Set flow name at module-level

data/recipes/grr_yarascan.json

@@ -20,6 +20,7 @@
           "reason": "@reason",
           "process_ignorelist": "fleetspeak\\.exe|gagent\\.exe",
           "cmdline_ignorelist": null,
+          "dump_process_on_match": "@dump_process_on_match",
           "grr_server_url": "@grr_server_url",
           "grr_username": "@grr_username",
           "grr_password": "@grr_password",
@@ -34,6 +35,7 @@
     ["reason", "Reason for collection.", null],
     ["hostnames", "Hostname(s) to collect the flow from.", null, {"format": "grr_host", "comma_separated": true}],
     ["--yara_name_filter", "Filter to filter Yara sigs by.", null],
+    ["--dump_process_on_match", "Whether to dump the process on match.", false],
     ["--api_key", "API Key to the Yeti instance", null],
     ["--api_root", "API root of the Yeti instance (e.g. http://localhost/api/)", "http://localhost/api/", {"format": "url"}],
     ["--approvers", "Emails for GRR approval request.", null],

dftimewolf/lib/collectors/grr_hosts.py

@@ -400,6 +400,8 @@ class GRRYaraScanner(GRRFlow):
     "math.": "import \"math\"",
   }
 
+  FLOW_NAME = 'YaraProcessScan'
+
   # pylint: disable=arguments-differ
   def __init__(self,
                state: DFTimewolfState,
@@ -413,13 +415,15 @@ def __init__(self,
     self.rule_count = 0
     self._grouping = ''
     self.rule_names = ''
+    self.dump_process_on_match = False
 
   # pylint: disable=too-many-arguments
   def SetUp(self,
             reason: str,
             hostnames: str,
             process_ignorelist: str,
             cmdline_ignorelist: str,
+            dump_process_on_match: bool,
             grr_server_url: str,
             grr_username: str,
             grr_password: str,
@@ -473,6 +477,8 @@ def SetUp(self,
         self.ModuleError(
           f'Invalid regex for cmdline_ignorelist: {exception}', critical=True)
 
+    self.dump_process_on_match = dump_process_on_match
+
   def PreProcess(self) -> None:
     """Concatenates Yara rules into one stacked rule.
 
@@ -515,10 +521,10 @@ def Process(self, container: containers.Host
         ignore_grr_process=True,
         process_regex=self.process_ignorelist_regex,
         cmdline_regex=self.cmdline_ignorelist_regex,
-        dump_process_on_match=False
+        dump_process_on_match=self.dump_process_on_match,
       )
 
-      flow_id = self._LaunchFlow(client, 'YaraProcessScan', flow_args)
+      flow_id = self._LaunchFlow(client, self.FLOW_NAME, flow_args)
       self.logger.info(
         f'Launched flow {flow_id} on {client.client_id} ({grr_hostname})')
 

dftimewolf/lib/collectors/grr_hunt.py

@@ -463,7 +463,7 @@ def SetUp(self,
             cmdline_ignorelist: Union[List[str], str, None],
             dump_process_on_match: bool,
             ) -> None:
-    """Initializes a GRR Hunt Osquery collector.
+    """Initializes a GRR Yara Hunt collector.
 
     Args:
       reason: justification for GRR access.

tests/lib/collectors/grr_hosts.py

@@ -981,6 +981,7 @@ def testInitialization(self, unused_mock_InitHttp):
         hostnames='C.0000000000000001',
         process_ignorelist='.*',
         cmdline_ignorelist=None,
+        dump_process_on_match=False,
         grr_server_url='http://fake/endpoint',
         grr_username='user',
         grr_password='password',
@@ -999,6 +1000,7 @@ def testInitializeBadRegex(self, unused_mock_InitHttp):
           hostnames='C.0000000000000001',
           process_ignorelist='(((((((',
           cmdline_ignorelist=None,
+          dump_process_on_match=False,
           grr_server_url='http://fake/endpoint',
           grr_username='user',
           grr_password='password',
@@ -1037,6 +1039,7 @@ def testProcess(
         hostnames='C.0000000000000001',
         process_ignorelist='.*',
         cmdline_ignorelist=None,
+        dump_process_on_match=False,
         grr_server_url='http://fake/endpoint',
         grr_username='user',
         grr_password='password',
@@ -1102,6 +1105,7 @@ def testPreProcess(
         hostnames='C.0000000000000001',
         process_ignorelist='.*',
         cmdline_ignorelist=None,
+        dump_process_on_match=False,
         grr_server_url='http://fake/endpoint',
         grr_username='user',
         grr_password='password',