TheHive-Project / TheHive-Project/Cortex-Analyzers
New analyzer: HashScanner (NIST NSRL known-file lo
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 490
- Forks
- 405
- Avg merge
- 2d 43m
- Merged PRs (30d)
- 8
Description
Feature description
Add a new analyzer, HashScanner_NSRL, for the hash data type (MD5 / SHA-1 / SHA-256). It looks up an observable against the NIST National Software Reference Library (NSRL) via the HashScanner API and reports whether the file is known (cataloged in NSRL). This lets analysts filter known files out of a case and focus on the unknown. A match means the file is known — not a safe/clean/malicious verdict.
Describe the solution you'd like
A standard Cortex analyzer (Python + cortexutils) with:
- Flavor
HashScanner_NSRL(data typehash), API key configured per organization - A single taxonomy:
HashScanner:NSRL = Known/Unknown - Short and long report templates
Free API tier available (registration required). I have the analyzer ready (flavor JSON, program, requirements, report templates, in catalog format) and will open a PR against develop referencing this issue.
Additional context
HashScanner provides the NSRL online so teams don't have to download and maintain the ~700 GB Reference Data Set locally. Reference repo: https://github.com/hashscanner/hashscanner-cortex
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the prepared flavor JSON, program, requirements, report templates, and catalog-format files in the referenced hashscanner-cortex repository. Verify that the analyzer uses the HashScanner API for hash observables and produces the specified Known/Unknown taxonomy and short and long reports.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100