TheHive-Project / TheHive-Project/Cortex-Analyzers
[FR] Add analyzer for CIS MCAP
A pull request for this has already been merged.
- #1098 by @joeslazaro-cdw — merged
- Dominant language
- Python
- Stars
- 490
- Forks
- 405
- Avg merge
- 2d 43m
- Merged PRs (30d)
- 8
Description
Feature description
The Center for Internet Security (CIS) provides an API for their Malicious Code Analysis Platform (MCAP), a no-cost web-based sandbox. CIS is home to MS-ISAC (Multi State Information Sharing and Analysis Center) and EI-ISAC (Elections Infrastructure Information Sharing and Analysis Center). MCAP allows MS-ISAC and EI-ISAC members to submit suspicious files such as executables, DLLs, documents, quarantine files, and archives for analysis in a controlled and non-public fashion. The platform also enables users to perform threat analysis based on domain, IP address, URL, hashes, and various Indicators of Compromise (IOCs).
Describe the solution you'd like
I have a working analyzer for which I am preparing to submit a pull request.
Additional context
Reference: https://www.cisecurity.org/
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source files, tests, or entry points are named in the issue. Review merged pull request #1098 and the CIS reference first to understand the analyzer that was proposed; completion would mean confirming the MCAP analyzer is integrated and covered by the repository's existing expectations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 15/100