savory’s url view
savory’s primary view into the URL database is the URL module. Here’s a snapshot of what a portion of it looks like
From this view you can move back and forth through the url list. Some pieces of information about each URL are also displayed to the end user. In the above screenshot you can see
- Snapshot of the webpage at the time it was recorded by savory
- URL of the malware
- Account which inserted the malware into savory (the bold text after “via”)
- The time that the url was inserted
- The tags that are associated with the URL. These include tags specified by the source doing the insert as well as auto-tagging functionality built into savory
- A summary list of tags. The list is interpreted as all tags on the current page you’re viewing and the number of urls that have that tag.
Some other tidbits that you can see are the links next to each tag in the tag summary.
By clicking the “+” sign, you append that tag to your search criteria, narrowing the list of URLs returned by savory. By clicking on the name of the tag, you clear out your current search criteria and start with just that one tag
As you narrow the tag criteria, the interface changes as shown below.
Selected tags are highlighted and moved to the end of the line. You’ll also notice that the number of urls savory returned is substantially less (only a single URL).
Note though that the tag summary to the right has not changed much. What the tag summary is telling you is that there are 5 URLs tagged “ssdfsdf…”, 5169 URLs tagged “unknown_html”, etc.
These numbers will likely exceed the total number of URLs in savory because multiple tags can be applied to any given URL. This summary is meant to be a gauge to the admin of how general or specific a specific tag is in relation to the system as a whole.