Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Yara CI config #434

Merged
merged 1 commit into from
May 14, 2024

Conversation

adepasquale
Copy link
Contributor

  1. Disable FP and FN checks as agreed with @kevoreilly
  2. Update or remove Yara strings that slow down scanning
  3. Add constraints to unlimited greedy regex in Yara

I can revert 2 and 3 if you'd rather keep some of these low-perf rules.

- Update or remove Yara strings that slow down scanning
- Add constraints to unlimited greedy regex in Yara
- Disable FP and FN checks
@r0ny123
Copy link
Contributor

r0ny123 commented May 9, 2024

why do you disable FP and FN check?

@adepasquale
Copy link
Contributor Author

There are literally thousands of matches, see https://github.com/adepasquale/CAPE-community/runs/24777647826 (capped to 1000). We agreed with @kevoreilly it would have been quicker to just skip them.

@adepasquale
Copy link
Contributor Author

That said, if you'd rather keep those checks I can attempt to build a bigger ignore list.

@kevoreilly
Copy link
Collaborator

Yeah the sheer number of FPs was ridiculous - but more than that, the prospect of changing the detections to remove the FPs whilst maintaining the same TP rate seems almost intractable. I think disabling is the most practical solution.

@kevoreilly kevoreilly merged commit 30a130d into CAPESandbox:master May 14, 2024
2 checks passed
@adepasquale adepasquale deleted the feature/yara-ci-config branch May 14, 2024 08:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants