Disable analyzer in configuration file

[jeromeleonard]

Have a way to disable analyzers in application.conf instead of remove analyzers folders after update.

Possible Solutions

add the list in /etc/cortex/application.conf :

[..]
analyzers {
    config {
        [..]
    }
    disabled = [
        analyzer_name_1,
        analyzer_name_4,
        analyzer_name_12,
        analyzer_name_N
    ]
    
    }
[..]

[saadkadhi]

How this issue differs from #14? Having a 'disabled' section would be troublesome. For instance what happens when an analyzer is configured **and** listed in the disabled section? IMO if an analyzer has a subsection in application.conf, that means it is in use and if we do not want it we simply comment out the relevant section. This also goes for analyzers which do need a configuration. If they are mentioned in application.conf then they are in use.

On Mon, 29 May 2017 at 16:25, Jerome Leonard ***@***.***> wrote: Have a way to disable analyzers in application.conf instead of remove analyzers folders after update. Possible Solutions add the list in /etc/cortex/application.conf : [..] analyzers { config { [..] } disabled = [ analyzer_name_1, analyzer_name_4, analyzer_name_12, analyzer_name_N ] } [..] — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#32>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACuGSzbNe-lBcTMdBNHRr-pZdZDx8e2xks5r-tVrgaJpZM4NpXoc> .

-- Saâd Kadhi CERT-BDF -- https://cert.banque-france.fr/ TheHive Project -- https://thehive-project.org/

[nadouani]

@saad don't forget that several analyzer might share the same config key in application.conf file. Think of PassiveTotal or DomainTools set of analyzers

[ghost]

Solution works perfectly.

Please note that the analyzer name needs to match the output from the following command:
grep 'Register analyzer' /var/log/cortex/application.log | sed -e 's/.*(\([0-9a-zA-Z_]\+\))$/\1/' | sort -u