cuckoobox/cuckoo — pull request #424 by gaelmuller (2014-12-11 13:50:16+00:00)
Title: Better Signatures

Adds two helpers in signatures: `Signature.add_match()` and `Signature.has_matches()` to simplify addition of matching data to the signature (no need to update `Signature.data` manually anymore). It is now easy to add one (or several !) match(es) to the Signature.

Also adds support for better display of matching data in the web interface. Simple example, displaying a dict:

![image](https://cloud.githubusercontent.com/assets/35897/5394940/a736f6a8-8143-11e4-9566-19753ad101ca.png)

Support for special type `'api'` to use with evented signatures, in order to extract the matching API calls. Example:

![image](https://cloud.githubusercontent.com/assets/35897/5394963/f40835be-8143-11e4-8008-b52592d60cbd.png)

The arrow on the right allows the user to jump directly at this API call in the Behavioral tab.

With this functionality, it was also obvious to implement a simple search in the Behavioral logs:

![image](https://cloud.githubusercontent.com/assets/35897/5395007/a92f4e32-8144-11e4-8146-87483818106a.png)

For this change to really mean something, I also updated every signature in the community repository to use this feature. This way, you can click on every signature with a high level of confidence that it will display the matching data. (PR to come)