TheHive-Project / TheHive-Project/Cortex
Cortex worker definitions are not updated/refreshed to include dockerImage
Open
Nobody has claimed this yet.
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Description
Request Type
Bug
Work Environment
| Question | Answer |
|---|---|
| OS version (server) | Ubuntu 18.04 LTS |
| OS version (client) | not relevant |
| Cortex version / git hash | 3.1.1-1 |
| Package Type | Debian package |
| Browser type & version | not relevant |
Problem Description
Migrating from Process-type to Docker-type workers (analyzers & responders) aka neurons is not possible, because the worker definitions inside Elasticsearch are not updated to include the dockerImage from the provided JSON files. Instead the field stays null.
Steps to Reproduce
- Add
"https://download.thehive-project.org/analyzers.json",to the beginning of theurlsforanalyzer. - Restart Cortex and hit refresh Analyzers on the organization page.
- The UI displays a message that Analyzers are refreshed and the listing also shows them as "Type: Docker", but inside Elasticsearch the dockerImage field stays
nulland therefore theDockerJobRunneris unable to execute them.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the analyzer refresh path and the worker definitions loaded from the provided analyzers.json URL. Trace how refreshed definitions are written to Elasticsearch, then verify that dockerImage is preserved and available to DockerJobRunner after a refresh.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, elasticsearch, scala
- Domain
- backend, databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100