Assemblyline Tutorials

[cccs-rs]

Do you guys find there's things about Assemblyline that could be better described in detail or maybe something where a "hands on" walkthrough is more beneficial (ie. service development)?

Topics could range from deployment, maintenance, or even troubleshooting procedures.

[kam193]

I'd have a few things, but I'm not entirely sure they are really for tutorials, or I'm just finding edge cases 😅

1. Possibilities and limitations of postprocessing actions. I'm thinking about using them, but non of the examples I've seen so far seems to do what I'd like to - e.g., to deal with usage limits, I cannot send all files to all external service. But what I often do manually is resending some of the files from a submission (my usual submissions are archives with many files) to virus total / sandbox, etc., if there is some suspicious hit in the file itself or other files from the same submission. Is it possible to automate it with postprocessing rules?
2. Workflows and workflow rules. They seem not really working as I expected. They look nice to mark alerts, but the info from alerts is not propagated to the submission - if I open a submission, I have no idea if I did anything with it. So I'm using the votes to mark if the submission was safe or malicious. I'd like know how you use it.
3. Dev area - manipulating ontology. I've started working on a better representation of a results from my private dynamic analysis service, so I want to create a right ontology to represent processes etc. My actual impression is that I have to juggle with dicts, and creating of some of them requires solving a circular dependencies 😅 But it's just an impression, I haven't spent enough time on it yet.
4. Malware Archive - it looks... useless 😅 When I archive a submission, all files generated in a submission are getting archived kind of separately, and the archive view presents malicious, non-malicious and supplementary files altogether. The attributions or comments done in the archive are not visible when submitting the same file again, so there is no knowledge sharing from the already processed and enriched files. As so, I'm not fully getting, how would be the best to use the malware archive.

[kh4rdur]

Scrolling through the user documentation, we've noticed the option to download files based on the hashes. The option looks great, but doesnt describe well enough how to use it.
https://cybercentrecanada.github.io/assemblyline4_docs/user_manual/submitting_sha256/
It would be great if there was a description regarding the configuration of the file_sources: (or other components) so more information can be gathered for new connections.