle state exposed by Fibratus. The `find_handles` function should return all handles known to Fibratus as a list of Python dictionary objects. The...
These functions would allow consulting the process state exposed by Fibratus. The `find_processes` function should return currently running processes as a list of Python dictionary objects. The `find_process` function accepts...