New analyzer: NERD

[vaclavbartos]

Added a new analyzer to get data from CESNET's Network Entity Reputation Database (NERD) (see https://nerd.cesnet.cz/).

Templates for The Hive are included.

If you want to test it, you'll need an API key - write me to bartos@cesnet.cz and I'll create you an account (unfortunatelly a feature to create account in NERD by yourself is not finished yet).

Note: I'm one of the authors and maintainer of NERD.

[dadokkio]

Just tested, nice templates 😃

There is just a missing quote in the url field in nerd.json file that need to be fixed and imho for no-data is better to keep the results as info and not as safe, what do you think?

Since you are going to update that file if you want you can add new analyzer information, your logo and screenshots that will be shown in the new documentation.
You can read more about this here: https://thehive-project.github.io/Cortex-Analyzers/analyzers_definition/

[vaclavbartos]

Thanks for the feedback and suggestions. I added some more information. I would add the logo and screenshots, too, but I don't know where to put the files to. The example shows the assets directory, but I can't find it anywhere.

[dadokkio]

You can add an assets folder in your code at the same level of the nerd.json.. the idea is that each analyzer will have an assets folder. you can see this approach already used in iris or spamassassin pulls

[vaclavbartos]

Thanks, I added the images.