TheHive-Project / TheHive-Project/Cortex-Analyzers
[FR] SentinelOne Analyzer: Deep Visibility DNSRequest
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 490
- Forks
- 405
- Avg merge
- 2d 43m
- Merged PRs (30d)
- 8
Description
Feature description
I'm working on an S1 analyzer. It will use S1 Deep Visibility to find all IPs of systems that performed a DNS lookup for supplied domain. Usually a good place to start looking for possible compromise.
Describe the solution you'd like
Uses S1 API v2.1, multiple AP requests will be used:
- Create Query and Get ID
- Get Query Status (multiple times as needed)
- Get Events (multiple as needed)
Returned is a set of unique IPs (unless I find a more appropriate observable) that made a DNS lookup for the domain name provided.
Additional context
N/A
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or entry points are named. Start by locating the analyzer structure and confirming the SentinelOne API v2.1 query, status, and events flow; done means returning unique IP observables for systems that queried the supplied domain.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100