Highlights
- Fixed Travis CI configuration.
- New `store_samples` attachments post processing, to store samples on filesystem.
- Splitted Elasticsearch template for attachments and mails.
- Many fix to Elasticsearch template to upgrade at 6.x.
- Added whitelist to VirusTotal post processing.
- Storing analyzed mails in daily folders.
- Fixed many bugs.
:warning: Breaking Changes :warning:
- Changed main configuration file. All lists are under `list` key, so they are automatically loaded:
Attachments bolt configuration
attachments:
The lists of all components must be under lists keyword to load them
automatically
commons:
lists:
blacklist_content_types:
All content types to remove from results
Example in content_types/blacklist/generic.example.yml
generic: /path/to/generic_content_types
custom: /path/to/custom_content_types
not_extract_content_types:
All content types that you don't want extract from archive
Example: application/java-archive (jar), you can save the jar
but do not extract the class inside.
generic: /path/to/generic_content_types
custom: /path/to/custom_content_types