AMIRA is an automatic service analysis in the OSXCollector files. Automated analysis is performed via OSXCollector output filters.
More specifically, with One Filter to Rule Them All. AMIRA takes care of retrieving the output files from an S3 bucket, running the analysis filter, and then uploading the analysis results back to the S3.
Architecture
The service uses S3 bucket event alerts to enable resolution. You will need to configure an S3 bucket for the OSXCollector output files so that when a file is added there, the notification will be sent to a series of SQS (AmiraS3EventNotifications in the image below).
AMIRA periodically checks the queue for any new messages and during λήψη of will get the OSXCollector output file from the S3 bucket. It will then run the parsing filter on the recovered file.
The analysis filter sequentially executes all the filters contained in the packet OSXCollector output filters. Some of them communicate with external resources such as hashes and use Intel API threat engines, e.g. VirusTotal, OpenDNS Investigate or ShadowServer.
The initial output of OSXCollector extends to all of these information and the last filter run by the analysis filter summarizes all the findings in human-readable form. Once the filter is complete, the analysis results will be loaded into the S3 results analysis bucket
Information about the installation and the use of the program, you will find here.