TheHive-Project / TheHive-Project/Cortex-Analyzers

[FR] New Analyzer: Axonius User & Device queries

Open
#733 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

category:feature-request
Dominant language
Python
Stars
490
Forks
405
Avg merge
2d 43m
Merged PRs (30d)
8

Description

Feature description
Axonius is an inventory management solution w/ visibility on all the users and devices in IR scope. It aggregates multiple adapters to create a complete view on an asset or user, and can be queried elsewhere for automated attribution & enrichment.

Describe the solution you'd like
The User model contains a username, email, and an array of managed devices, as well as other configurable fields like department, job title, and more.

We can think of these as translations from one of those data types to the other... Hypothetically, if we receive an alert that an email address attempted to exfiltrate data, it would be useful to translate that email address to a user name and device list, and visa versa.

Same applies with Devices... being able to translate a hostname to the user that manages it, ex. for the purpose of outreach.

Additional context

I have already created a proof of concept for private use levering the axonius_api_client, so if you assign this to me I can publicize it.

In our environment we've created custom Observable types hostname, username, and email for the purpose of these translations.... If this makes the solution too custom-tailored for broad utilization then reject the ticket.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Review the proposed Axonius User and Device translations and the referenced axonius_api_client proof of concept first. Confirm how the custom hostname, username, and email Observable types map to the requested queries, then define the supported scope and acceptance criteria; the work is done when the public analyzer behavior is agreed, implemented, and tested.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.