Malice NSRL Plugin - This takes the 5.5 GB NSRL minimal set and converts it into a 77.4 MB bloom filter with an Estimate False Positive Rate of 0.001
This repository contains a Dockerfile of the NSRL lookup malice plugin malice/nsrl.
REPOSITORY TAG SIZE
malice/nsrl latest 117MB
malice/nsrl 0.1.0 117MB
malice/nsrl sha1 117MB
malice/nsrl md5 117MB
NOTE:
- tags
latest
and0.1.0
are the same assha1
- tag
sha1
can query by sha1 hash- tag
md5
can query by md5 hash
- Install Docker.
- Download trusted build from public DockerHub:
docker pull malice/nsrl
docker run --rm malice/nsrl --help
Usage: nsrl [OPTIONS] COMMAND [arg...]
Malice nsrl Plugin
Version: v0.1.0, BuildTime: 20161119
Author:
blacktop - <https://github.com/blacktop>
Options:
--verbose, -V verbose output
--help, -h show help
--version, -v print the version
Commands:
web Create a NSRL lookup web service
build Build bloomfilter from NSRL database
lookup Query NSRL for hash
help Shows a list of commands or help for one command
Run 'nsrl COMMAND --help' for more information on a command.
docker run --rm malice/nsrl:md5 lookup 829e4805b0e12b383ee09abdc9e2dc3c
docker run --rm malice/nsrl:sha1 lookup 5a272b7441328e09704b6d7eabdbd51b8858fde4
NAME:
nsrl lookup - Query NSRL for hash
USAGE:
nsrl lookup [command options] SHA1 to query NSRL with
OPTIONS:
--elasticsearch value elasticsearch url for Malice to store results [$MALICE_ELASTICSEARCH_URL]
--post, -p POST results to Malice webhook [$MALICE_ENDPOINT]
--proxy, -x proxy settings for Malice webhook endpoint [$MALICE_PROXY]
--timeout value malice plugin timeout (in seconds) (default: 10) [$MALICE_TIMEOUT]
--table, -t output as Markdown table
{
"nsrl": {
"found": true,
"hash": "5A272B7441328E09704B6D7EABDBD51B8858FDE4"
}
}
- Found โ
- To write results to ElasticSearch
- To create a nsrl lookup micro-service
- To post results to a webhook
- To query NSRL for a filename
Find a bug? Want more features? Find something missing in the documentation? Let me know! Please don't hesitate to file an issue
See CHANGELOG.md
See all contributors on GitHub.
Please update the CHANGELOG.md and submit a Pull Request on GitHub.
MIT Copyright (c) 2015 blacktop