Add Script Sentinel Docker image for malware analysis #41063
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Analyzes PowerShell, Bash, and JavaScript scripts - MITRE ATT&CK technique identification - IOC extraction and XDR context - Based on demisto/python3 Alpine image - Non-root user for security - Includes verification script - Poetry-based dependency management
|
Thanks for opening your first pull request. You are awesome! Questions about how we build Docker images? Make sure to checkout our README. What happens next?
Good luck to us all! |
- Remove test directories from tree-sitter-javascript and tree-sitter-powershell - Remove node_modules directories (not needed at runtime) - Update .gitignore to exclude test directories - Add requirements.txt for explicit dependency management This fixes the CI/CD pytest collection errors where test files were being discovered in the grammar subdirectories.
- Remove requirements.txt (should be auto-generated by build system) - Add requirements.txt to .gitignore - Poetry will generate requirements.txt during build from poetry.lock This follows the official Demisto dockerfiles build process where requirements.txt is generated from poetry.lock during CI/CD build.
- Supports XSIAM wrapper mode via 'xsiam-wrapper' argument - Supports CLI mode via 'analyze', '--help', or '-h' arguments - Allows arbitrary commands for Demisto build verification (e.g., 'which python') - Fixed line endings to LF (Unix) to prevent 'exec user process' errors
- Removed ENTRYPOINT to allow Demisto build verification to run commands directly - Removed USER sentinel directive to avoid permission issues during verification - The XSIAM integration will call xsiam_wrapper.py explicitly when needed - Keeps all application code and dependencies intact
- Added tree-sitter-language-pack to pyproject.toml dependencies - Removed poetry.lock to force regeneration with new dependency - This package is required by sentinel/parser.py for script parsing - Fixes ModuleNotFoundError during Docker image verification
- Updated tree-sitter from 0.21.3 to ^0.22.0 for compatibility with tree-sitter-language-pack - Regenerated poetry.lock with compatible dependencies - Resolves dependency conflict that prevented poetry lock generation
- Install gcc, musl-dev, python3-dev as virtual package - Required for compiling tree-sitter-language-pack C extensions - Clean up build deps after pip install to minimize image size
- Changed analyzer.py to use lazy import for ADK agent - ADK is now only imported when include_llm=True - Gracefully falls back to heuristics-only mode when ADK unavailable - Fixes ModuleNotFoundError: No module named 'google.adk' - Allows Docker image to work without optional LLM dependencies
Docker Image Ready - DevDocker automatic build has deployed your docker image: devdemisto/script-sentinel:1.0.0.5974178 Docker Metadata
|
- Changed python version constraint from ^3.11 to ~3.11 - Changed tree-sitter version constraint from ^0.22.0 to ~0.22.0 - Regenerated poetry.lock file with updated constraints - Demisto build system requires tilde notation for version constraints
Docker Image Ready - DevDocker automatic build has deployed your docker image: devdemisto/script-sentinel:1.0.0.5974625 Docker Metadata
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Status
Ready/In Progress/In Hold (Reason for hold)
Related Content Pull Request
Related PR: link to the PR at demisto/content
Related Issues
Related: link to the issue
Description
A few sentences describing the overall goals of the pull request's commits.