Skip to content

score_process

Risk scoring entry points: how analyzer reports become a case verdict, and the final-score calculation.

processing

Mail, attachment, and IOC scoring pipeline.

logger = logging.getLogger(__name__) module-attribute

update_cases_logger = logging.getLogger('tasp.cron.update_ongoing_case_jobs') module-attribute

log_and_process(item, process_func, item_name, reports, total_scores, total_confidences, is_malicious, case_id)

compute_weighted_scores(reports, label)

Return (weighted_score, weighted_confidence, total_weight).

Raises ValueError when total_weight is zero so callers get a clear signal rather than (0, 0, 0) which looks like a legitimate result.

process_reports(analyzers_reports, mail_part, part_type, is_malicious)

Compute weighted score/confidence from a list of reports and write them onto mail_part.score / mail_part.confidence.

Returns (score, confidence). Raises ValueError when reports is empty or total weight is zero.

process_mail(mail, reports, total_scores, total_confidences, is_malicious, case_id)

process_mail_header(mail_header, reports, total_scores, total_confidences, is_malicious, case_id)

process_mail_body(mail_body, reports, total_scores, total_confidences, is_malicious, case_id)

process_ioc(ioc, ioc_type, reports, total_scores, total_confidences, is_malicious)

process_file_ioc(file_ioc, reports, total_scores, total_confidences, is_malicious, case_id)

Process a file IOC, combining linked-hash scores when present.

process_archive_ioc(file_ioc, reports, total_scores, total_confidences, is_malicious, case_id)

Process an archive file IOC — no linked-hash combination.

process_archive(archive, reports, total_scores, total_confidences, is_malicious, case_id)

process_attachment(attachment, reports, total_scores, total_confidences, is_malicious, case_id)

process_mail_artifact(artifact, reports, total_scores, total_confidences, is_malicious, case_id)

case_score_calculation

Final score calculation and result range classification.

ARTIFACT_DENY_LIST_SCORE = 10 module-attribute

ARTIFACT_DENY_LIST_CONFIDENCE = 100 module-attribute

IOC_DENY_LIST_SCORE = 10 module-attribute

IOC_DENY_LIST_CONFIDENCE = 100 module-attribute

IOC_DENY_LIST_LEVEL = 'critical' module-attribute

update_cases_logger = logging.getLogger('tasp.cron.update_ongoing_case_jobs') module-attribute

logger = logging.getLogger(__name__) module-attribute

ScoreLevel

Bases: Enum

SAFE = (0, 4) class-attribute instance-attribute

INFO = (5, 5) class-attribute instance-attribute

SUSPICIOUS = (6, 7) class-attribute instance-attribute

MALICIOUS = (8, 10) class-attribute instance-attribute

ResultRange

Bases: Enum

SAFE = (0, 4) class-attribute instance-attribute

SUSPICIOUS = (5, 7) class-attribute instance-attribute

DANGEROUS = (8, 10) class-attribute instance-attribute

get_score_level(score)

get_deny_listed_domains_set()

Return the union of deny-listed, campaign, and watcher domains. Issues a single SQL UNION query instead of three separate queries.