TheHive-Project / TheHive-Project/Cortex-Analyzers
[Improvement] Joe Sandbox Analyzer should pull a more detailed report from the JoeSandbox
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 490
- Forks
- 405
- Avg merge
- 2d 43m
- Merged PRs (30d)
- 8
Description
Feature description
I noticed the JoeSandbox analyzers pull the "irjsonfixed" report from the sandbox. This report is a strongly reduced version of the full sandbox report. It also lacks very important information. For example if a a file (like a .PDF) is corrupt and could not be analyzed it will show "0/100 clean" in TheHive and not even the "full report" in Cortex tells me that the analysis has come to an end when the file could not be opened.
Thats why I think the analyzer should parse its results from the "jsonfixed" report instead and display analysis errors in some way.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the Joe Sandbox analyzer entry points and inspect how they currently request and parse the "irjsonfixed" report. Compare that flow with the "jsonfixed" report and determine how analysis errors should be surfaced; the work is done when failed or corrupt-file analyses are distinguishable from clean results and the full report remains available.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100