Additional Filters to Allow/Prevent Observable Analysis

Request Type

Feature Request

Work Environment

Problem Description

With the recent addition of the Unshortenlink analyzer, the need for additional filters to allow or prevent certain observable analysis in complement of the TLP arose.

Indeed, using the Unshortenlink analyzer without extra caution might lead to unexpected consequences. For example, if the URL an analyst is seeking to unshorten is an attacker-controlled one, they may end up leaving undesired traces in the threat actor's infrastructure logs. The TLP values Cortex allows an orgAdmin to configure to prevent the use of an analyzer if the TLP associated with an observable is above the authorized level won't be of much help since Unshortenlink have to access the shortened URL.

Possible Solutions

It would be nice if Cortex supports additional configuration items that can be used by analyzers to allow or prevent observable analysis if:

• they begin with a certain pattern (begin with)
• they end with a certain pattern (end with)
• they contain a certain pattern (contain)
• they have a certain value (is)

By default the configuration item could be positioned to .*. It should also be possible to import a list of entries (whitelist / blacklist) from a text file for example.