Feature Request: Regional Storage of Malware Samples Due to Legislative Changes

[ociappara]

In response to evolving global legislative requirements regarding data storage, we propose the implementation of a feature to store samples across different cloud regions. This change will ensure compliance with local laws, and enhance data protection. The system should: Allow users to identify the appropriate cloud storage region through the UI & API, and the sample will be stored in the appropriate location.

[cccs-rs]

I think we can add region (or something similar to aws_region in the S3Transport) as a optional param to all the filestore transport types so we can associate storage to a "region". Perhaps we have to add something similar to FileSource if relevant?

And then on the API side, we can have an optional param region to specify the region the file should be saved to (region would have to be one of the regions that the system knows about based on the filestore configuration). In the UI, this could be a dropdown in the Options tab when submitting (maybe having a None value if specifying the region isn't important for the submission)

If you really want to enforce regional storage on the system, we can add a boolean flag in the configuration that specifies you have specify the location to store the file otherwise the API will respond with an error (this would also remove the None option in the UI).

[cccs-rs]

Thoughts?

[ociappara]

Apologies for the delay, yes this would be perfect! thank you. Along the same requirements, some samples should be deleted as soon as they are processed, at the moment we call the "purge" API. Maybe we could extend the ingest API with a parameter to purge the submitted file after analysis. Just root file not child nodes.