TheHive-Project / TheHive-Project/Cortex

File Name and Extension Lost After Analysis in Cortex

Open
#467 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Scala
Stars
1.6k
Forks
264
PR merge metrics
No merged PRs in 30d

Description

Problem Description

When analyzing a file observable with a Cortex Analyzer from TheHive, the file name and its extension are lost or changed during the process. This behavior occurs when the observable is sent to Cortex for analysis and affects the subsequent handling and analysis of the file since the original file name and extension are significant for my analyzer.

Steps to Reproduce

Create a case in TheHive and add a file observable with a specific file name and extension.
Run the Analyzer in Cortex to analyze the file observable.
After the analysis is complete, observe that the file name and extension are changed or missing in the analysis results or observable details.

Possible Solutions

If you have any suggestions on how to maintain the original file name and extension throughout the analysis process

Complementary information

Any logs or configurations that showcase this behavior will be helpful. Here is an example of what happens to the file name before and after analysis

image

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is named. Reproduce the issue by creating a TheHive file observable and running a Cortex Analyzer, then compare the filename and extension before and after analysis. Done means the original filename and extension remain available to the analyzer and in the resulting observable or analysis details.

Written by the indexing model from the issue text.

Assessment

Tech stack
scala
Domain
api, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.