TheHive-Project / TheHive-Project/Cortex

Input problem with Custom Analyzer

Open
#439 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Scala
Stars
1.6k
Forks
264
PR merge metrics
No merged PRs in 30d

Description

Describe the bug
I am trying to edit an existing cortex analyzer (Urlscan_io_Search_0_1_1) to add a new feature. I want to add to this existing analyzer an extra option for a regex based search through Urlscan's capability to search using URL keyword regex. The issue raises when I use a "" character and cortex adds an extra "" character.

To Reproduce
Steps to reproduce the behavior:

Create or edit an analyzer and use as datatype regexp in Service Interaction File.
Use the analyzer and give as an input a regex with "" character in. For example "http://domain.test"
Then the cortex will change the regex into "http\:\/\/domain\.test"
Expected behavior
In this occasion we will expect to use "" character as it is without cortex adding an extra "" character".
The same problem rises when running OpenCTI_SearchObservables_2_0 analyzer with regexp option.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with a Service Interaction File using regexp and the example input, then compare the submitted and transformed values. Trace how Cortex handles analyzer input before the request reaches Urlscan_io_Search_0_1_1 or OpenCTI_SearchObservables_2_0. Done means backslashes in regexp input are preserved without extra escaping and the behavior is verified for both analyzers.

Written by the indexing model from the issue text.

Assessment

Tech stack
scala
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.