service_manifest.yml

name: Martello
version: $SERVICE_TAG
description: This service wraps the martello classifier

# Regex defining the types of files the service accepts and rejects
accepts: executable/windows/.*
rejects: empty|metadata/.*|executable/windows/dos|executable/windows/com

# At which stage the service should run (one of FILTER, EXTRACT, CORE, SECONDARY, POST, REVIEW)
# NOTE: Stages are executed in the order defined in the list
stage: CORE
# Which category the service is part of (one of Antivirus, Dynamic Analysis, External, Extraction, Filtering, Internet Connected, Networking, Static Analysis)
category: Static Analysis

# Does the service require access to the file to perform its task
# If set to false, the service will only have access to the file metadata (e.g. Hashes, size, type, ...)
file_required: true
# Maximum execution time the service has before it's considered to be timed out
timeout: 60

# is the service enabled by default
enabled: true

config:
  suspicious_thr: 0.8
  malicious_thr: 0.95
  benign_thr: 0.2

heuristics:
  - description: This suspicious heuristic indicates file has possibility of being malware
    filetype: "executable/windows"
    heur_id: 1
    name: Suspicious Martello classification
    score: 200
  - description: This malicious heuristic indicates high likelihood of file being malware
    filetype: "executable/windows"
    heur_id: 2
    name: Malicious Martello classification
    score: 500
  - description: This benign heuristic indicates likelihood of file being benign
    filetype: "executable/windows"
    heur_id: 3
    name: Benign Martello classification
    score: 0

docker_config:
  image: ${REGISTRY}cccs/assemblyline-service-martello:$SERVICE_TAG
  cpu_cores: 1.0
  ram_mb: 8192