TheHive-Project / TheHive-Project/Cortex-Analyzers

[Bug] how to mount volume in analyzer docker container?

Open
#942 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
490
Forks
405
Avg merge
2d 43m
Merged PRs (30d)
8

Description

Describe the bug
my issue is related to the closed #707

I seem to have the very same issue, running cortex 3.1.0 installed ubuntu package, and the analyzers as docker images.
I followed example here to create volume and git cloned the blocklists,
http://dockerlabs.collabnix.com/beginners/volume/creating-volume-mount-from-dockercli.html

However, when the analyzer runs, I get


{
  "hits": [],
  "count": 0
}

as the docker image doesn't mount it. Looking at the code, i guess that's expected when the analyzer doesn't find any of the iplist or netlist files.

As I run the cortex not as a docker container, there's no docker-compose to tweak.

I guess I'm missing the last step, wonder how to tell cortex to use/mount the given volume when starting up the analyzer. Any clue?

Expected behavior
I would like to be able to share a host folder/volume with cortex analyzer.

Work environment

  • Client OS:
  • Server OS: Ubuntu 20.04.2
  • Browse type and version:
  • Cortex version: 3.1.0-1 Ubuntu Packages
  • Cortex Analyzer/Responder name: FireHOLBlocklists
  • Cortex Analyzer/Responder version: 2.0

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Cortex 3.1.0 configuration and the Docker invocation for the FireHOLBlocklists analyzer, then compare the setup with the closed #707 issue. Verify whether the host folder or Docker volume is visible inside the analyzer and whether the blocklist files are detected; done means a host-mounted blocklist produces non-empty results.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, python
Domain
devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.