TheHive-Project / TheHive-Project/Cortex
Input problem with Custom Analyzer
Nobody has claimed this yet.
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
I am trying to edit an existing cortex analyzer (Urlscan_io_Search_0_1_1) to add a new feature. I want to add to this existing analyzer an extra option for a regex based search through Urlscan's capability to search using URL keyword regex. The issue raises when I use a "" character and cortex adds an extra "" character.
To Reproduce
Steps to reproduce the behavior:
Create or edit an analyzer and use as datatype regexp in Service Interaction File.
Use the analyzer and give as an input a regex with "" character in. For example "http://domain.test"
Then the cortex will change the regex into "http\:\/\/domain\.test"
Expected behavior
In this occasion we will expect to use "" character as it is without cortex adding an extra "" character".
The same problem rises when running OpenCTI_SearchObservables_2_0 analyzer with regexp option.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue with a Service Interaction File using regexp and the example input, then compare the submitted and transformed values. Trace how Cortex handles analyzer input before the request reaches Urlscan_io_Search_0_1_1 or OpenCTI_SearchObservables_2_0. Done means backslashes in regexp input are preserved without extra escaping and the behavior is verified for both analyzers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- scala
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100