TheHive-Project / TheHive-Project/Cortex-Analyzers
Analyzers: domain vs fqdn
@garanews is already working on this.
Since Dec 25, 2019.
- Dominant language
- Python
- Stars
- 490
- Forks
- 405
- Avg merge
- 2d 43m
- Merged PRs (30d)
- 8
Description
Request Type
Question
Description
Analyzing attributes with datatype "hostname" and "domain" in MISP:
domain
Page 1 of 1615, showing 60 records out of 96849 total, starting on record 1, ending on 60
hostname
Page 1 of 1393, showing 60 records out of 83522 total, starting on record 1, ending on 60
when imported in The Hive they become type "fqdn" and "domain".
In this situation the analyzers available for the 2 types are different:
But all the fqdn above mentioned can be analyzed with (almost?) all analyzers used for domain type.
Possible Solutions
In order to access to other analyzers (VT,etc), analyst is removing manually all fqdn imported and adds again as domain...
An option would be configure the "domain" analyzers to analyze also fqdn type.
What do you think?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.