Feature Request: (Badlist) Show which badlist source was matched against in the heuristics.

[simonbjorzen-ts]

Feature Request: (Badlist) Show which badlist source was matched against in the heuristics.

[cccs-rs]

Should be part of the 4.5 release of Assemblyline:
https://github.com/CybercentreCanada/assemblyline/releases/tag/v4.5.0.stable1

[simonbjorzen-ts]

Perhaps the attribution field can be used for this?
I didn't see that before making this issue.

[cccs-rs]

We may not be able to show all the metadata associated to a badlist match in the way you described (in a single section) as the reasons can vary and can be classified at different levels, in which case we'd have to split up the reasoning as a subsection of the IOC hit (something we currently do now but the presentation can be improved).

In regards to metadata such as "Added On" (added) and "Last Updated" (updated), we can add that metadata for context since it's behind the classification of the badlist item itself but we aren't able to distinguish between when one source "added" the item vs another: we just know when it was added/updated to the system in general but not by whom:
https://github.com/CybercentreCanada/assemblyline-service-badlist/blob/0d1d22668d4a5e5fd609a68069a0c7263c09c80e/badlist/badlist.py#L118-L129