TheHive-Project / TheHive-Project/Cortex
Cortex to provide hashes from file observables to analyzers
Nobody has claimed this yet.
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Description
Request Type
Feature Request
Cortex to provide hashes when analyzing an observable of dataType "file".
VirusTotal analyzer already look for these hashes:
hashes = self.get_param("attachment.hashes", None)
(see: https://github.com/TheHive-Project/Cortex-Analyzers/blob/master/analyzers/VirusTotal/virustotal.py#L258)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the referenced VirusTotal analyzer at analyzers/VirusTotal/virustotal.py around the attachment.hashes lookup, then trace how Cortex passes parameters for observables with dataType "file". Done means analyzers receive the available file hashes during analysis, with the relevant behavior covered by existing tests if present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python, scala
- Domain
- api, backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100