{"action":"opened","issue":{"url":"https://api.github.com/repos/threatgrid/naga/issues/85","repository_url":"https://api.github.com/repos/threatgrid/naga","labels_url":"https://api.github.com/repos/threatgrid/naga/issues/85/labels{/name}","comments_url":"https://api.github.com/repos/threatgrid/naga/issues/85/comments","events_url":"https://api.github.com/repos/threatgrid/naga/issues/85/events","html_url":"https://github.com/threatgrid/naga/issues/85","id":319700402,"number":85,"title":"[UI] Naga Rule Engine Use Cases","user":{"login":"saintx","id":711320,"avatar_url":"https://avatars1.githubusercontent.com/u/711320?v=4","gravatar_id":"","url":"https://api.github.com/users/saintx","html_url":"https://github.com/saintx","followers_url":"https://api.github.com/users/saintx/followers","following_url":"https://api.github.com/users/saintx/following{/other_user}","gists_url":"https://api.github.com/users/saintx/gists{/gist_id}","starred_url":"https://api.github.com/users/saintx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/saintx/subscriptions","organizations_url":"https://api.github.com/users/saintx/orgs","repos_url":"https://api.github.com/users/saintx/repos","events_url":"https://api.github.com/users/saintx/events{/privacy}","received_events_url":"https://api.github.com/users/saintx/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-05-02T20:28:28Z","updated_at":"2018-05-02T20:28:28Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"## Use Cases\r\n\r\n- [ ] If a domain serves up a link to known `Malicious` URL, flag that domain as `Suspicious`.\r\n- [ ] Sinkhole domains: If a domain resolves to a known sinkholed IP address, then mark the domain as suspicious. (make inferences about a node and produce a disposition)\r\n- [ ] Suggest a course of action:  If there is a file that has a `Malicious` disposition, but is not in AMP Protect DB, suggest that they add it to their AMP Simple Custom Detection.  If there is a *domain* that is `Malicious`, but OpenDNS does not have a `Malicious` verdict for it, suggest they block it in OpenDNS.  This demonstrates how to suggest a course of action for our (admittedly limited) response actions.\r\n\r\n## How to Get There\r\n- We need a better workbench for rules.\r\n- Direct import of the entities (bundles) that we get back from enrichment.\r\n- Dump in a subset of the module configurations, so we know which modules the user has.\r\n- For output, we have something in the results.  In the next stage, we can figure out how to wire it back into the UI.\r\n\r\n## Metrics\r\n- Above the results, output how many seconds or milliseconds the program takes to run.  Show how long the application of the rules to the axioms takes."}}
{"actor":{"display_login":"saintx"}}