Skip to content
This repository was archived by the owner on Apr 11, 2026. It is now read-only.
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -46,5 +46,5 @@ RUN chmod 755 /usr/local/bin/capa

# ----------------------------------------------------------------------

# Default command if not run from docker-compose (and command being overidden)
# Default command if not run from docker-compose (and command being overridden)
CMD ["celery", "--app=openrelik_worker_capa.tasks", "worker", "--task-events", "--concurrency=1", "--loglevel=INFO"]
14 changes: 9 additions & 5 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,23 +1,27 @@
[![codecov](https://codecov.io/github/openrelik/openrelik-worker-capa/graph/badge.svg?token=mcoWTDgnQz)](https://codecov.io/github/openrelik/openrelik-worker-capa)

# Openrelik worker openrelik-worker-capa
# OpenRelik Worker: capa

## Description

Identify capabilities in executable files
This OpenRelik worker utilizes **capa** to identify capabilities in executable files.

**What is capa?**

Capa is an open-source tool developed by Mandiant (formerly FireEye) that detects capabilities in executable files. You run it against a PE file, ELF, shellcode, or .NET module, and it tells you what it thinks the program can do. For example, it might suggest that the file is a backdoor, can install services, or relies on HTTP to communicate. For more details, visit the [official capa repository](https://github.com/mandiant/capa).

## Deploy

Add the below configuration to the OpenRelik docker-compose.yml file.
To deploy this worker, add the following service configuration to your OpenRelik `docker-compose.yml` file:

```
```yaml
openrelik-worker-openrelik-worker-capa:
container_name: openrelik-worker-openrelik-worker-capa
image: ghcr.io/openrelik/openrelik-worker-openrelik-worker-capa:latest
restart: always
environment:
- REDIS_URL=redis://openrelik-redis:6379
- OPENRELIK_PYDEBUG=0
- OPENRELIK_PYDEBUG=0 # Set to 1 for debugpy remote debugging
volumes:
- ./data:/usr/share/openrelik/data
command: "celery --app=src.app worker --task-events --concurrency=4 --loglevel=INFO -Q openrelik-worker-openrelik-worker-capa"
Expand Down