service_manifest.yml

name: AVClass
version: $SERVICE_TAG
description: This service consumes Anti-Virus tags (`av.virus_name`) and extracts family, behavior, and platform information based on [AVClass2](https://github.com/malicialab/avclass/tree/master/avclass2).

# Regex defining the types of files the service accepts and rejects
accepts: .*
rejects: empty|metadata/.*|uri/.*

# At which stage the service should run (one of FILTER, EXTRACT, CORE, SECONDARY, POST, REVIEW)
# NOTE: Stages are executed in the order defined in the list
stage: POST
# Which category the service is part of (one of Antivirus, Dynamic Analysis, External, Extraction, Filtering, Internet Connected, Networking, Static Analysis)
category: Antivirus

# Does the service require access to the file to perform its task
# If set to false, the service will only have access to the file metadata (e.g. Hashes, size, type, ...)
file_required: true
# Maximum execution time the service has before it's considered to be timed out
timeout: 60

# is the service enabled by default
enabled: true
uses_tags: true
privileged: true

submission_params:
  - default: true
    name: include_malpedia_dataset
    type: bool
    value: true

heuristics:
  - heur_id: 1
    name: Malware family label
    score: 0
    filetype: "*"
    description: AV labels identify malware family

  - heur_id: 2
    name: Malware classification label
    score: 0
    filetype: "*"
    description: AV labels indicate a malware classification

  - heur_id: 3
    name: Malicious behavior label
    score: 0
    filetype: "*"
    description: AV labels indicate malicious behavior

  - heur_id: 4
    name: File identification label
    score: 0
    filetype: "*"
    description: AV labels indicate file type

docker_config:
  image: ${REGISTRY}cccs/assemblyline-service-avclass:$SERVICE_TAG
  cpu_cores: 0.25

dependencies:
  updates:
    container:
      allow_internet_access: true
      command: ["python", "-m", "avclass.update_server"]
      image: ${REGISTRY}cccs/assemblyline-service-avclass:$SERVICE_TAG
      ports: ["5003"]
      cpu_cores: 2
    run_as_core: True

update_config:
  generates_signatures: false
  sources:
    - name: malpedia
      uri: https://malpedia.caad.fkie.fraunhofer.de/api/get/families?format=json
  update_interval_seconds: 86400
  wait_for_update: false