Reduce severity and confidence levels in mountpoints#539
Reduce severity and confidence levels in mountpoints#539kevross33 wants to merge 2 commits intoCAPESandbox:masterfrom
Conversation
Seems this alerts more than I anticipated in samples. I didn't overly see it outside bootkits and ransomware in testing against others but I was focused on specific samples. Until signature can be tightened or false positives/true positives confirmed dropping it to an info as still useful.
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses an issue where two Windows mount point discovery signatures were generating more alerts than anticipated. The changes reduce the severity and confidence levels of these signatures, effectively treating them as informational alerts. This adjustment aims to decrease noise until the signatures can be further refined to reduce false positives or confirm true positives more accurately. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request reduces the severity and confidence levels for the discover_registry_mount_points and mountpoints_volume_discovery signatures to decrease the number of alerts. This is a reasonable temporary measure given the high rate of false positives. I have suggested adding TODO comments to both updated signatures. This will serve as a reminder to re-evaluate these values once the signatures have been refined, improving the long-term maintainability of the code.
| severity = 1 | ||
| confidence = 20 |
There was a problem hiding this comment.
Given the PR description mentions these changes are temporary until the signature can be tightened, it would be beneficial to add a TODO comment. This will serve as a reminder for future developers to re-evaluate these values, improving code maintainability.
| severity = 1 | |
| confidence = 20 | |
| # TODO: Re-evaluate severity and confidence once the signature is tightened to reduce false positives. | |
| severity = 1 | |
| confidence = 20 |
| severity = 1 | ||
| confidence = 20 |
There was a problem hiding this comment.
Similar to the DiscoverRegistryMountPoints signature, it would be helpful to add a TODO comment here. This reflects that these values are temporary and should be revisited once the signature is improved to reduce false positives.
| severity = 1 | |
| confidence = 20 | |
| # TODO: Re-evaluate severity and confidence once the signature is tightened to reduce false positives. | |
| severity = 1 | |
| confidence = 20 |
1 participant
Seems this alerts more than I anticipated in samples. I didn't overly see it outside bootkits and ransomware in testing against others but I was focused on specific samples.
Until signature can be tightened or false positives/true positives confirmed dropping it to an info as still useful.