score_process¶
Risk scoring entry points: how analyzer reports become a case verdict, and the final-score calculation.
processing
¶
Mail, attachment, and IOC scoring pipeline.
logger = logging.getLogger(__name__)
module-attribute
¶
update_cases_logger = logging.getLogger('tasp.cron.update_ongoing_case_jobs')
module-attribute
¶
log_and_process(item, process_func, item_name, reports, total_scores, total_confidences, is_malicious, case_id)
¶
compute_weighted_scores(reports, label)
¶
Return (weighted_score, weighted_confidence, total_weight).
Raises ValueError when total_weight is zero so callers get a clear signal rather than (0, 0, 0) which looks like a legitimate result.
process_reports(analyzers_reports, mail_part, part_type, is_malicious)
¶
Compute weighted score/confidence from a list of reports and write them onto mail_part.score / mail_part.confidence.
Returns (score, confidence). Raises ValueError when reports is empty or total weight is zero.
process_mail(mail, reports, total_scores, total_confidences, is_malicious, case_id)
¶
process_mail_header(mail_header, reports, total_scores, total_confidences, is_malicious, case_id)
¶
process_mail_body(mail_body, reports, total_scores, total_confidences, is_malicious, case_id)
¶
process_ioc(ioc, ioc_type, reports, total_scores, total_confidences, is_malicious)
¶
process_file_ioc(file_ioc, reports, total_scores, total_confidences, is_malicious, case_id)
¶
Process a file IOC, combining linked-hash scores when present.
process_archive_ioc(file_ioc, reports, total_scores, total_confidences, is_malicious, case_id)
¶
Process an archive file IOC — no linked-hash combination.
process_archive(archive, reports, total_scores, total_confidences, is_malicious, case_id)
¶
process_attachment(attachment, reports, total_scores, total_confidences, is_malicious, case_id)
¶
process_mail_artifact(artifact, reports, total_scores, total_confidences, is_malicious, case_id)
¶
case_score_calculation
¶
Final score calculation and result range classification.
ARTIFACT_DENY_LIST_SCORE = 10
module-attribute
¶
ARTIFACT_DENY_LIST_CONFIDENCE = 100
module-attribute
¶
IOC_DENY_LIST_SCORE = 10
module-attribute
¶
IOC_DENY_LIST_CONFIDENCE = 100
module-attribute
¶
IOC_DENY_LIST_LEVEL = 'critical'
module-attribute
¶
update_cases_logger = logging.getLogger('tasp.cron.update_ongoing_case_jobs')
module-attribute
¶
logger = logging.getLogger(__name__)
module-attribute
¶
ScoreLevel
¶
ResultRange
¶
get_score_level(score)
¶
get_deny_listed_domains_set()
¶
Return the union of deny-listed, campaign, and watcher domains. Issues a single SQL UNION query instead of three separate queries.