<extensionManifest><groupId>org.apache.nifi</groupId><artifactId>nifi-cybersecurity-nar</artifactId><version>1.22.0</version><systemApiVersion>1.22.0</systemApiVersion><buildInfo><tag>nifi-1.22.0-RC1</tag><branch>UNKNOWN</branch><revision>71e3ea9</revision></buildInfo><extensions><extension><name>org.apache.nifi.processors.cybersecurity.CompareFuzzyHash</name><type>PROCESSOR</type><description>Compares an attribute containing a Fuzzy Hash against a file containing a list of fuzzy hashes, appending an attribute to the FlowFile in case of a successful match.</description><tags><tag>hashing</tag><tag>fuzzy-hashing</tag><tag>cyber-security</tag></tags><properties><property><name>HASH_LIST_FILE</name><displayName>Hash List Source File</displayName><description>Path to the file containing hashes to be validated against</description><required>true</required><sensitive>false</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic><resourceDefinition><cardinality>SINGLE</cardinality><resourceTypes><resourceType>FILE</resourceType></resourceTypes></resourceDefinition></property><property><name>HASH_ALGORITHM</name><displayName>Hashing Algorithm</displayName><description>The hashing algorithm utilised</description><allowableValues><allowableValue><displayName>ssdeep</displayName><value>ssdeep</value><description>Uses ssdeep / SpamSum 'context triggered piecewise hash'.</description></allowableValue><allowableValue><displayName>tlsh</displayName><value>tlsh</value><description>Uses TLSH (Trend 'Locality Sensitive Hash'). Note: FlowFile Content must be at least 512 characters long</description></allowableValue></allowableValues><required>true</required><sensitive>false</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property><property><name>ATTRIBUTE_NAME</name><displayName>Hash Attribute Name</displayName><description>The name of the FlowFile Attribute that should hold the Fuzzy Hash Value</description><defaultValue>fuzzyhash.value</defaultValue><required>true</required><sensitive>false</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property><property><name>MATCH_THRESHOLD</name><displayName>Match Threshold</displayName><description>The similarity score must exceed or be equal to in order formatch to be considered true. Refer to Additional Information for differences between TLSH and SSDEEP scores and how they relate to this property.</description><required>true</required><sensitive>false</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property><property><name>MATCHING_MODE</name><displayName>Matching Mode</displayName><description>Defines if the Processor should try to match as many entries as possible (multi-match) or if it should stop after the first match (single)</description><defaultValue>single</defaultValue><allowableValues><allowableValue><displayName>single</displayName><value>single</value><description>Send FlowFile to matched after the first match above threshold</description></allowableValue><allowableValue><displayName>multi-match</displayName><value>multi-match</value><description>Iterate full list of hashes before deciding to send FlowFile to matched or unmatched</description></allowableValue></allowableValues><required>true</required><sensitive>false</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property></properties><relationships><relationship><name>failure</name><description>Any FlowFile that cannot be matched, e.g. (lacks the attribute) will be sent to this Relationship.</description><autoTerminated>false</autoTerminated></relationship><relationship><name>not-found</name><description>Any FlowFile that cannot be matched to an existing hash will be sent to this Relationship.</description><autoTerminated>false</autoTerminated></relationship><relationship><name>found</name><description>Any FlowFile that is successfully matched to an existing hash will be sent to this Relationship.</description><autoTerminated>false</autoTerminated></relationship></relationships><writesAttributes><writesAttribute><name>XXXX.N.match</name><description>The match that resembles the attribute specified by the &lt;Hash Attribute Name&gt; property. Note that: 'XXX' gets replaced with the &lt;Hash Attribute Name&gt;</description></writesAttribute><writesAttribute><name>XXXX.N.similarity</name><description>The similarity score between this flowfileand its match of the same number N. Note that: 'XXX' gets replaced with the &lt;Hash Attribute Name&gt;</description></writesAttribute></writesAttributes><supportsBatching>true</supportsBatching><eventDriven>true</eventDriven><sideEffectFree>true</sideEffectFree><inputRequirement>INPUT_REQUIRED</inputRequirement><seeAlso><see>org.apache.nifi.processors.cybersecurity.FuzzyHashContent</see></seeAlso></extension><extension><name>org.apache.nifi.processors.cybersecurity.FuzzyHashContent</name><type>PROCESSOR</type><description>Calculates a fuzzy/locality-sensitive hash value for the Content of a FlowFile and puts that hash value on the FlowFile as an attribute whose name is determined by the &lt;Hash Attribute Name&gt; property.Note: this processor only offers non-cryptographic hash algorithms. And it should be not be seen as a replacement to the HashContent processor.Note: The underlying library loads the entirety of the streamed content into and performs result evaluations in memory. Accordingly, it is important to consider the anticipated profile of content being evaluated by this processor and the hardware supporting it especially when working against large files.</description><tags><tag>hashing</tag><tag>fuzzy-hashing</tag><tag>cyber-security</tag></tags><properties><property><name>ATTRIBUTE_NAME</name><displayName>Hash Attribute Name</displayName><description>The name of the FlowFile Attribute that should hold the Fuzzy Hash Value</description><defaultValue>fuzzyhash.value</defaultValue><required>true</required><sensitive>false</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property><property><name>HASH_ALGORITHM</name><displayName>Hashing Algorithm</displayName><description>The hashing algorithm utilised</description><allowableValues><allowableValue><displayName>ssdeep</displayName><value>ssdeep</value><description>Uses ssdeep / SpamSum 'context triggered piecewise hash'.</description></allowableValue><allowableValue><displayName>tlsh</displayName><value>tlsh</value><description>Uses TLSH (Trend 'Locality Sensitive Hash'). Note: FlowFile Content must be at least 512 characters long</description></allowableValue></allowableValues><required>true</required><sensitive>false</sensitive><expressionLanguageSupported>false</expressionLanguageSupported><expressionLanguageScope>NONE</expressionLanguageScope><dynamicallyModifiesClasspath>false</dynamicallyModifiesClasspath><dynamic>false</dynamic></property></properties><relationships><relationship><name>success</name><description>Any FlowFile that is successfully hashed will be sent to this Relationship.</description><autoTerminated>false</autoTerminated></relationship><relationship><name>failure</name><description>Any FlowFile that is successfully hashed will be sent to this Relationship.</description><autoTerminated>false</autoTerminated></relationship></relationships><writesAttributes><writesAttribute><name>&lt;Hash Attribute Name&gt;</name><description>This Processor adds an attribute whose value is the result of Hashing the existing FlowFile content. The name of this attribute is specified by the &lt;Hash Attribute Name&gt; property</description></writesAttribute></writesAttributes><supportsBatching>true</supportsBatching><eventDriven>true</eventDriven><sideEffectFree>true</sideEffectFree><inputRequirement>INPUT_REQUIRED</inputRequirement><seeAlso><see>org.apache.nifi.processors.cybersecurity.CompareFuzzyHash</see><see>org.apache.nifi.processors.standard.HashContent</see></seeAlso></extension></extensions></extensionManifest>