Cortex to provide hashes from file observables to analyzers
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
Research direction
Start with the referenced VirusTotal analyzer at analyzers/VirusTotal/virustotal.py around the attachment.hashes lookup, then trace how Cortex passes parameters for observables with dataType "file". Done means analyzers receive the available file hashes during analysis, with the relevant behavior covered by existing tests if present.
Written by the indexing model from the issue text.
Description
Request Type
Feature Request
Cortex to provide hashes when analyzing an observable of dataType "file".
VirusTotal analyzer already look for these hashes:
hashes = self.get_param("attachment.hashes", None)
(see: https://github.com/TheHive-Project/Cortex-Analyzers/blob/master/analyzers/VirusTotal/virustotal.py#L258)
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from TheHive-Project/Cortex
-
Difficulty 4/5 3-5 days Newbie friendliness 52/100
TheHive-Project/Cortex#493 · 1 reaction ·
-
Difficulty 1/5 Under an hour Newbie friendliness 15/100
TheHive-Project/Cortex#486 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
TheHive-Project/Cortex#485 · 4 comments ·
-
Difficulty 1/5 Under an hour Newbie friendliness 55/100
TheHive-Project/Cortex#484 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
TheHive-Project/Cortex#483 · 1 reaction ·
All issues in TheHive-Project/Cortex
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
ergoplatform/ergodocs#614 ·
-
area:ci enhancement requires-triage
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
apache/datafusion-comet#6078 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
[VL] madvise(WILLNEED) call fails in MmapFileStream because of wrong calculation of fetching length Openbug triage
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
chipsalliance/rocket-chip#3831 ·