TheHive-Project / TheHive-Project/Cortex-Analyzers

Mark specific Configuration Items as Secret

Open
#445 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

category:bug category:feature-request
Dominant language
Python
Stars
490
Forks
405
Avg merge
2d 43m
Merged PRs (30d)
8

Description

Feature description
Allow developers to flag a config item as "Secret" so that cortexutils can hide it in error messages.
Add the info in "How to Write and Submit an Analyzer" documentation.

Additional context
In some cases, an error in a Cortex-Analyzer code can reveal the API keys, like shown in the following image.

image

Complementary information
This is my config file

{
  "name": "FalconSearchIOC",
  "author": "Norgalades",
  "license": "AGPL-V3",
  "url": "https://github.com/",
  "version": "1.0",
  "description": "Check if an IOC (IP, domain or hash) has been seen in your CrowdStike environment.",
  "dataTypeList": ["ip", "hash", "domain"],
  "baseConfig": "FalconSearchIOC",
  "command": "FalconSearchIOC/falcon_search_IOC.py",
  "configurationItems": [
    {
      "name": "cs_api_off",
      "description": "Office api",
      "type": "string",
      "multi": false,
      "required": true
    },
    {
      "name": "cs_api_aff",
      "description": "Aff api",
      "type": "string",
      "multi": false,
      "required": true
    }
  ]
}

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the configurationItems section in the example configuration and read the “How to Write and Submit an Analyzer” documentation. Determine how a specific item can be marked Secret so cortexutils hides its value from error messages, then update that documentation and verify that API keys are no longer exposed.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
documentation, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.