-
Notifications
You must be signed in to change notification settings - Fork 2
Open
Labels
Description
Should we add a bin with added dependencies like docopt or do this in a separate gem?
add a bin/stub to the gem for basic functionality?
sketch out some thing like with independent bins
metascan-online
metascan-hashlookup
metascan-etc
-or-
Use a single bin with deep commands like git
metascan online
metascan hashlookup
-c --config= [yaml config with api key, and server url]
--api-key= cleartext api key
-o --output-dir= location to store the json output file
[argv] list of files to submit
Hashlookup additional flags
`-f --file=
-h --hash= md5 sum
-i --ip= IP address
-u --url= URL address
/bin/metascan-online -c ~/.metascan scanthis.exe
/bin/metascan-hashlookup -c ~/.metascan -f scanthis.exe
/bin/metascan-hashlookup -c ~/.metascan -h 31b7b54dc4ec48c2b4aa35767cd9c402
/bin/metascan-hashlookup -c ~/.metascan -ip 10.0.0.1
/bin/metascan-hashlookup -c ~/.metascan -url www.google.com
Additional functions like
--request-rescan
Unix return code match "Definitions - Description of scan_result_i and scan_all_result_i"
https://metascan-online.com/en/public-api#/definitions
0 Clean No threat detection or the file is empty.
1 Infected/Known Threat is found.
2 Suspicious Classified as a possible threat but not identified as a specific threat.
3 Failed To Scan Scanning is not fully performed (e.g., invalid file or no read permission).
4 Cleaned Not Applicable.
5 Unknown Scan result does not exist (only for hash lookups).
6 Quarantined Not Applicable.
[..]