TheHive-Project / TheHive-Project/Cortex
MSdefender in a Standalone Cortex with caseID as mandatory
Nobody has claimed this yet.
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Description
Request Type
Hey Guys,
I'm using Cortex as a standalone where i send via api some requests to get analysis. I'm trying to use the MSDefender responder via API. The request is done and is on the Cortex Jobs, but it end's in error: "caseId is missing"
i already tried to pass in the body the caseID key with a dummy but its not working. I already tried to pass the value as string or integer:
Something like this:
{
"_type":"case_artifact",
"data":"127.0.0.1",
"dataType":"ip",
"ioc":false,
"status":"Ok",
"tlp":2,
"caseId":123
}
Any tips?
Thanks,
Tiago Cardoso
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the MSDefender responder request through the Cortex API in standalone mode, using the example payload and checking where the “caseId is missing” error is produced. Trace how the responder handles caseId outside TheHive and define done as a successful standalone request or a clear, documented validation requirement.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- scala
- Domain
- api, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100