TheHive-Project / TheHive-Project/Cortex-Analyzers

[Bug] Impossible to link a mountpoint from the host to neurons

Open
#902 3 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

category:enhancement scope:cortex
Dominant language
Python
Stars
490
Forks
405
Avg merge
2d 43m
Merged PRs (30d)
8

Description

Describe the bug
Some analyzer needs some files provided from the host to be able to work properly

To Reproduce
Steps to reproduce the behavior:

  1. Share a folder from the host do docker container (ex: .yara_rule:/opt/yara_rules)
  2. Add some Yara rules to the folder
  3. Try to configurate and activate Yara 2.0
  4. Try to use the analyzer on a sample which should be detected using yara rules.
  5. See it showing no result found

Expected behavior
It should be possible to add extra share parameters to cortexneurons.

Complementary information
If applicable, add screenshots and any additional information that might help explain your problem.

Possible solutions
Being able to create a mount point that could be used by the cortexneurons.
For example, create a data_neurons and then put files and other needed by the cortexneurons form this folder.

Additional context
All analyzer or Responder needing a mount of a folder will fail.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the Docker configuration for cortexneurons and how analyzer or Responder mounts are passed through. Reproduce with a host share such as .yara_rule:/opt/yara_rules, configure Yara 2.0, and analyze a matching sample. Done means extra host shares are available to cortexneurons and mounted Yara rules produce the expected detection.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, python
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.