fix(signatures): use data action instead of command_execution (#299)

Signed-off-by: Antoine MAZEAS <antoine.mazeas@filigran.io>

Author: antoinemzs

pyoaev/signatures/models.py

@@ -208,7 +208,7 @@ def post_execution_update(self, tool_output: ToolOutput, now: datetime) -> None:
         else:
             self.execution_status = ExecutionStatus.EXECUTED
 
-        self.execution_action = InjectExecutionActions("command_execution")
+        self.execution_action = InjectExecutionActions("data")
 
 
 class SignatureCallbackPayload(BaseModel):

pyoaev/signatures/types.py

@@ -36,6 +36,7 @@ class InjectExecutionActions(str, Enum):
     DNS_RESOLUTION = "dns_resolution"
     FILE_EXECUTION = "file_execution"
     FILE_DROP = "file_drop"
+    DATA = "data"
     COMPLETE = "complete"
 
 

test/signatures/features/signature_manager_post_execution.feature

@@ -25,4 +25,4 @@ Feature: SignatureManager post-execution execution elements update
         And the end_time parameter in the execution details model is a datetime object
         And this end_time is chronologically greater than or equal to start_time "2024-06-26T06:00:00Z"
         And the execution_status parameter in the execution details model is equal to "EXECUTED"
-        And the execution_action parameter in the execution details model is equal to "command_execution"
+        And the execution_action parameter in the execution details model is equal to "data"