add yara desription and name

plugins/feeds/public/otx_alienvault.py

@@ -9,6 +9,7 @@
 from core import taskmanager
 from core.config.config import yeti_config
 from core.schemas import entity, indicator, observable, task
+import yara
 
 
 class OTXAlienvault(task.FeedTask):
@@ -106,6 +107,19 @@ def analyze(self, item):
                     # sometimes the content is empty
                     if not otx_indic["content"]:
                         continue
+                    r = None
+                    try:
+                        r = yara.compile(source=otx_indic["content"])
+
+                    except Exception as e:
+                        logging.error(f"Error compiling YARA rule: {e}")
+                        continue
+
+                    for t in r:
+                        ind_obj.name = t.identifier
+                        if "description" in t.meta:
+                            ind_obj.description = t.meta["description"]
+
                     ind_obj.pattern = otx_indic["content"]
                     ind_obj.save()
                     investigation.link_to(ind_obj, "Observed", "OTXAlienVault")

pyproject.toml

@@ -24,6 +24,7 @@ authlib = "^1.2.1"
 itsdangerous = "^2.1.2"
 pyyaml = "^6.0.1"
 parameterized = "^0.9.0"
+yara-python = "^4.5.0"
 
 [tool.poetry.group.dev.dependencies]
 pylint = "^2.16.1"