Refactor the validation_regex feature for context links
- Dominant language
- Python
- Stars
- 3.4k
- Forks
- 666
- Avg merge
- 7d 22m
- Merged PRs (30d)
- 5
Description
Related to #2439 .
With the current approach for configuring context links, it can end up in a very nasty long regex if we want to support multiple fields.
Example with virustotal:
```
match_fields: ['host', 'url', 'domain', 'md5_hash', 'md5', 'sha1_hash', 'sha1', 'sha256_hash', 'sha256', 'hash', 'ipv4', 'ip', 'ip_address', 'dest_ip', 'source_ip']
validation_regex: '/(\b25[0-5]|\b2[0-4][0-9]|\b[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}|(^(?!-)[A-Za-z0-9-]+([\-\.]{1}[a-z0-9]+)*\.[A-Za-z]{2,6}$)|(^[0-9a-f]{64}$)|(^[0-9a-f]{40}$)|(^[0-9a-f]{32}$)|((([A-Za-z]{3,9}:(?:\/\/)?)(?:[\-;:&=\+\$,\w]+@)?[A-Za-z0-9\.\-]+|(?:www\.|[\-;:&=\+\$,\w]+@)[A-Za-z0-9\.\-]+)((?:\/[\+~%\/\.\w\-_]*)?\??(?:[\-\+=&;%@\.\w_]*)#?(?:[\.\!\/\\\w]*))?)|((?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9][a-z0-9-]{0,61}[a-z0-9])/i'
```
Some ideas on how to potentially fix this:
- Allow for defining regex types in the config that can be re-used per item. E.g. define `sha256 = ^[0-9a-f]{64}$` and reuse that as keyword in the `validation_regex`.
- Allow to reference regex defined by the intelligence feature for `validation_regex`.
- Allow to reference the same external service multiple times for different fields.
Contributor guide
Assessment
This issue has not been assessed yet.