After the first feedback received from the community on Discord and Github, we have put the coming 4.1.0 release of TheHive on hold to focus on what can potentially break Cortex v3.1.0 and TheHive v3.5.0 with the upgrade to Elasticsearch v7.11.x. Several questions appeared on our side:
How to fix the installation process ?
How to fix the upgrade process ?
As the update of an existing Elasticsearch database to 7.11.x makes the downgrade impossible after that, will our fix repair it ?
Good news: this is fixed with TheHive v3.5.1 and Cortex 3.1.1, and these versions will repair databases that have already been updated to ES 7.11.x.
The update to these new versions introduces new indexes, for Cortex (cortex_6), as well as for TheHive (the_hive_17).
If you plan to run a new installation for Cortex, just follow the installation guide;
If you want to update your setup, we recommend to follow this process:
Stop TheHive or Cortex
Stop Elasticsearch
Update Elasticsearch package
Restart Elasticsearch and ensure this is going well
Install TheHive 3.5.1 or Cortex 3.1.1 package
If you already updated Elasticsearch to version 7.11.x and faced potential breaks with Cortex or TheHive, follow the process described previously and you should regain access to your data.
Once updated, you should be invited to update the database:
Update Database after installing TheHive 3.5.1 or Cortex 3.1.1
Click on “Update Database” and you should then be invited to login. Everything should work fine after that.
As usual, we recommend making backups or a snapshot of the database before running the upgrade.
If you are running TheHive v3.5.0 and / or Cortex v3.1.0, the underlying database is Elasticsearch v7.x.
Elastic recently released two new versions: v7.11.0 and v7.11.1. After some initial feedback and investigations, we found that the new releases introduce changes that break the compatibility with our products – TheHive 3.5.0 and Cortex 3.1.0.
Therefore, please DO NOT upgrade your current database to Elasticsearch v7.11.x as no rollback is possible. Elasticsearch v7.11.x breaks the installation process as well as the update process.
If you are in the process of installing or updating to Cortex v3.1.0 or TheHive v3.5.0, you need to specify the exact working version of Elasticsearch to use:
For Debian packages: “apt install elasticsearch=7.10.2”
FOR RPM packages: “yum install elasticsearch-7.10.2-1”
We are currently running deeper investigations and are planning to release updated versions as soon as possible for Cortex v3.1.0 and for TheHive 3.5.0.
Didn’t you think we were going to holidays without letting few new stuff to play with ? 6 new Analyzers and 1 Responder complete the growing list of Neurons.
A Huge thanks to all the contributors for the great new features, without forgetting the work regarding improvements and bug fixes.
This analyzer comes in 1 flavor and let you check SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting and Conformance) status of a domain or fqdn.
TheHive displays the analyzer results as follows:
DomainMailSPFDMARD short reportDomainMailSPFDMARD Long report
ForcepointWebsensePing
Forcepoint URL Filtering provides defenses against productivity draining web content and threats to operations. It ensures organizational productivity by delivering defenses against productivity draining web activity while providing the necessary security in a world of advanced threats.
Using WebsensePing utility is possible to query Master Database URL Categories that contains the industry’s most accurate, current and comprehensive classification of URLs. ForcePoint uses proprietary classification software and human inspection techniques to categorize and maintain definitions of more than 95 URL categories in more than 50 languages.
An active Forcepoint subscription is required to use the analyzer.
TheHive displays the analyzer results as follows:
ForcepointWebsensePing short report samplesForcepointWebsensePing long report sample
NERD
This analyzer allows to query the NERD (Network Entity Reputation) database, and get score and basic information. Project NERD aims to build an extensive reputation database of known sources of cyber threats. That is, a list of known malicious IP addresses or other network entities (e.g. ASNs or domain names) together with all security-relevant information about each of them.
A valid API key is required to run this analyzer.
TheHive displays the analyzer results as follows:
NERD short reportNERD long report
SekoiaIntelligenceCenter
This analyzer allows you to gather more context related to domain names, IP adresses, urls and file hashes using the SEKOIA.IO Intelligence Database.
An active SEKOIA.IO Intelligence Center subscription is required to use the analyzer.
TheHive displays the analyzer results as follows:
SEKOIAIntelligenceCenter_Indicators long report
Spamassassin
This analyzer let you query a local SpamAssassin instance by sending a file, and get a SPAM score.
Apache SpamAssassin is the #1 Open Source anti-spam platform giving system administrators a filter to classify email and block spam (unsolicited bulk email). It uses a robust scoring framework and plug-ins to integrate a wide range of advanced heuristic and statistical analysis tests on email headers and body text including text analysis, Bayesian filtering, DNS blocklists, and collaborative filtering databases.
TheHive displays the analyzer results as follows:
Spamassassin short reportSpamassassin long report
Splunk
This analyzer allows you to execute a list of searches in Splunk by passing the element you are looking for as a parameter.
This analyzer comes in 10 flavors:
Splunk_Search_Domain_FQDN: Dispatch a list of saved searches on a given domain/fqdn
Splunk_Search_File_Filename: Dispatch a list of saved searches on a given file/filename
Splunk_Search_Hash: Dispatch a list of saved searches on a given hash
Splunk_Search_IP: Dispatch a list of saved searches on a given IP (IPv4 only)
Splunk_Search_Mail_Email: Dispatch a list of saved searches on a given mail/email
Splunk_Search_Mail_Subject: Dispatch a list of saved searches on a given mail_subject
Splunk_Search_Other: Dispatch a list of saved searches on a given data (any type)
Splunk_Search_Registry: Dispatch a list of saved searches on a given registry
Splunk_Search_URL_URI_Path: Dispatch a list of saved searches on a given url/uri_path
Splunk_Search_User_Agent: Dispatch a list of saved searches on a given user_agent
Splunk_Search_User: Dispatch a list of saved searches on a given user id (variable name is ‘other’)
A valid Splunk subscription is required to run this analyzer.
TheHive displays the analyzer results as follows:
Splunk_Search_Registry short reportSplunk_Search_Registry long report
Responders
Velociraptor
Velociraptor let you interrogate your endpoint for specific data. Velociraptor is a tool for collecting host based state information using Velocidex Query Language (VQL) queries.
This responder can be used to run a flow for a Velociraptor artifact. This could include gathering data, or performing initial response.
It can be run on an observable type of ip, fqdn, or other, and will look for a matching client via the Velociraptor server. If a client match is found for the last seen IP, or the hostname, the responder will kick off the flow, the results will be returned, and the client ID will be added as a tag to the case and the observable.
Get It While Supply Lasts!
If you are still using the old-style way of installing analyzers and responders, run the following commands:
cd path/to/Cortex-Analyzers
git pull
for I in analyzers/*/requirements.txt; do sudo -H pip3 install -U -r $I || true; done
for I in responders/*/requirements.txt; do sudo -H pip3 install -U -r $I || true; done
Once done, ensure to refresh your analyzers and responders in the Cortex WebUI. Connect as an orgadmin and go to the Organization menu. Click on the Analyzers tab and click on the Refresh analyzers button. Do the same for the Responders tab: click on the Refresh responders button. Refer to the online Cortex documentation for further details.
Update TheHive Report Templates
If you are using TheHive, you must import the new report templates in your instance as follows:
go to Admin > Report templates menu ( Admin > Analyzer templates in TheHive 4.0)
click on Import templates button and select the downloaded package
Running Into Trouble?
Shall you encounter any difficulty, please join our user forum, contact us on Gitter, or send us an email at support@thehive-project.org. We will be more than happy to help!
Thanks to the community and all the contributors, this release comes with 1 new Analyzer, 2 new Responders, lots of improvements and bug fixes.
But there is more news from the front.
Starting from this milestone, bugfixes and new Analyzers or Responders should be released in a smoother way as we are improving few processes. Some changes and recommandations should appear in the next days for submission, and our release process will be improved to fix bugs easier and release new code faster.
We also plan to offer a better documentation. We already started to publish information regarding each Analyzer and Responder. This is a work in progress, and it will be updated with the current requirements guide.
DomainToolsIris documentation page
For each Analyzer and Responder, a page details the purpose of each flavors, the configuration required and even some screenshots from report samples. It will also allow developers to share their own notes if wanted.
New Analyzers
LastInfoSec analyzer, contributed by @remydewa (#754)
Improvement in Shodan: add vulns in template and taxonomies (#772 & #776)
Improvement in Mailer responder: tasks support and auth (#764, #737, #379)
Improvement in SinkDb: support for new api with new dataTypes supported (#483, #498, #756)
Analyzers
LastInfoSec
LastInfoSec offers innovative and automated solutions to collect data, refine it and turn it into useful and actionable information, quickly available to improve the protection, detection and investigation capabilities of companies and government organizations.
TheHive displays the analyzer results as follows:
Short template for LastInfoSec ReportLong Template for LastInfoSec Report
Onyphe
An important work has been made on Onyphe Analyzer to support APIv2. All 7 flavors from older version have been removed and merged into only one flavor named “Onyphe_Summary”. An API key is still needed to query Onyphe API.
TheHive displays the analyzer results as follows:
Onyphe_Summary short reportOnyphe_Summary long report
Responders
Sendgrid
Sendgrid is a customer communication platform for transactional and marketing email used when you have to ensure that your notifications and transactional emails are delivered quickly and securely.
This analyzer works like the Mailer one, but relying on SendGrid external service to delivery emails.
In order to use the service please follow the instruction being careful to the verify your email address.
VirusTotalDownloader
This responders runs on Observables of type “hash” and allows analyst to download corresponding file from VirusTotal. Once downloaded, the file is added to the current case observables in TheHive.
In order to use this responder, a Premium API key from VirusTotal is needed. An API key from TheHive is also needed to upload the file in the observables list.
Use the responder on the hash to add the sample in your Observables
Fixes and Improvements
Fix: some analyzer uses invalid “email” dataType (#799)
Fix in MalwareBazaar: wrong dataTypes in config (#794)
Fix in PhishTank: the JSON object must be str, not ‘bytes’ (#786)
Fix in VMRay: fix error in parsing and workflow (#785 & #784)
Fix in ThreatResponse: module_type key removed from response (#759)
Fix in Abuse_Finder: pythonwhois dependency (#742)
Get It While Supply Lasts!
If you are still using the old-style way of installing analyzers and responders, run the following commands:
cd path/to/Cortex-Analyzers
git pull
for I in analyzers/*/requirements.txt; do sudo -H pip3 install -U -r $I || true; done
for I in responders/*/requirements.txt; do sudo -H pip3 install -U -r $I || true; done
Once done, ensure to refresh your analyzers and responders in the Cortex WebUI. Connect as an orgadmin and go to the Organization menu. Click on the Analyzers tab and click on the Refresh analyzers button. Do the same for the Responders tab: click on the Refresh responders button. Refer to the online Cortex documentation for further details.
Update TheHive Report Templates
If you are using TheHive, you must import the new report templates in your instance as follows:
click on Import templates button and select the downloaded package
Running Into Trouble?
Shall you encounter any difficulty, please join our user forum, contact us on Gitter, or send us an email at support@thehive-project.org. We will be more than happy to help!
Good morning (or evening if you are on that side of the planet) folks!
We had a very busy week, packed with announcements. First, we released TheHive 4.0-RC2 which you’ve certainly taken to test, then we announced two patch releases for TheHive 3.4. And guess what? Here are some additional Cortex analyzers, a responder and a number of fixes and improvements for existing ones, bringing the total to a whopping 146 analyzers and 18 responders!
RT4-CreateTicket responder, contributed by @mdavis332 (#543)
Analyzers
ANY.RUN
ANY.RUN is a malware sandbox service in the cloud. By using this analyzer, an analyst can submit a suspicious file or URL to the service for analysis and get a report. The report can contain various information such as:
Interactive access
Research threats by filter in public submissions
File and URL dynamic analysis
Mitre ATT&CK mapping
Detailed malware reports
ANY.RUN short reportANY.RUN long report
CyberChef
CyberChef is a simple, intuitive web app for carrying out all manner of “cyber” operations within a web browser. These operations include simple encoding like XOR or Base64, more complex encryption like AES, DES and Blowfish, creating binary and hexdumps, compression and decompression of data, calculating hashes and checksums, IPv6 and X.509 parsing, changing character encodings, and much more.
This analyzer connects to a CyberChef-server and comes in 3 flavors:
CyberChef_FromBase64, that takes Base64 strings as input for CyberChef-server
CyberChef_FromCharCode, that takes CharCode as input for CyberChef-server and run this recipe
CyberChef_FromHex, that takes Hex strings as input for CyberChef-server
TheHive displays the analyzer results as follows:
CyberChef short report
CyberChef long report
MalwareBazaar
MalwareBazaar is a project from abuse.ch with the goal of sharing malware samples with the infosec community, AV vendors and threat intelligence providers.
This analyzer allows analysts to query the API of this service on observables of types ip, domain, fqdn, url, and hash.
TheHive displays the analyzer results as follows:
MalwareBazaar short reportMalwareBazaar long report
OpenCTI
OpenCTI is an open source platform allowing organisations to manage their Cyber Threat Intelligence knowledge and observables. It has been created in order to structure, store, organise and visualise technical and non-technical information about cyber threats.
This analyzer allows an analyst to query the API and request for information about observables of types domain, ip, url, fqdn, uri_path, user-agent, hash, email, mail, mail_subject, registry, regexp,filename and other.
TheHive displays the analyzer results as follows:
OpenCTI short reportOpenCTI long report
MISPWarningLists reloaded (need for speed aka DB support)
The previous version of this analyzer basically used to clone the MISP Warning lists repository and do a lookup in downloaded files. This can be very long to complete.
This new version introduces the optional support of PostgreSQL:
To store warning lists, in a similar way to the NSRL (National Software Reference Library) Analyzer.
Make lookups through these lists faster.
If you want to benefit from the performance boost, using a PostgreSQL server to store the data, you can simply install the requirements.txt, feed the database and configure the connection in the configuration as well:
In the analyzer folder, use the program warninglists_create_db.py to import the warning lists in PostgreSQL. Before running, edit the program file and update the path of where your lists are stored (warninglists_path = "misp-warninglists/**/list.json")
You can schedule these jobs (ex. with cron): first, sync a folder with the repository, and then run the program to update the database.
Once done, configure the analyzer with the conn parameter to connect to the database, or, if you prefer to continue using the previous behaviour and do your lookups in files, just specify the path of the folder:
MISPWarningList Configuration example
Templates have also been updated, and TheHive displays the analyzer results as follows:
MISPWarningList short reportMISPWarningList long report
Responders
RT4-CreateTicket
RT4 (Request Tracker) is a ticketing system. With this responder, an analyst can create a ticket in RT. CaseID is submitted to RT as a reference.
Unfortunately, like for some other analyzers and responders, we have not been able to test this responder on our side. Please feel free to share your feedback with us and also with Michael Davis, who we would like to thank for the hard work and for having shared this responder with the community.
Fixes and Improvements
Fix Inconsistent Key References in Shodan Analyzer (#748)
Improvement: EmlParser now extracts some useful IOCs (#710)
Get It While Supply Lasts!
If you are still using the old-style way of installing analyzers and responders, run the following commands:
cd path/to/Cortex-Analyzers
git pull
for I in analyzers/*/requirements.txt; do sudo -H pip3 install -U -r $I || true; done
for I in responders/*/requirements.txt; do sudo -H pip3 install -U -r $I || true; done
Once done, ensure to refresh your analyzers and responders in the Cortex WebUI. Connect as an orgadmin and go to the Organization menu. Click on the Analyzers tab and click on the Refresh analyzers button. Do the same for the Responders tab: click on the Refresh responders button. Refer to the online Cortex documentation for further details.
Update TheHive Report Templates
If you are using TheHive, you must import the new report templates in your instance as follows:
click on Import templates button and select the downloaded package
Running Into Trouble?
Shall you encounter any difficulty, please join our user forum, contact us on Gitter, or send us an email at support@thehive-project.org. We will be more than happy to help!
Amidst the ongoing COVID-19 crisis, we managed to release Cortex-Analyzers 2.6.0, which includes 4 new Analyzers, 2 new Responders, and a large number of bug fixes and improvements.
We’d like to thank all the contributors for their awesome work!
We truly appreciate the time they generously give away for helping our fellow cyberdefenders out there protect their environments against attackers who are also in lockdown mode. Attackers who, instead of playing board games or chess, are playing with our nerves and the hordes of teleworkers who are willing to click on anything that provide the ‘latest and greatest COVID-19 information’ or which can help them do their jobs (like this wonderful ‘Zoon’ video-conferencing application 😋).
The Investigate flavour was missing from the DomainToolsIris analyzer that was included in Cortex-Analyzers 2.4.0. This is now fixed. This new flavour can be used to gather interesting information on a domain.
TheHive displays the analyzer results as follows:
DomainToolsIris_Investigate short reportsDomainToolsIris_Investigate long report
IntezerCommunity
Intezer Analyze™ is a cloud-based malware analysis service that provides an extensive understanding of any executable file by comparing code on a massive scale to a comprehensive database of malware and trusted software.
This analyzer can be used to submit a file to the Intezer service for analysis.
TheHive displays the analyzer results as follows:
IntezerCommunity short reportIntezerCommunity long report
NSRL
The National Software Reference Library (NSRL) is designed to collect software from various sources and incorporate file profiles computed from this software into a Reference Data Set (RDS) of information. The RDS can be used by law enforcement, government, and industry organisations to review files on a computer by matching file profiles in the RDS. This will help alleviate much of the effort involved in determining which files are important as evidence on computers or file systems that have been seized as part of criminal investigations.
In order to use this analyzer, you must download and extract NSRLFile files from the NIST website. You can pick multiple files but you need to rename them in order to understand which file contains the required information.
All files are called NSRLFile.txt, renaming them permit to understand in which file the record has been found.
The analyzer can operate in 2 different ways with 2 completely different performance profiles (we’re speaking around 30 secs vs 0.05 sec):
lookup in plain files
lookup in a database
If you are planning to use this analyzer for many searches, then the second option is suggested and we provide a script to help you parse, validate and insert data in a PostgreSQL database. If you choose this option, consider that the DB size can be around 4 times bigger than plain files.
NSRL Lookup short templateNSRL Lookup long report
UrlScan.io
The URLScan.io analyzer has been updated with a new Scan flavour. Until now, this analyzer allowed to request report regarding a url, domain, fqdn observable. With this new flavour, anyone with a valid API key, which can be obtained for free, can request a scan on observables of the same type.
UrlScan.io short templateUrlScan.io long template
Responders
DomainToolsIris_CheckMaliciousTags
Depending on the reports generated by the DomainToolsIris analyzer, this responder adds a tag at the Case and Observable level if something malicious is found. This responder can be updated to add more custom actions depending on your needs and environment.
DomainToolsIris_AddRiskyDNSTag
Depending on on the reports generated by the DomainToolsIris analyzer, this responder adds a tag at the Case and Observable level if one of the domain observables is considered risky. This responder can be updated to add more custom actions depending on your needs and environment.
If you are still using the old-style way of installing analyzers and responders, run the following commands:
cd path/to/Cortex-Analyzers
git pull
for I in analyzers/*/requirements.txt; do sudo -H pip3 install -U -r $I || true; done
for I in responders/*/requirements.txt; do sudo -H pip3 install -U -r $I || true; done
Once done, ensure to refresh your analyzers and responders in the Cortex WebUI. Connect as an orgadmin and go to the Organization menu. Click on the Analyzers tab and click on the Refresh analyzers button. Do the same for the Responders tab: click on the Refresh responders button. Refer to the online Cortex documentation for further details.
Update TheHive Report Templates
If you are using TheHive, you must import the new report templates in your instance as follows:
click on Import templates button and select the downloaded package
Running Into Trouble?
Shall you encounter any difficulty, please join our user forum, contact us on Gitter, or send us an email at support@thehive-project.org. We will be more than happy to help!
Shortly after the release of Cortex-Analyzers 2.4.0, TheHive Project’s code Chefs are happy to announce Cortex-Analyzers 2.5.0, a new Cortex analyzer & responder release which brings the total to 142 analyzers and 16 responders, up from 138 and 10 respectively!
We’d like to thank all the contributors for their precious work which will certainly provide more options to fellow cyber defenders and cyber threat intelligence analysts for improving their efficiency and focus on what really matters.
Clamav is a powerful and open source antivirus engine that allows writing custom signatures using Yara and sigtool. @Hestat contributed with this analyzer that permits to TheHive to communicate with a local clamav-daemon.
Clamav short report for safe and malicious samples
IPVoid
Contributed by @jdsnape, this analyzer leverages the IP reputation check of apivoid.com, the API of www.ipvoid.com. As you can probably guess by its name, this analyzer can be used to enrich ip observables.
In order to use this analyzer, an account and a valid subscription to apivoid.com are required. An API key needs then to be provided.
TheHive displays the analyzer results as follows:
IPVoid analyzer short report
IPVoid analyzer long report
ThreatResponse
This analyzer lets you leverage the Cisco Threat Response service. Query Threat Response for verdicts and sightings for observables of type domain, filename, fqdn, hash (MD5, SHA1, SHA256), ip and url.
The analyser report lets you pivot into a Threat Response investigation of an observable.
Combining it with AMP for Endpoints Responder
It will extract the connector GUIDs as new observables to enable seamless use of the AMP for Endpoints Responder if a target is returned from the AMP for Endpoints module. It requires the AMP for Endpoints module to be configured in Threat Response.
A valid Cisco ThreatResponse subscription is required, and you have to provide your client ID and password information to use this analyzer.
TheHive displays the analyzer results as follows:
ThreatResponse analyzer short report
ThreatResponser analyzer long report
ThreatGrid
This analyzer queries Cisco Threat Grid for file, url, or hash and deliver analysis report. It also lets you pivot into the Threat Grid report to access more information related to Behavioral indicators or TCP/IP stream.
A valid Cisco Threat Grid subscription is required, and you have to provide hostname and api key to use this analyzer.
AMPforEndpoints_MoveGUID: Move Connector GUID to a new group.
AMPforEndpoints_SCDAdd: Add SHA256 to a Simple Custom Detection List. TheHive’s case ID and description are appended to the description
AMPforEndpoints_SCDRemove: Remove SHA256 from a Simple Custom Detetion List.
A valid Cisco AMP for Endpoints subscription is required, and you have to provide the client id, api key and several context information to use this responder.
Redmine
Redmine is a free and open source, web-based project management and issue tracking tool. It allows users to manage multiple projects and associated subprojects.
This responder, contribuited by srilumpa, can be used to create an issue in the Redmine ticketing system from a case. It will use the case title as the issue subject and the case description as the issue body.
To set it up in Cortex, you will need:
To define a user to allow Cortex to connect to Redmine and with access to the various projects in which issues should be created
Define three custom fields in TheHive that will be used to select the project, the tracker and, optionally, the assignee of the issue. These fields can be free form or can be custom fields with preset values.
Custom fields in TheHive for Redmine integration
At the moment the responder has few capabilities. If you need any other integration feel free to discuss on the pull issue.
Cortex responder output and corresponding issue in Redmine
If you are still using the old-style way of installing analyzers and responders, run the following commands:
cd path/to/Cortex-Analyzers
git pull
for I in analyzers/*/requirements.txt; do sudo -H pip3 install -U -r $I || true; done
for I in responders/*/requirements.txt; do sudo -H pip3 install -U -r $I || true; done
Once done, ensure to refresh your analyzers and responders in the Cortex WebUI. Connect as an orgadmin and go to the Organization menu. Click on the Analyzers tab and click on the Refresh analyzers button. Do the same for the Responders tab: click on the Refresh responders button. Refer to the online Cortex documentation for further details.
Update TheHive Report Templates
If you are using TheHive, you must import the new report templates in your instance as follows:
click on Import templates button and select the downloaded package
Running Into Trouble?
Shall you encounter any difficulty, please join our user forum, contact us on Gitter, or send us an email at support@thehive-project.org. We will be more than happy to help!
Soon after we released Cortex-Analyzers 2.4.0, Jérôme noticed that something was definitely wrong. And that something was plural.
As he set to retest a few things here and there, he realised that many docker images, for the latest and greatest analyzers and responders, were not automatically built. The code factory wasn’t working 😰
So he started digging. And the more he dug, the more bugs he discovered. Our user community also reported a few issues. He thought it was about time he opens that bottle of Aloxe-Corton, put a Makaya McCraven album to play on his turntable, and rolls his sleeves to address all these problems headfirst 🍷
After a few hours of intense work, he managed to fix the docker build process and release Cortex-Analyzers 2.4.1, a hotfix that corrects the following issues:
[#545] Message extraction using FileInfo doesn’t always work
[#610] The VirusTotal analyzer contains a typo which prevents it from running
[#614] Many analyzers fail to run due to incorrect permissions
[#619] Abuse Finder not working with docker after force usage of python3
[#620] Missing library prevented the build of the docker image corresponding to the new MalwareClustering analyzer
Finally, he took the opportunity to rename Palo Alto AUTOFOCUS analyzers to Autofocus, for consistency purposes.
Please refer to our previous blog post, pertaining to Cortex-Analyzers 2.4.0, for update instructions.
Thank you in advance for your understanding and happy cyberfighting! 💪🏼
Guess what? TheHive Project is still alive and well, as Saâd already mentioned in a previous blog post.
We’ve been certainly very busy lately, preparing the upcoming release of TheHive 4 and doing many other things beside working on our FOSS project. As a result, it took us a rather long time to merge several community contributions and reduce the sizeable pile of pull requests.
We would like to thank our contributors for their patience and we hope the cyberdefenders out there will enjoy the brand new Cortex-Analyzers 2.4.0 release, with many new analyzers, responders and some bug fixes & improvements, bringing the total to a whooping 138 analyzers (counting all flavors) and 10 responders!
Additionally, with this release, all analyzers are now using Python 3. No more Python 2 technodebt!
The EmailRep analyzer checks the reputation of an email address against the emailrep.io database.
IPInfo
This analyzer accesses IP-centric features provided by ipinfo.io. While the EmailRep API can be used without a token for limited usage, the ipinfo.io analyzer requires the configuration of an API token before use.
Maltiverse
This analyzer lets you query the free Maltiverse Threat Intelligence platform for enrichment information about a particular hash, domain, ip or url.
TheHive displays the analyzer results as follows:
Maltiverse short report
Maltiverse long report
MalwareClustering
Andrea Garavaglia contributed this one a long time ago and we finally merged it into the Cortex-Analyzers repository. Andrea gave a talk about the background of this analyzer at the fourth MISP summit. You can watch it here.
Screenshots of the Malware Clustering analyzer, by Andrea Garavaglia
In order to use the analyzer, you need to point it to a Neo4j server (you need to supply the host, port, login & password).
PaloAlto Autofocus
This analyzer lets you leverage PaloAlto Autofocus services. Provided you are an Autofocus customer and you have access to their API, you need to configure the analyzer with your username and a token key.
The analyzer comes with 3 flavors:
AUTOFOCUS_GetSampleAnalysis lets you request a full report for a given hash.
AUTOFOCUS_SearchIOC lets you research for samples linked to specific IoCs with datatypes like domain, fqdn, user-agent, imphash, ip, mutex, tag and url. Please note that mutex and tag are not default datatypes in TheHive. You need to create them in TheHive before you can leverage them.
AUTOFOCUS_SearchJSON lets you research for samples based on a complex JSON query.
Important: TheHive has no templates corresponding to this analyzer have been published yet. They will be provided in the near future.
SpamhausDBL
This analyzer performs reputation lookups of a domain or a fqdn against Spamhaus Domain Block List (DBL).
TheHive displays the analyzer results as follows:
SpamhausDBL short reportSpamhausDBL long report
TeamCymruMHR
This analyzer queries Team Cymru’s Malware Hash Registry for known malware hashes (MD5 or SHA-1). If it is malware and known by the service, it returns the last time it has been seen along with an approximate anti-virus detection percentage.
Overview of the New Responders
KnowBe4
This responder allows the integration between TheHive/Cortex and KnowBe4’s User Events API. If a mail observable is tagged with a specified tag, corresponding to the responder’s configuration (e.g. phished), then the associated user will have a custom event added to their profile in KnowBe4.
A valid account on KnowBe4 and an API key are required to run this responder.
Minemeld
This responder sends observables you select to a Palo Alto Minemeld instance.
This responder performs actions on Wazuh, the open source security monitoring platform. It currently supports ad-hoc firewall blocking of ip observables.
Improvements
New PassiveTotal flavors
Thanks to Brandon Dixon, the PassiveTotal analyzer gains 3 new flavors, bringing the total to 11:
PassiveTotal_Trackerslet you make tracker lookups on observables of type domain, fqdn and ip.
PassiveTotal_Host_Pairs let you make host pair lookups on observables of type domain, fqdn and ip.
PassiveTotal_Componentslets you make components lookup on observables of type domain, fqdn and ip.
They come with their own report templates.
GreyNoise Analyzer
The analyzer has been updated to support GreyNoise API v2, thanks to the contribution of Whitney Champion (#562).
New Data Types Supported by Some Analyzers
VirusTotal_GetReporthas been updated to allow requests for observables of type fqdn.
Threatcrowd has been updated to allow requests for observables of type domain.
Shodan has been updated to allow requests for observables of type fqdn.
Fixes
[#602] The MISP analyzer was bumped to version 2.1 and is ready to use PyMISP 2.4.120.
Get It While Supply Lasts!
I’m Hype
If you are using the dockerized analyzers & responders, ensure to refresh your analyzers and responders in the Cortex WebUI. Connect as an orgadmin and go to the Organization menu. Click on the Analyzers tab and click on the Refresh analyzers button. Do the same for the Responders tab: click on the Refresh responders button.
I’m Country
If you are still using the old-style way of installing analyzers and responders, run the following commands:
cd path/to/Cortex-Analyzers git pull for I in analyzers/*/requirements.txt; do sudo -H pip3 install -U -r $I || true; done for I in responders/*/requirements.txt; do sudo -H pip3 install -U -r $I || true; done
Once done, ensure to refresh your analyzers and responders in the Cortex WebUI. Connect as an orgadmin and go to the Organization menu. Click on the Analyzers tab and click on the Refresh analyzers button. Do the same for the Responders tab: click on the Refresh responders button. Refer to the online Cortex documentation for further details.
Update TheHive Report Templates
If you are using TheHive, you must import the new report templates in your instance as follows:
click on Import templates button and select the downloaded package
Running Into Trouble?
Shall you encounter any difficulty, please join our user forum, contact us on Gitter, or send us an email at support@thehive-project.org. We will be more than happy to help!
Lo and behold, we aren’t dead & TheHive Project ain’t toast! So, foremost, Happy New Year folks (we are still in January, right?)! We have some nice gifts coming up for you, gifts that have required very heavy-duty work. Of course, you might complain that we haven’t been responsive as of late but hey, there’s only so much we can do, right?
Happy New Year Folks! (Photo by Saâd Kadhi)
We’ll talk about those gifts in the upcoming weeks. In the meantime, there’s a new Cortex version in town and we urge you to upgrade to it, particularly if you consider deploying several Cortex nodes as a cluster. Indeed, Cortex 3.0.1 fixes a missing dependency that is required to set up such an architecture. Additionally (and this is the part where you should be paying attention), this version fixes the display of error messages pertaining to analyzer and responder operations, and also ensure that old responders and analyzers no longer show up once you clicked on that Refresh button.
Fixes and Enhancements
#244 Prevent the Play secret key from being displayed in the logs at startup. Nonetheless, you can still display it (for troubleshooting purposes or to make things easier for attackers that might have access to the logs and be interested in such a world-changing secret) by using the --show-secret option when starting Cortex
#243 fixes the display of error messages when analyzers & responders fail
#240 An encoding issue causes an invalid format in the catalog file
#230 Elastic4play has dropped the ES cluster configuration option. Contributed by Adeel Ahmad
#164 Handle second/minute-rates limits on Flavors and Analyzers
Running Into Trouble?
Shall you encounter any difficulty during the upgrade process, please ask on our user forum, get in touch with the community on Gitter, or send us an email at support@thehive-project.org.
TheHive Project 