<commit_before>Malware Name Mapping
====================

This script fetches the current mapping file from the [Malware Name Mapping repository](https://github.com/certtools/malware_name_mapping/raw/master/mapping.csv) and converts it to the syntax needed by the modify expert.
It expects a comma-separated file and uses the first column as regular expression and the second one as family name. Other URLs can be given as parameter.
The resulting configuration sets the field `classification.identifier` to the malware family name corresponding to the given `malware.name`.

By default, the result is printed to stdout, a filename can be given as parameter.

For more information about the mapping project, have a look at the [Malware Name Mapping repository](https://github.com/certtools/malware_name_mapping).

See also the built-in help of the script by calling it with `-h`.

Default rule
------------

A default rule can optionally be added the the end of the rules with the `-d` flag.
With this rule, the field `classification.identifier` is set to `malware.name` if the first is empty and the latter is not.
As this is the last rule, it is kind of "last resort" to fill the identifier field.<commit_msg>DOC: contrib malware names: how to use<commit_after>Malware Name Mapping
====================

This script fetches the current mapping file from the [Malware Name Mapping repository](https://github.com/certtools/malware_name_mapping/raw/master/mapping.csv) and converts it to the syntax needed by the modify expert.
It expects a comma-separated file and uses the first column as regular expression and the second one as family name. Other URLs can be given as parameter.
The resulting configuration sets the field `classification.identifier` to the malware family name corresponding to the given `malware.name`.

By default, the result is printed to stdout, a filename can be given as parameter.

For more information about the mapping project, have a look at the [Malware Name Mapping repository](https://github.com/certtools/malware_name_mapping).

See also the built-in help of the script by calling it with `-h`.

Default rule
------------

A default rule can optionally be added the the end of the rules with the `-d` flag.
With this rule, the field `classification.identifier` is set to `malware.name` if the first is empty and the latter is not.
As this is the last rule, it is kind of "last resort" to fill the identifier field.

Modify Bot
----------

Use the Modify bot to apply the ruleset by using the generated file as configuration. Also, deactivate the case sensitivity of the bot.
{'fraction_non_alphanumeric': 0.07940161104718067, 'fraction_numerical': 0.0, 'mean_word_length': 4.311608961303462, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7644444', 'n_tokens_mistral': 653, 'n_tokens_neox': 631, 'n_words': 372}