PDF/TXT Report

[kurgans0]

It will be good to have a formatted report (PDF and/or TXT).
It will available by download with a link on "Actions..." button.

Comment:
today, we can do a Print using the browser, but some bugs can appear (like missing icons to know the status)

[Rafiot]

That's a good idea, is there anything specific you'd like to have in the report? Or not have?

[kurgans0]

The two first, I think "c'est de base" for you but just in case...
1/ Easy for the user > just one click to download the report
2/ To have a complete report with sub-documents when the main item use the Extractor module.

The goal, this report should be used like a proof/evidence. Then it's good to have the context.
3/ Start the document with the final result (Clean/Suspicious/Malicious) and associated comment (like the webpage)
4/ At the end of document, to have the environment information:

• Report date (UTC?)
• Version/date of Pandora
• List of modules with name, version/date, last update of signature/AV, status
  5/ If Extractor module is used, maybe to have the possibility to have a "simple" report or a "full" report.
  For simple, to have light array with file name (+path? in case of zip), size, one hash (MD5), status, recommendation (short or truncated?)
  6/ Header: Custom report with company name and logo
  7/ Footer: to have a disclaimer (no warranty?)

And congrats for the job. I'm happy to implement now this tool in my job after to listen the podcast NoLimitSecu this spring.

[Rafiot]

Thank you! I'll see how I can implement that.

From the top of my head I see two approaches:

• The somewhat quick and dirty one, using WeasyPrint, which we're already using to generate previews. But it will only be able to dump whatever is on the web page, so you won't get any of the extracted contents or anything like that. Advantage: it can be added this week.
• The more long term solution: a markdown export that can then be converted to PDF (or any other format we can generate out of a markdown file). It will require to add that export to the main analysis report, and to every module. It's a lot more work and will definitely take somewhat longer, but will be easier to integrate with 3rd party tools, and allow you to edit the file before making the PDF for example.

I'll see if and how I can implement the 1st approach now because it is probably (?) pretty straightforward, and then look at the 2nd one early 2023.

[Rafiot]

Update: no, we cannot just throw the URL to weasyprint: most of the content is loaded by JS, which is then not accessible from the straight HTML response to a GET.

[Rafiot]

okay, so I changed a few things so when an analysis is done, it displays it immediately instead of relying on JS, which means weasyprint is kindof an option, but the rendering is really bad so I don't think it is the way to go.

[kurgans0]

Thanks for these first tests.

(Je réfléchis tout haut...)
What is the goal > to have a proof = a report, not a PDF.
Of course, if it's a PDF is nice, but your idea to create a MD is good.
But if it's a text file, it's easy to update manually.
Then maybe to add an electronic signature using the report and a private key.
I'm not an expert about signature and possible solution, but maybe it's possible to have the public key on the signature and to have a tool/script to authenticate the report (I hope it's clear...)