TheHive-Project / TheHive-Project/Cortex-Analyzers
[Bug] Impossible to link a mountpoint from the host to neurons
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 490
- Forks
- 405
- Avg merge
- 2d 43m
- Merged PRs (30d)
- 8
Description
Describe the bug
Some analyzer needs some files provided from the host to be able to work properly
To Reproduce
Steps to reproduce the behavior:
- Share a folder from the host do docker container (ex: .yara_rule:/opt/yara_rules)
- Add some Yara rules to the folder
- Try to configurate and activate Yara 2.0
- Try to use the analyzer on a sample which should be detected using yara rules.
- See it showing no result found
Expected behavior
It should be possible to add extra share parameters to cortexneurons.
Complementary information
If applicable, add screenshots and any additional information that might help explain your problem.
Possible solutions
Being able to create a mount point that could be used by the cortexneurons.
For example, create a data_neurons and then put files and other needed by the cortexneurons form this folder.
Additional context
All analyzer or Responder needing a mount of a folder will fail.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the Docker configuration for cortexneurons and how analyzer or Responder mounts are passed through. Reproduce with a host share such as .yara_rule:/opt/yara_rules, configure Yara 2.0, and analyze a matching sample. Done means extra host shares are available to cortexneurons and mounted Yara rules produce the expected detection.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, python
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100