CIRCL.lu PassiveDNS Analyzer

[saadkadhi]

Request Type

Analyzer Request

Work Environment

NA

Analyzer Description

Create an analyzer to tap into CIRCL.lu PassiveDNS service.

[saadkadhi]

@3c7 has proposed to create it.

[saadkadhi]

@3c7 any update on this one and the other few analyzers you would be contributing? Do you need any help from us?

[3c7]

Hey @saadkadhi, currently working on google safebrowsing analyzer. Hope I'm able to publish the analyzers next week.

(Malwr.com uses ReCaptcha for the login and searching for hashes is not allowed through the API, so that analyzer is not ready to use at the moment)

Updated cortexutils to python 3, except for the artifacts part, because I don't know for what it is used.

Edit: Will publish them under https://github.com/BSI-CERT-Bund/cortex-analyzers

[nadouani]

Hi @3c7,

just for information, the artifacts part will be used in the upcoming versions of TheHive to allow user to import observables coming from an analyzer report.

cortexutils comps with a default implementation which is using ioc-parser to extract observables from the report, but you can implement your own artifacts() method (it will override the default method provided by cortexutils.Analyzersuper class.

That said, we will upgrade cortexutils to make sure it uses a fork of ioc-parser that is python3 compatible

Thanks

[nadouani]

@3c7 could you please share the updates you made to cortexutils? we can include the in the next release ;)
If so, just create a pull request.

Thanks

[3c7]

@nadouani Ah, thank you. My cortexutils-implementation is basically a clone of yours without the ioc-parser dependent artifacts function plus have the raw report as standard summary. ;)
I will review my code and create a pull request after that.

[saadkadhi]

Thanks a lot @3c7. We are looking forward to your contributions. If you also use TheHive and feel comfortable with AngularJS, we'd appreciate it if you submit short and long report templates for your analyzer set. Otherwise we'll take care of those.

[3c7]

I've created templates for all of my analyzers, but maybe you can improve them. I'm not that familiar with Angular.