TheHive-Project / TheHive-Project/Cortex-Analyzers
[Bug] OpenCTI Analyzer returns report on its own URL!
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 490
- Forks
- 405
- Avg merge
- 2d 43m
- Merged PRs (30d)
- 8
Description
Describe the bug
When I add a URL observable after having configured the OpenCTI_SearchObservable 1.0 and running the analysis the report that is returned is on the URL of OpenCTI, not the URL observable.
To Reproduce
Steps to reproduce the behavior:
- Configure the OpenCTI_SearchObservable analyzer with hxxp://opencti.my.domain.
- Add an observable: hxxp//suspicious.url.cc and run the analyzer
- It runs, correctly, and returns a result by the result is of the analysis of hxxp://opencti.my.domain.
Expected behavior
I expect the report to be about the observable URL.
Work environment
- Client OS: Any
- Server OS: Ubuntu 18.04
- Browse type and version: Chrome
- Cortex version: cortex/stable,now 3.0.1-1 all [installed]
- Cortex Analyzer/Responder name: OpenCTI_SearchObservable (from GitHub)
- Cortex Analyzer/Responder version: 1.0
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the OpenCTI_SearchObservable analyzer entry point and tracing how its configured OpenCTI URL and the submitted URL observable are passed into the analysis. Reproduce the report with the configuration and observable described in the issue, then verify that the returned report concerns the observable URL rather than the OpenCTI server URL.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100