Example: triage

Inputs
Profile
Report outputs
- Triage report (converted from triage_report.json)
- CSV outputs

Inputs

examples/inputs/triage-samples/vulnerable_app.java

Profile

# Triage and Risk Scoring Example Profile
# Demonstrates triage report generation with risk scoring

decode = ["base64", "hex"]

max-file-size = 52428800  # 50 MiB

tag = "triage"

# High-risk patterns (higher weight in scoring)
[[patterns]]
  name = "Command Injection"
  pattern = "Runtime\\.getRuntime\\(\\)\\.exec\\("
  type = "regex"

[[patterns]]
  name = "SQL Injection"
  pattern = "(?i)(select|insert|update|delete|drop|union).*from"
  type = "regex"

[[patterns]]
  name = "Path Traversal"
  pattern = "\\.\\./\\.\\./\\.\\./"
  type = "regex"

[[patterns]]
  name = "Remote Code Execution"
  pattern = "eval\\s*\\([^)]*\\$"
  type = "regex"

# Medium-risk patterns
[[patterns]]
  name = "Hardcoded Password"
  pattern = "password\\s*=\\s*['\"][^'\"]{8,}['\"]"
  type = "regex"
  case-insensitive = true

[[patterns]]
  name = "API Key"
  pattern = "api[_-]?key\\s*=\\s*['\"][^'\"]{16,}['\"]"
  type = "regex"
  case-insensitive = true

# Signatures for risk scoring
[[signatures]]
  name = "High Entropy Suspicious"
  query = "SELECT sha256 FROM unique_files WHERE shannon_entropy > 7.5"

[[signatures]]
  name = "Multiple Pattern Matches"
  query = "SELECT sha256, COUNT(*) as matches FROM pattern_matches GROUP BY sha256 HAVING matches > 3"

Report outputs

Triage report (converted from triage_report.json)

total_files	1
critical_count	0
high_count	0
medium_count	0
low_count	0
minimal_count	1
must_investigate_count	0
generated_at	2025-12-03T09:19:44.871932886+00:00

top_scores

characteristics_score	file_type	file_type_score	must_investigate	path	pattern_count_score	pattern_matches	pattern_severity_score	reasons	risk_level	score	sha256
0	Other	0	False	/vulnerable_app.java	10	7	9	["7 suspicious patterns detected"]	Minimal	19	d72c3fd8cb250df27971c5ec01617f81fa34a607440f08c95f856570d69fd055

all_scores

characteristics_score	file_type	file_type_score	must_investigate	path	pattern_count_score	pattern_matches	pattern_severity_score	reasons	risk_level	score	sha256
0	Other	0	False	/vulnerable_app.java	10	7	9	["7 suspicious patterns detected"]	Minimal	19	d72c3fd8cb250df27971c5ec01617f81fa34a607440f08c95f856570d69fd055

CSV outputs

errors.csv

Empty CSV

files.csv

path	file_name	sha256	file_created	file_modified	file_accessed	mime_types_from_file_extension	is_symbolic_link	is_extracted_file	is_decoded_file	is_deobfuscated_file	tag
/vulnerable_app.java	vulnerable_app.java	d72c3fd8cb250df27971c5ec01617f81fa34a607440f08c95f856570d69fd055	2025-12-03T08:56:20.496889204Z	2025-12-03T08:56:20.496889204Z	2025-12-03T08:56:20.496889204Z	[]	0	0	0	0

pattern_matches.csv

id	sha256	pattern_name	match_type	match	location	length
1	d72c3fd8cb250df27971c5ec01617f81fa34a607440f08c95f856570d69fd055	Command Injection	regex	Runtime.getRuntime().exec(	7:8	26
2	d72c3fd8cb250df27971c5ec01617f81fa34a607440f08c95f856570d69fd055	SQL Injection	regex	SELECT * FROM	12:24	13
3	d72c3fd8cb250df27971c5ec01617f81fa34a607440f08c95f856570d69fd055	SQL Injection	regex	SELECT name FROM users UNION SELECT password FROM	14:25	49
4	d72c3fd8cb250df27971c5ec01617f81fa34a607440f08c95f856570d69fd055	Path Traversal	regex	../../../	19:33	9
5	d72c3fd8cb250df27971c5ec01617f81fa34a607440f08c95f856570d69fd055	Remote Code Execution	regex	eval($	30:8	6
6	d72c3fd8cb250df27971c5ec01617f81fa34a607440f08c95f856570d69fd055	Hardcoded Password	regex	PASSWORD = "SuperSecret123!"	24:35	28
7	d72c3fd8cb250df27971c5ec01617f81fa34a607440f08c95f856570d69fd055	API Key	regex	API_KEY = "sk-1234567890abcdefghijklmnop"	25:32	41

signature_matches.csv

id	signature_name	sha256
1	Multiple Pattern Matches	d72c3fd8cb250df27971c5ec01617f81fa34a607440f08c95f856570d69fd055

unique_files.csv

sha256	sha1	md5	file_size	mime_type_for_content	shannon_entropy
d72c3fd8cb250df27971c5ec01617f81fa34a607440f08c95f856570d69fd055	569213c480f1f16a4aee71518abb2fe52f5c11cf	74a23ade7caca99c1f48bd7cf2daff2f	1047	text/plain	4.83469776402311

Keyboard shortcuts

sus - Systematic Universal Scanner - Documentation