Lobotomizing 'troublesome' signatures via custom rulesets aka removing false positives

[munntjlx]

I have looked and there doesnt' seem to be a filtering mechanism. "Custom" Rules are mentioned as being able to override 'default' rulesets. What I don't know how to do is 'export' the default rulesets and then specify them when running scans. I want to 'filter out' specific' problematic rules to reduce our workload PRE processing. Is there a methodology for doing 'custom' exports of default rulesets, and then lobotomizing the rulesets I don't like?

[munntjlx]

In response to my own question, it DOES look like I could 'lobotimize' the binary itself:

https://github.com/praetorian-inc/noseyparker/blob/main/crates/noseyparker/data/default/builtin/rulesets/default.yml

Just remove the ones I no longer want in conciousness.

[bradlarsen]

@munntjlx Yeah, there's not a great way of dumping the current built-in rulesets to the YAML format. As you discovered, copying the default.yml ruleset from the source repo and modifying as you see fit is a good way to go.

I am curious which rules you end up disabling...

[munntjlx]

Generic password quoted and double quoted

[munntjlx]

My method was FAR less elegant, remove the rules from the PRIMARY file and recompile!

[bradlarsen]

Gotcha. Yes, one would wish for a simpler method of overriding the default set of rules!

[munntjlx]

Honestly, since you (praetorian) don't want to be amazonized/microsoftized (aka they steal your nice progam and make it a service) Inconvenience is a selling point. It keeps you 'cloud proof' in that if you want customizations etc. you need to pay. I think this is perfectly reasonable for an open sourced program to give SOMETHING to the community without giving it to the superscalers.

[munntjlx]

so my new 'default' is the lobotomized one