TheHive-Project / TheHive-Project/Cortex
Custom observables for custom analyzers
Nobody has claimed this yet.
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Description
Custom/Generic Observables field
Request Type
Feature Request
Work Environment
| Question | Answer |
|---|---|
| Cortex version / git hash | 3.0.1, 643b72aa0f94716151998b0ca04214066b207958 |
Description
This request was asked here but adding it again here will be helpful.
At times we would need to add analyzers that would perform very specific task for which observables will not be of the provided types. For example: Cloud Account ID/ User ID to check for unauthorised access in logs.
An additional observable with dynamic type would be helpful in such scenarios. The analyzers that we create would specify the type. This might not be useful for tagging observables to analyzers but will be helpful for devs looking to create their own observable type and analyzers.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named. Start by tracing Cortex's observable type handling and analyzer input declarations; done means custom analyzers can declare and process dynamic observable types such as cloud account or user IDs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- scala
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100