Skip to content
This repository has been archived by the owner on Mar 15, 2021. It is now read-only.

Commit

Permalink
one more...
Browse files Browse the repository at this point in the history
  • Loading branch information
brifordwylie committed Jun 21, 2014
1 parent daa993d commit c3039f2
Showing 1 changed file with 10 additions and 8 deletions.
18 changes: 10 additions & 8 deletions clients/pe_indexer.py
Expand Up @@ -3,8 +3,8 @@
import os
import pprint

def main():

def main():

parser = argparse.ArgumentParser()
parser.add_argument('-p', '--port', type=int, default=4242, help='port used by workbench server')
Expand All @@ -18,9 +18,10 @@ def main():
for filename in file_list:

# Skip OS generated files
if '.DS_Store' in filename: continue
if '.DS_Store' in filename:
continue

with open(filename,'rb') as file:
with open(filename, 'rb') as file:
md5 = c.store_sample(filename, file.read(), 'pe')

# Index the strings and features output (notice we can ask for any worker output)
Expand All @@ -37,7 +38,7 @@ def main():
# Now actually do something interesing with our ELS index
# ES Facets are kewl (http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-facets.html)
facet_query = '{"facets" : {"tag" : {"terms" : {"field" : "string_list"}}}}'
results = c.search('strings',facet_query)
results = c.search('strings', facet_query)
try:
print '\nQuery: %s' % facet_query
print 'Number of hits: %d' % results['hits']['total']
Expand All @@ -46,15 +47,16 @@ def main():
except TypeError:
print 'Probably using a Stub Indexer, if you want an ELS Indexer see the readme'


# Fuzzy is kewl (http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-fuzzy-query.html)
fuzzy_query = '{"fields":["md5","sparse_features.imported_symbols"],"query": {"fuzzy" : {"sparse_features.imported_symbols" : "loadlibrary"}}}'
results = c.search('pe_features',fuzzy_query)
fuzzy_query = '{"fields":["md5","sparse_features.imported_symbols"],' \
'"query": {"fuzzy" : {"sparse_features.imported_symbols" : "loadlibrary"}}}'
results = c.search('pe_features', fuzzy_query)
try:
print '\nQuery: %s' % fuzzy_query
print 'Number of hits: %d' % results['hits']['total']
print 'Max Score: %f' % results['hits']['max_score']
pprint.pprint([ (hit['fields']['md5'], hit['fields']['sparse_features.imported_symbols']) for hit in results['hits']['hits'] ])
pprint.pprint([(hit['fields']['md5'], hit['fields']['sparse_features.imported_symbols'])
for hit in results['hits']['hits']])
except TypeError:
print 'Probably using a Stub Indexer, if you want an ELS Indexer see the readme'

Expand Down

0 comments on commit c3039f2

Please sign in to comment.