service_manifest.yml

name: Safelist
version: $SERVICE_TAG
description: This service will check the file hashes against Assemblyline's internal safelist infrastructure and mark files as safe accordingly.

accepts: .*
rejects: empty|metadata/.*

stage: FILTER
category: Filtering

file_required: false
timeout: 10
disable_cache: false
privileged: true

enabled: true

config:
  cache_timeout_seconds: 1800
  lookup_md5: false
  lookup_sha1: true
  lookup_sha256: true
  trusted_distributors:
    - "^Apple.*"
    - "^Microsoft.*"
    - "^Google.*"
    - "^Canonical.*"
    - "^Red Hat.*"
    - "^Oracle.*"
docker_config:
  image: ${REGISTRY}cccs/assemblyline-service-safelist:$SERVICE_TAG
  cpu_cores: 0.4
  ram_mb: 256

heuristics:
  - heur_id: 1
    name: Safelisted by external source
    score: -1000
    filetype: "*"
    description: Hash is found in an external source of know good files
  - heur_id: 2
    name: Safelisted by user
    score: -1000
    filetype: "*"
    description: A user of this system found this file to be safe

dependencies:
  updates:
    container:
      allow_internet_access: true
      command: ["python", "-m", "safelist.update_server"]
      image: ${REGISTRY}cccs/assemblyline-service-safelist:$SERVICE_TAG
      ports: ["5003"]
      # Upper-bound, adjust based on sources
      cpu_cores: 2
      ram_mb: 4096
    run_as_core: True

update_config:
  update_interval_seconds: 86400
  wait_for_update: false
  generates_signatures: false
  sources:
    []
    # We will not force a safelist onto our users.
    # Here are examples of NSRL sources that are working with the updater:
    # - name: NSRL_modern
    #   pattern: RDS_${QUARTERLY}_modern_minimal/RDS_${QUARTERLY}_modern_minimal.db
    #   uri: https://s3.amazonaws.com/rds.nsrl.nist.gov/RDS/rds_${QUARTERLY}/RDS_${QUARTERLY}_modern_minimal.zip
    # - name: NSRL_legacy
    #   pattern: RDS_${QUARTERLY}_legacy_minimal/RDS_${QUARTERLY}_legacy_minimal.db
    #   uri: https://s3.amazonaws.com/rds.nsrl.nist.gov/RDS/rds_${QUARTERLY}/RDS_${QUARTERLY}_legacy_minimal.zip
    # - name: NSRL_android
    #   pattern: RDS_${QUARTERLY}_android_minimal/RDS_${QUARTERLY}_android_minimal.db
    #   uri: https://s3.amazonaws.com/rds.nsrl.nist.gov/RDS/rds_${QUARTERLY}/RDS_${QUARTERLY}_android_minimal.zip
    # - name: NSRL_ios
    #   pattern: RDS_${QUARTERLY}_ios_minimal/RDS_${QUARTERLY}_ios_minimal.db
    #   uri: https://s3.amazonaws.com/rds.nsrl.nist.gov/RDS/rds_${QUARTERLY}/RDS_${QUARTERLY}_ios_minimal.zip