TheHive-Project / TheHive-Project/Cortex-Analyzers
Mark specific Configuration Items as Secret
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 490
- Forks
- 405
- Avg merge
- 2d 43m
- Merged PRs (30d)
- 8
Description
Feature description
Allow developers to flag a config item as "Secret" so that cortexutils can hide it in error messages.
Add the info in "How to Write and Submit an Analyzer" documentation.
Additional context
In some cases, an error in a Cortex-Analyzer code can reveal the API keys, like shown in the following image.

Complementary information
This is my config file
{
"name": "FalconSearchIOC",
"author": "Norgalades",
"license": "AGPL-V3",
"url": "https://github.com/",
"version": "1.0",
"description": "Check if an IOC (IP, domain or hash) has been seen in your CrowdStike environment.",
"dataTypeList": ["ip", "hash", "domain"],
"baseConfig": "FalconSearchIOC",
"command": "FalconSearchIOC/falcon_search_IOC.py",
"configurationItems": [
{
"name": "cs_api_off",
"description": "Office api",
"type": "string",
"multi": false,
"required": true
},
{
"name": "cs_api_aff",
"description": "Aff api",
"type": "string",
"multi": false,
"required": true
}
]
}
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the configurationItems section in the example configuration and read the “How to Write and Submit an Analyzer” documentation. Determine how a specific item can be marked Secret so cortexutils hides its value from error messages, then update that documentation and verify that API keys are no longer exposed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- documentation, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100