Add RuleLicense to JSON output

Author: tstromberg

pkg/bincapz/report.go

@@ -27,6 +27,7 @@ type Behavior struct {
 	RiskScore   int
 	RiskLevel   string
 	RuleAuthor  string
+	RuleLicense string
 }
 
 type FileReport struct {
@@ -209,6 +210,7 @@ func fileReport(mrs yara.MatchRules, ignoreTags []string, minLevel int) FileRepo
 	syscalls := []string{}
 	desc := ""
 	author := ""
+	license := ""
 
 	for _, m := range mrs {
 		risk := behaviorRisk(m.Namespace, m.Tags)
@@ -229,6 +231,12 @@ func fileReport(mrs yara.MatchRules, ignoreTags []string, minLevel int) FileRepo
 					b.RuleAuthor = author
 				}
 
+			case "license", "license_url":
+				license = fmt.Sprintf("%s", meta.Value)
+				if len(license) > len(b.RuleLicense) {
+					b.RuleLicense = license
+				}
+
 			case "description", "threat_name", "name":
 				desc = fmt.Sprintf("%s", meta.Value)
 				if len(desc) > len(b.Description) {