TheHive-Project / TheHive-Project/Cortex-Analyzers

[Bug] OpenCTI Analyzer returns report on its own URL!

Open
#887 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

category:bug scope:analyzer status:waiting-for-reply
Dominant language
Python
Stars
490
Forks
405
Avg merge
2d 43m
Merged PRs (30d)
8

Description

Describe the bug
When I add a URL observable after having configured the OpenCTI_SearchObservable 1.0 and running the analysis the report that is returned is on the URL of OpenCTI, not the URL observable.

To Reproduce
Steps to reproduce the behavior:

  1. Configure the OpenCTI_SearchObservable analyzer with hxxp://opencti.my.domain.
  2. Add an observable: hxxp//suspicious.url.cc and run the analyzer
  3. It runs, correctly, and returns a result by the result is of the analysis of hxxp://opencti.my.domain.

Expected behavior
I expect the report to be about the observable URL.

Work environment

  • Client OS: Any
  • Server OS: Ubuntu 18.04
  • Browse type and version: Chrome
  • Cortex version: cortex/stable,now 3.0.1-1 all [installed]
  • Cortex Analyzer/Responder name: OpenCTI_SearchObservable (from GitHub)
  • Cortex Analyzer/Responder version: 1.0

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the OpenCTI_SearchObservable analyzer entry point and tracing how its configured OpenCTI URL and the submitted URL observable are passed into the analysis. Reproduce the report with the configuration and observable described in the issue, then verify that the returned report concerns the observable URL rather than the OpenCTI server URL.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.