Add known FP MD5 hashes list at https://github.com/Neo23x0/ti-falsepositives to threat intel module#1068

Merged

AlyaGomaa merged 10 commits intodevelopfrom

alya/add_known_fps_list

Nov 18, 2024

Commits on Nov 18, 2024

.pre-commit-config.yaml: allow uploading of large files at config/local_ti_files/known_fp_hashes.csv
AlyaGomaa
committed
.pre-commit-config.yaml: add an exception for check-added-large-files hook to allow uploading the list of fps
AlyaGomaa
committed
add a list of known fp hashes from https://github.com/Neo23x0/ti-falsepositives
AlyaGomaa
committed
threat_intelligence.py: add a parser for the list of known FP hashes
AlyaGomaa
committed
db: add functions to store and retrieve FP hashes
AlyaGomaa
committed
use md5 hashes only in known_fp_md5_hashes.csv
AlyaGomaa
committed
threat_intelligence.py: dont lookup known FP hashes
AlyaGomaa
committed
test_threat_intelligence.py: add a unit test for is_known_fp_md5_hash()
AlyaGomaa
committed
detection_modules.md: document the MD5 whitelist
AlyaGomaa
committed
test_threat_intelligence.py: update unit tests
AlyaGomaa
committed