Merge pull request #221 from opencybersecurityalliance/develop

v1.3.3

CHANGELOG.rst

@@ -6,6 +6,14 @@ All notable changes to this project will be documented in this file.
 
 The format is based on `Keep a Changelog`_.
 
+1.3.3 (2022-04-29)
+==================
+
+Fixed
+-----
+
+- Jupyter kernel crashing upon restart
+
 1.3.2 (2022-04-22)
 ==================
 

docs/overview/packages.rst

@@ -2,11 +2,10 @@ The entire Kestrel runtime consists of the following Python packages:
 
 - ``kestrel`` (repo: `kestrel-lang`_): The interpreter including parser,
   session management, code generation, data source and analytics interface
-  managers, and a command-line front end.
+  managers, and a command-line front-end.
 
-- ``firepit`` (repo: `firepit`_): The Kestrel internal data storage ingesting
-  data from data sources, caching related data, and linking records against
-  each Kestrel variable.
+- ``firepit`` (repo: `firepit`_): The Kestrel internal data storage ingesting,
+  processing, storing, caching, and linking data with Kestrel variables.
 
 - ``kestrel_datasource_stixshifter`` (repo: `kestrel-lang`_): The STIX-Shifter
   data source interface for managing data sources via STIX-Shifter.

docs/talks.rst

@@ -27,11 +27,11 @@ Campaigns With Kestrel`_. The live hunting demo explained the basics of Kestrel
 throughout the discovery of the hybrid cloud APT campaign developed for our
 Black Hat Europe 2021 session.
 
-Kestrel will be discussed at `SC Media eSummit on Threat Hunting & Offense
+Kestrel was discussed at `SC eSummit on Threat Hunting & Offense
 Security`_ in an interview session `The ABCs of Kestrel: How the threat-hunting
-language enables efficiencies & interoperability`_. The session will discuss
+language enables efficiencies & interoperability`_. The session discussed
 the history, mission, key idea, community, and stories of Kestrel for
-researchers, threat hunters, and enterprise executives to understand Kestrel.
+threat hunters, enterprise executives, and security researchers.
 
 .. _The Game of Cyber Threat Hunting\: The Return of the Fun: https://www.rsaconference.com/Library/presentation/USA/2021/The%20Game%20of%20Cyber%20Threat%20Hunting%20The%20Return%20of%20the%20Fun
 .. _small-enterprise APT hunting demo: https://www.youtube.com/watch?v=tASFWZfD7l8
@@ -47,5 +47,5 @@ researchers, threat hunters, and enterprise executives to understand Kestrel.
 .. _Infosec Jupyterthon 2021: https://infosecjupyterthon.com/2021/agenda.html
 .. _Reason Cyber Campaigns With Kestrel: https://www.youtube.com/embed/nMnHBnYfIaI?start=20557&end=22695
 
-.. _SC Media eSummit on Threat Hunting & Offense Security: https://www.scmagazine.com/esummit/automating-the-hunt-for-advanced-threats
+.. _SC eSummit on Threat Hunting & Offense Security: https://www.scmagazine.com/esummit/automating-the-hunt-for-advanced-threats
 .. _The ABCs of Kestrel\: How the threat-hunting language enables efficiencies & interoperability: https://www.scmagazine.com/esummit/automating-the-hunt-for-advanced-threats

setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = kestrel-lang
-version = 1.3.2
+version = 1.3.3
 description = Kestrel Threat Hunting Language
 long_description = file:README.rst
 long_description_content_type = text/x-rst

src/kestrel/session.py

@@ -55,6 +55,7 @@
 import time
 import math
 import lark
+import atexit
 from datetime import datetime
 from contextlib import AbstractContextManager
 
@@ -248,6 +249,8 @@ def __init__(
         iso_ts_regex = r"\d{4}(-\d{2}(-\d{2}(T\d{2}(:\d{2}(:\d{2}Z?)?)?)?)?)?"
         self._iso_ts = re.compile(iso_ts_regex)
 
+        atexit.register(self.close)
+
     def execute(self, codeblock):
         """Execute a Kestrel code block.
 
@@ -490,6 +493,9 @@ def close(self):
             else:
                 shutil.rmtree(self.runtime_directory)
 
+    def __exit__(self, exception_type, exception_value, traceback):
+        self.close()
+
     def _execute_ast(self, ast):
         displays = []
         new_vars = []
@@ -557,9 +563,6 @@ def _execute_ast(self, ast):
 
         return displays
 
-    def __exit__(self, exception_type, exception_value, traceback):
-        self.close()
-
     def _update_symbol_table(self, output_var_name, output_var_struct):
         self.symtable[output_var_name] = output_var_struct
         self.symtable[self.config["language"]["default_variable"]] = output_var_struct