TheHive-Project / TheHive-Project/Cortex
Add observable types to Responder dataTypeList
Nobody has claimed this yet.
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Description
Request Type
Feature Request
The list of responder actions in Hive can get quite large.
It would be really nice of you could specify which obeservable type a responder is supposed to be used for.
My suggestion is extending the dataTypeList with this option:
thehive:case_artifactType
In use it would look something like this.
thehive:case_artifactType:ip
thehive:case_artifactType:hash
This would allow Hive to only display responders for the correct data types, in this example, hash or ip.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the responder dataTypeList handling and the existing thehive:case_artifactType entries. Define how values such as thehive:case_artifactType:ip and :hash are parsed and used for responder visibility, then verify that only responders matching the observable type are displayed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- scala
- Domain
- backend-api-design
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100