Currently, for a matched signature, we're exposing the following things -
- Identifier keywords / expression that caused a call to happen
- Caller Function node definition
- Callee function node definition (if available)
For examples like this -
classClass1:
defmethod1():
xyz(...)
With available match information for xyz function, we can easily get these values -
- definition of
method1 - identifier causing this match -
xyz
However, for use cases like malware analysis, it could be better to have more context about matched evidences
eg. method1 could have different meaning in Class1 and Class2
We should think about a way for consumer to get this information (maybe at multiple levels like, scope, function, class, file etc)
Currently, for a matched signature, we're exposing the following things -
For examples like this -
With available match information for xyz function, we can easily get these values -
method1xyzHowever, for use cases like malware analysis, it could be better to have more context about matched evidences
eg.
method1could have different meaning inClass1andClass2We should think about a way for consumer to get this information (maybe at multiple levels like, scope, function, class, file etc)