Input problem with Custom Analyzer
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 42/100
Research direction
Start by reproducing the issue with a Service Interaction File using regexp and the example input, then compare the submitted and transformed values. Trace how Cortex handles analyzer input before the request reaches Urlscan_io_Search_0_1_1 or OpenCTI_SearchObservables_2_0. Done means backslashes in regexp input are preserved without extra escaping and the behavior is verified for both analyzers.
Written by the indexing model from the issue text.
Description
Describe the bug
I am trying to edit an existing cortex analyzer (Urlscan_io_Search_0_1_1) to add a new feature. I want to add to this existing analyzer an extra option for a regex based search through Urlscan's capability to search using URL keyword regex. The issue raises when I use a "" character and cortex adds an extra "" character.
To Reproduce
Steps to reproduce the behavior:
Create or edit an analyzer and use as datatype regexp in Service Interaction File.
Use the analyzer and give as an input a regex with "" character in. For example "http://domain.test"
Then the cortex will change the regex into "http\:\/\/domain\.test"
Expected behavior
In this occasion we will expect to use "" character as it is without cortex adding an extra "" character".
The same problem rises when running OpenCTI_SearchObservables_2_0 analyzer with regexp option.
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from TheHive-Project/Cortex
-
Difficulty 4/5 3-5 days Newbie friendliness 52/100
TheHive-Project/Cortex#493 · 1 reaction ·
-
Difficulty 1/5 Under an hour Newbie friendliness 15/100
TheHive-Project/Cortex#486 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
TheHive-Project/Cortex#485 · 4 comments ·
-
Difficulty 1/5 Under an hour Newbie friendliness 55/100
TheHive-Project/Cortex#484 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
TheHive-Project/Cortex#483 · 1 reaction ·
All issues in TheHive-Project/Cortex
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
ergoplatform/ergodocs#614 ·
-
area:ci enhancement requires-triage
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
apache/datafusion-comet#6078 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
[VL] madvise(WILLNEED) call fails in MmapFileStream because of wrong calculation of fetching length Openbug triage
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
chipsalliance/rocket-chip#3831 ·