TheHive-Project / TheHive-Project/Cortex-Analyzers
[Bug] how to mount volume in analyzer docker container?
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 490
- Forks
- 405
- Avg merge
- 2d 43m
- Merged PRs (30d)
- 8
Description
Describe the bug
my issue is related to the closed #707
I seem to have the very same issue, running cortex 3.1.0 installed ubuntu package, and the analyzers as docker images.
I followed example here to create volume and git cloned the blocklists,
http://dockerlabs.collabnix.com/beginners/volume/creating-volume-mount-from-dockercli.html
However, when the analyzer runs, I get
{
"hits": [],
"count": 0
}
as the docker image doesn't mount it. Looking at the code, i guess that's expected when the analyzer doesn't find any of the iplist or netlist files.
As I run the cortex not as a docker container, there's no docker-compose to tweak.
I guess I'm missing the last step, wonder how to tell cortex to use/mount the given volume when starting up the analyzer. Any clue?
Expected behavior
I would like to be able to share a host folder/volume with cortex analyzer.
Work environment
- Client OS:
- Server OS: Ubuntu 20.04.2
- Browse type and version:
- Cortex version: 3.1.0-1 Ubuntu Packages
- Cortex Analyzer/Responder name: FireHOLBlocklists
- Cortex Analyzer/Responder version: 2.0
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Cortex 3.1.0 configuration and the Docker invocation for the FireHOLBlocklists analyzer, then compare the setup with the closed #707 issue. Verify whether the host folder or Docker volume is visible inside the analyzer and whether the blocklist files are detected; done means a host-mounted blocklist produces non-empty results.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, python
- Domain
- devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100