precursor 0.2.3

Pre-protocol payload tagging, similarity clustering, and packet/firmware triage CLI.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69

{
  "---PRECURSOR_STATISTICS---": "This JSON is output to STDERR so that you can parse stats separate from the primary output.",
  "Input": {
    "Count": 10,
    "Unique": 10,
    "AvgSize": "108",
    "MinSize": 86,
    "MaxSize": 307,
    "P95Size": 86,
    "TotalSize": "1.06KB"
  },
  "Match": {
    "Patterns": 5,
    "TotalMatches": 30,
    "Matches": [
      {
        "Name": "exploit_class_path",
        "Matches": 9
      },
      {
        "Name": "ldap_scheme",
        "Matches": 1
      },
      {
        "Name": "java_user_agent",
        "Matches": 9
      },
      {
        "Name": "urlencoded_jndi",
        "Matches": 1
      },
      {
        "Name": "http_method",
        "Matches": 10
      }
    ],
    "HashesGenerated": 10,
    "AvgSize": "108",
    "MinSize": 86,
    "MaxSize": 307,
    "P95Size": 307,
    "TotalSize": "3.17KB"
  },
  "Compare": {
    "Similarities": 45,
    "AvgDistance": "40",
    "MinDistance": 19,
    "MaxDistance": 77,
    "P95Distance": 76
  },
  "Environment": {
    "Version": "0.2.1",
    "DurationSeconds": "0.00",
    "ProcessingRate": "1.06KB/ms",
    "SimilarityMode": "lzjd",
    "RegexEngine": "pcre2",
    "InputMode": "string",
    "HashFunction": "48_1",
    "DistanceThreshold": 100,
    "DiffEnabled": true,
    "OnlyOutputSimilar": false,
    "LengthEnabled": false,
    "InputJSONKey": "",
    "SinglePacketInference": true,
    "AbstainThreshold": 0.65,
    "ProtocolTopK": 3,
    "SigmaRulesLoaded": 0
  }
}