update rule syntax to support scope specification for dynamic analysis flavor #1539
Closed
4 tasks done
Labels
breaking-change
introduces a breaking change that should be released in a major version
dynamic
related to dynamic analysis flavor
enhancement
New feature or request
as described in #1517 (comment), update the rule syntax to support the rule metadata structure like:
this will require changes in a bunch of places, including:
this issue doesn't describe how capa uses the scope specifier - only that it can parse rules with this new syntax.
while this feature is in development, its ok to map rules with
rule.meta.scope: XXX
torule.meta.scope.static: XXX
andrule.meta.scope.dynamic: thread
. we can do a cleanup of the capa-rules once this feature works well.the PR should be accompanied by test cases that show what happen when invalid syntax is encountered, such as unknown scope names.
The text was updated successfully, but these errors were encountered: