[Feature Request] TheHive 4 Orgs associated with Cortex3 Orgs (one instance)

Request Type

Feature Request

Work Environment

Problem Description

Instead of associate an organizations from TheHive4 to an instance of Cortex, be possible to associate to an organization of cortex: Eg:

TheHive:
OrgTH1
OrgTH2

Cortex:
OrgC1
OrgC2

OrgTH1 -> OrgC1
OrgTH2 -> OrgC2

Instead of:

OrgTH1 -> Cortex1(OrgC1)
OrgTH2 -> Cortex2(OrgC2)

In production is not practical to have multiple cortex, so i can have different analyzers an responders in each one.

Steps to Reproduce

1. Create two org in Thehive4
2. Create two org in Cortex3
3. try to associate them, without adding another cortex instance, or creating multi instances in app conf pointing to the same. :)

Possible Solutions

Add an option in application.conf to associate an organization from thehive4 to different organization of the same instance of cortex.

Complementary information

play.modules.enabled += org.thp.thehive.connector.cortex.CortexModule
cortex {
  servers = [
    {
      name = local
      url = "http://localhost:9001"
      auth {
        type = "bearer"
        key = "[REDACTED]"
      }
      # HTTP client configuration (SSL and proxy)
      #  wsConfig {}
     # List TheHive organisation which can use this Cortex server. All ("*") by default
     includedTheHiveOrganisations = ["*"]
     # List TheHive organisation which cannot use this Cortex server. None by default
     # excludedTheHiveOrganisations = []
    }
  ]
  # Check job update time intervalcortex
  refreshDelay = 5 seconds
  # Maximum number of successive errors before give up
  maxRetryOnError = 3
  # Check remote Cortex status time interval
  statusCheckInterval = 1 minute
}

to be something like:

...
includedTheHiveOrganisations = ["
                                                       OrgTH1:OrgC1,
                                                       OrgTH2:OrgC2
                                                      "]
...

Start with the CortexModule configuration in application.conf, especially the cortex.servers organization filters. Trace how TheHive organizations are associated with a Cortex server and how the proposed OrgTH1:OrgC1 mappings would be represented. Done means separate TheHive organizations can target different Cortex organizations on one instance without adding another server entry.