Shortly after the release of Cortex-Analyzers 2.4.0, TheHive Project’s code Chefs are happy to announce Cortex-Analyzers 2.5.0, a new Cortex analyzer & responder release which brings the total to 142 analyzers and 16 responders, up from 138 and 10 respectively!
We’d like to thank all the contributors for their precious work which will certainly provide more options to fellow cyber defenders and cyber threat intelligence analysts for improving their efficiency and focus on what really matters.
What’s New?
New Analyzers
- Clamav, contributed by @Hestat (#312)
- IPVoid, contributed by @jdsnape (#455)
- ThreatGrid, contributed by Michael Auger (#597)
- ThreatResponse, contributed by Michael Auger (#598)
New Responders
- AMPForEndpoints, contributed by Michael Auger (#596)
- Redmine, contributed by srilumpa (#342)
Analyzers
Clamav
Clamav is a powerful and open source antivirus engine that allows writing custom signatures using Yara and sigtool. @Hestat contributed with this analyzer that permits to TheHive to communicate with a local clamav-daemon.
A detailed configuration guide is available on Hetstat’s website.
IPVoid
Contributed by @jdsnape, this analyzer leverages the IP reputation check of apivoid.com, the API of www.ipvoid.com. As you can probably guess by its name, this analyzer can be used to enrich ip observables.
In order to use this analyzer, an account and a valid subscription to apivoid.com are required. An API key needs then to be provided.
TheHive displays the analyzer results as follows:
ThreatResponse
This analyzer lets you leverage the Cisco Threat Response service. Query Threat Response for verdicts and sightings for observables of type domain, filename, fqdn, hash (MD5, SHA1, SHA256), ip and url.
The analyser report lets you pivot into a Threat Response investigation of an observable.
Combining it with AMP for Endpoints Responder
It will extract the connector GUIDs as new observables to enable seamless use of the AMP for Endpoints Responder if a target is returned from the AMP for Endpoints module. It requires the AMP for Endpoints module to be configured in Threat Response.
A valid Cisco ThreatResponse subscription is required, and you have to provide your client ID and password information to use this analyzer.
TheHive displays the analyzer results as follows:
ThreatGrid
This analyzer queries Cisco Threat Grid for file, url, or hash and deliver analysis report. It also lets you pivot into the Threat Grid report to access more information related to Behavioral indicators or TCP/IP stream.
A valid Cisco Threat Grid subscription is required, and you have to provide hostname and api key to use this analyzer.
TheHive displays the analyzer results as follows:
Responders
AMPForEndpoints
This responders performs several actions on Cisco AMP for Endpoints. It comes in 5 flavors:
- AMPforEndpoints_IsolationStart: Start Host Isolation.
- AMPforEndpoints_IsolationStop: Stop Host Isolation.
- AMPforEndpoints_MoveGUID: Move Connector GUID to a new group.
- AMPforEndpoints_SCDAdd: Add SHA256 to a Simple Custom Detection List. TheHive’s case ID and description are appended to the description
- AMPforEndpoints_SCDRemove: Remove SHA256 from a Simple Custom Detetion List.
A valid Cisco AMP for Endpoints subscription is required, and you have to provide the client id, api key and several context information to use this responder.
Redmine
Redmine is a free and open source, web-based project management and issue tracking tool. It allows users to manage multiple projects and associated subprojects.
This responder, contribuited by srilumpa, can be used to create an issue in the Redmine ticketing system from a case. It will use the case title as the issue subject and the case description as the issue body.
To set it up in Cortex, you will need:
- To define a user to allow Cortex to connect to Redmine and with access to the various projects in which issues should be created
- Define three custom fields in TheHive that will be used to select the project, the tracker and, optionally, the assignee of the issue. These fields can be free form or can be custom fields with preset values.
At the moment the responder has few capabilities. If you need any other integration feel free to discuss on the pull issue.
Fixes
- Umbrella Investigate [#698]
Get It While Supply Lasts!
If you are still using the old-style way of installing analyzers and responders, run the following commands:
cd path/to/Cortex-Analyzers
git pull
for I in analyzers/*/requirements.txt; do sudo -H pip3 install -U -r $I || true; done
for I in responders/*/requirements.txt; do sudo -H pip3 install -U -r $I || true; done
Once done, ensure to refresh your analyzers and responders in the Cortex WebUI. Connect as an orgadmin and go to the Organization menu. Click on the Analyzers tab and click on the Refresh analyzers button. Do the same for the Responders tab: click on the Refresh responders button. Refer to the online Cortex documentation for further details.
Update TheHive Report Templates
If you are using TheHive, you must import the new report templates in your instance as follows:
- download the updated package
- log in TheHive using an administrator account
- go to
Admin> Report templates` menu - click on
Import templatesbutton and select the downloaded package
Running Into Trouble?
Shall you encounter any difficulty, please join our user forum, contact us on Gitter, or send us an email at support@thehive-project.org. We will be more than happy to help!
TheHive Project 