Skip to content

Commit

Permalink
Run yara rule downloads asynchronously
Browse files Browse the repository at this point in the history
This allows parallelizing download of multiple small files from github.
Cuts previous ~20 minute play time to ~5 minutes on a 8 core vagrant box
with `--forks 8` flag.

Downside is that ansible doesn't know if the rule has changed since last
download and we lose idempotency, i.e., every rule is listed as changed.
  • Loading branch information
jukuisma committed Apr 16, 2024
1 parent 1794cdf commit 0c97bc4
Showing 1 changed file with 12 additions and 4 deletions.
16 changes: 12 additions & 4 deletions tasks/clamav.yml
Original file line number Diff line number Diff line change
Expand Up @@ -315,7 +315,9 @@
owner: root
group: root
mode: '0644'
with_items:
async: 20 # Single yara rule download shouldn't take longer than this
poll: 0
loop:
- apt_aa19_024a.yar
- apt_alienspy_rat.yar
- apt_apt17_malware.yar
Expand Down Expand Up @@ -771,7 +773,9 @@
owner: root
group: root
mode: '0644'
with_items:
async: 20
poll: 0
loop:
- CobaltStrike__Resources_Command_Ps1_v2_5_to_v3_7_and_Resources_Compress_Ps1_v3_8_to_v4_x.yara
- CobaltStrike__Resources_Template_Py_v3_3_to_v4_x.yara
- CobaltStrike__Resources_Template_Sct_v3_3_to_v4_x.yara
Expand All @@ -789,7 +793,9 @@
owner: root
group: root
mode: '0644'
with_items:
async: 20
poll: 0
loop:
- Linux_Backdoor_Bash.yar
- Linux_Backdoor_Fontonlake.yar
- Linux_Backdoor_Generic.yar
Expand Down Expand Up @@ -1271,7 +1277,9 @@
owner: root
group: root
mode: '0644'
with_items:
async: 20
poll: 0
loop:
- https://raw.githubusercontent.com/Yara-Rules/rules/master/cve_rules/CVE-2010-0805.yar
- https://raw.githubusercontent.com/Yara-Rules/rules/master/cve_rules/CVE-2010-0887.yar
- https://raw.githubusercontent.com/Yara-Rules/rules/master/cve_rules/CVE-2010-1297.yar
Expand Down

0 comments on commit 0c97bc4

Please sign in to comment.