We are happy to announce the immediate availability of a new major version of Cortex-Analyzers. Version 1.11.0 includes two brand new analyzers, several updates and a few bug fixes:
- Hashdd, contributed by iosonogio
- URLhaus, contributed by ninoseki
- The Domaintools analyzer has been updated with two new flavors: Risk and Reputation
- The VirusTotal analyzer can (finally!) get reports for URL observables
- MsgParser and File_Info have been merged in a new, shiny, completely rewritten FileInfo analyzer
As we are approaching the 90 analyzers mark, we wholeheartedly thank our user community for continuously contributing new analyzers, testing them and helping us improve the existing ones.
Important Notice
We made significant changes in this release in the analyzers and short reports. Prior to Cortex-Analyzers 1.11.0, the summary() function in the analyzer code generates a result such as:
"taxonomies": [{
"level": "suspicious",
"namespace": "DT",
"predicate": "Risk",
"value": "\"10\""
}]
Double quotes were included in the resulting value. We decided to update the summary() function and make it generate the same result without double quotes :
"taxonomies": [{
"level": "suspicious",
"namespace": "DT",
"predicate": "Risk",
"value": "10"
}]
To display the double quotes in TheHive, we updated all short reports to include them:
<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
{{t.namespace}}:{{t.predicate}}="{{t.value}}"
</span>
Hashdd
hashdd.com is a search engine for file hashes which automatically queries 3rd party services like VirusTotal and enriches the information provided based on the 3rd party data. The analyzer includes two flavors: Status and Detail. The first one is used to query hashdd without an API key for the threat level only. The latter produces additional meta information about the sample, but requires an API key.
Results are displayed in TheHive in the following manner:
URLhaus
URLhaus, a service that shares the latest malware download URLs and reports those sites to their respective hosting companies, can now be queried for domains, URLs and hashes. If the observable is found, available information will be displayed as follows:
Domaintools Risk and Reputation
New Risk and Reputation services from Domaintools have been added as new flavors to the existing Domaintools analyzer set.
Risk Evidence
The DomainTools Risk Score predicts the risk level and likely threats from a domain that has not been observed in malicious activities, by analyzing various properties of the domain as soon as it is registered.
Reputation
The Domaintools Reputation Score gives indications about how closely a domain is related to known bad domains, actors, and IPs.
An All New FileInfo
FileInfo performs local static analysis of file observables. It has been completely rewritten from the ground up to be more flexible thus it can easily be enriched with new supported file types and analysis modules. We took this opportunity to merge MsgParser, in charge of extracting and displaying Outlook emails into FileInfo.
As of this release, FileInfo now supports PDF, PE, MS Office documents and Outlook .msg files. We also added support for DDE detection and link extraction in MS Office documents, thanks to Decalage who added this in Oletools since v0.52.
Bug fixes
- #286 : we updated the way MISP analyzer validates its SSL configuration
-
#292 : we fixed the API URL of malwares.com in the Malwares analyzer
Get It While Supply Lasts!
Each analyzer comes with its own, pip compatible requirements.txt file. To update your Cortex analyzers to 1.11.0, run the following commands:
cd path/to/Cortex-Analyzers
git pull
for I in analyzers/*/requirements.txt; do sudo -H pip2 install -r $I; done && \
for I in analyzers/*/requirements.txt; do sudo -H pip3 install -r $I || true; done
Once done, do not forget to login to Cortex as an orgadmin and click on the Refresh Analyzers button.
Update TheHive Report Templates
If you are using TheHive, get the latest version of the report templates and import them into TheHive.
Running Into Trouble?
Shall you encounter any difficulty, please join our user forum, contact us on Gitter, or send us an email at support@thehive-project.org. We will be more than happy to help!
TheHive Project 