Magika tag Karton service

Simply tag your samples with the calculated Makiga type and associated prediction score in percent.

The idea of using Magika with Karton comes from a question asked during the conference HA - Not "High Availability" but "Hunting Automation" at Pass-the-SALT 2024 by Xavier Mertens.

Consumes:

{
    "type": "sample",
    "kind": "raw"
},
{
    "type": "sample",
    "kind": "unrecognized"
}

Produce:

{
    "type": "sample",
    "stage": "recognized"
}

Usage

First of all, make sure you have setup the core system: https://github.com/CERT-Polska/karton

Do not forget to add your karton.ini in this folder. Then, simply install the Karton dependency and run it.

$ python3 -m venv venv && source venv/bin/activate
$ pip install -r requirements.txt
$ python3 karton-magika.py

Tadaaa it already exist ! Check the awesome karton-filetype by NtWriteCode.

I personnaly use the vanilla karton-classifier because I want to keep it light and I am only interested in the prediction score.