This repository has been archived by the owner on Feb 27, 2024. It is now read-only.
Add ability to load user defined rules/parsers at runtime #25
Labels
enhancement
New feature or request
Is your feature request related to a problem? Please describe.
Some rules and parsers may be specific to a company's use cases, for example flagging all downloads from non-trusted URLs/IPs. In order to accomplish this without requiring each user to rebuild the container image and maintain their own internal fork, Build Inspector needs to be able to take in new rules and parsers from mapped folders.
Describe the solution you'd like
The solution should ideally be a part of the initial loading of the rules and parsers. Logic should be able to take an argument for the location of the rules and parsers (with a sane default value), and should dynamically load the YARA rules files and any Python modules that fit the proper interface for a parser. An example can be found here
Describe alternatives you've considered
Alternative would be to have users maintain downstream forks with their own rules built in. This is sub-optimal as it requires maintenance and feeding of changes and build systems.
Additional context
The text was updated successfully, but these errors were encountered: