Malware Name Mapping
====================

This script fetches the current mapping file from the [Malware Name Mapping repository](https://github.com/certtools/malware_name_mapping/raw/master/mapping.csv) and converts it to the syntax needed by the modify expert.
It expects a comma-separated file and uses the first column as regular expression and the second one as family name. Other URLs can be given as parameter.
The resulting configuration sets the field `classification.identifier` to the malware family name corresponding to the given `malware.name`.

By default, the result is printed to stdout, a filename can be given as parameter.

For more information about the mapping project, have a look at the [Malware Name Mapping repository](https://github.com/certtools/malware_name_mapping).

See also the built-in help of the script by calling it with `-h`.

Additional optional rules
----------------

### Matching the family name

Rules that also match the family name itself can be added with the flag `-f`.
This is useful if the feeds already use common malware names and the field `classificaion.identifier` should be filled.

### Default rule

A default rule can optionally be added the the end of the rules with the `-d` flag.
With this rule, the field `classification.identifier` is set to `malware.name` if the first is empty and the latter is not.
As this is the last rule, it is kind of "last resort" to fill the identifier field.

Modify Bot
----------

Use the Modify bot to apply the ruleset by using the generated file as configuration. Also, deactivate the case sensitivity of the bot.

Automation
----------

You can use a crontab-entry like this:
```
0  1  *      *   *   /path/to/contrib/malware_name_mapping/download_mapping.py /opt/intelmq/var/lib/bots/modify/malware-family-names.conf && intelmqctl reload malware-family-name-expert
```
You can check the validity of the resulting rule file with `intelmqctl check`.
