We are proud to announce the immediate availability of Cerana 0.9 (TheHive 3.0.9) and Cortex 2.0.4. These hotfix releases address a number of issues and we encourage you to update your current installation at your earliest opportunity. For your comfort and sanity. Seriously.
We also took this opportunity to update Cortex analyzers to fix issues with CIRCL Passive SSL, Hybrid Analysis, and the Joe Sandbox URL Analysis template. Moreover, we have updated the cortexutils library to set the taxonomy level to info if it is invalid. To upgrade cortexutils to 1.2.4:
Note: the Bluecoat analyzer was removed since it does not comply with the updated Terms of Service of Symantec Web Pulse SiteReview. Symantec does no longer permit programmatic querying of the service.
Fixes in Cerana 0.9
#527: display long reports when the analyst clicks on the corresponding short reports. Meh!
#541: make the drop-down menu for case templates scroll when there is a truckload of them.
Something does not work as expected? You have troubles installing or upgrading? Spotted new bugs? No worries, please open issues on GitHub or comment on existing ones, join our user forum, contact us on Gitter, or send us an email at support@thehive-project.org. We are here to help.
Correction: April 14, 2018 An earlier version of this post did not mention that the Bluecoat analyzer was removed in the latest Cortex Analyzers repository release.
Two months ago, TheHive Chefs announced that Cortex passed the 30 analyzers mark as they added HybridAnalysis, EmergingThreats and Shodan, all three contributed by our continuously growing user community.
It’s 2018 already and to wish you a very happy new DFIR year, Nils and Jérôme got out of their way and reviewed many outstanding pull requests for new analyzers and fixed several bugs. Kudos bees!
The latest release of Cortex-Analyzers, v 1.8.0, contains not one, not two, not even three but ten new analyzers! Isn’t that good omen for a fresh new year fighting cybercrime?
The ten new analyzers, described below, are:
Bluecoat: contributed by our longtime friends from CERT La Poste.
MISP WarningLists: Nils strikes again (watch out Jérôme! the youngster is gonna leave you way behind ;).
Onyphe: contributed by Pierre Baudry and Adrien Barchapt. It comes in five different flavors.
PayloadSecurity: submitted by Emmanuel Torquato. The analyzer comes in two flavors.
Robtex: added by… Nils again! It has three flavors.
SinkDB: guess who developed that one? Wow, impressive! How did you figure it out? Yes, Nils!
Tor Blutmagie: contributed by Marc-André Doll.
Tor Project: also contributed by Marc-André Doll.
We would like to wholeheartedly thank all the individuals and teams listed above for their invaluable contributions. So a big merci for your work!
Bluecoat
The Bluecoat analyzer queries the Symantec – previously known as Bluecoat – WebPulse site review API for the currently assigned site category of URLs or domains. The analyzer needs no further configuration. When executed through TheHive, the analyzer produces short and long reports as shown below:
TheHive: Bluecoat 1.0 Analyzer – Short and Long Report Samples
C1fApp
The C1fApp analyzer queries the C1fApp service, an Open Source threat feed aggregation application, using the API for IP addresses, domains and URL.
Before using the analyzer, you need to create an account on the C1fApp website and get the associated API key which you’ll need to provide as a value for the key parameter of the analyzer config section of /etc/cortex/application.conf as shown below. Once you’ve done so, you’ll need to restart Cortex.
C1fApp {
service="query"
key="<insert API key here>"
url="https://www.c1fapp.com/cifapp/api/"
}
When launched using TheHive, the analyzer produces short and long reports such as the following:
TheHive: C1fApp 1.0 Analyzer – Short and Long Report Samples
Censys.io
Censys.io continually monitors every reachable server and device on the Internet, so you can search for them and analyze them in real time. Using the corresponding analyzer, information about a website certificate can be obtained using the associated IP, domain or certificate hash.
In order to use this analyzer, an account at censys.io has to be registered and the API ID and secret need to be added to the Cortex configuration file:
Censys {
uid="<Your ID here>"
key="<Your secret here>"
}
Once done, you’ll have to restart Cortex. When ran from TheHive, the analyzer produces short and long reports such as the following:
TheHive: Censys 1.0 Analyzer – Short and Long Report Samples
Details about the ports can be obtained with a click on the specific button.
MISP WarningLists
In order to detect false positives soon enough in the analysis process, our good friends at the MISP Project published their so called warning lists which contain lists of well-known services or indicators.
This analyzer queries observables against the MISP warning lists. Observables can be an IP address, a hash, a domain, a FQDN or a URL.
To iterate through all the warning lists, the repository itself must be available on the Cortex instance:
We highly recommend you create a cron entry or use a similar mechanism to keep the lists fresh. While the default path for the lists is the misp-warninglists subdirectory it can be adjusted in the configuration file:
When called from TheHive, the analyzer produces short and long reports as shown below:
TheHive: MISP WarningLists 1.0 Analyzer – Short and Long Report Samples
As you can see, The MISP WarningLists analyzer checks if the repository is up-to-date 😉
Onyphe
The Onyphe analyzer leverages Onyphe’s API to query the service, which provides data about the IP address space and the publicly available information in a single, handy location.
The service comes in five flavors:
Onyphe_Forward: retrieves forward DNS lookup information we have for the given IPv4/IPv6 address with history of changes.
Onyphe_Geolocate: retrieves geolocation information for the given IPv4/IPv6 address.
Onyphe_Ports: retrieves synscan information we have for the given IPv4/IPv6 address with history of changes.
Onyphe_Reverse: retrieves reverse DNS lookup information we have for the given IPv4/IPv6 address with history of changes.
Onyphe_Threats: retrieves Onyphe threats information on anIPv4/IPv6 address with associated history.
To use the analyzer, you need to create an account on the Onyphe website. Provide the API key associated with your account as a value for the key parameter and add the lines below to the config section of /etc/cortex/application.conf then restart the cortex service.
Onyphe {
key = "<insert API key here>"
}
When ran from TheHive, the analyzer produces short and long reports such as the following:
TheHive: Onyphe 1.0 Analyzer – Short and Long Report Samples
PayloadSecurity
The PayloadSecurity analyzer let you submit observables to a on-premises PayloadSecurity instance. To use it, you need to create an account on the PayloadSecurity service. Provide the API/secret pair as values for the key and secretparameters, collect the URL and environmentid of the service, and add the lines below to the config section of /etc/cortex/application.conf. Then restart the cortex service.
When launched through TheHive, the analyzer produces short and long reports such as the following:
TheHive: PayloadSecurity 1.0 Analyzer – Short and Long Report Samples
Robtex
When collecting data about IPs, domains and FQDNs, Robtex can be a good source of information. According to their statistics, they logged over 20 billion DNS resource records. The corresponding analyzer comes in three flavors:
Robtex_Forward_PDNS_Query: checks domains/FQDNs using the Robtex Passive DNS API
Robtex_IP_Query: checks IPs using the Robtex IP API
Robtex_Reverse_PDNS_Query: checks IPs using the Robtex reverse Passive DNS API
The analyzer uses the free Robtex API which needs no subsequent configuration. However, the free API limits the rate and amount of returned data.
When executed using TheHive, the analyzer produces short and long reports such as the following:
TheHive: Robtex 1.0 Analyzer – Short and Long Report Samples
SinkDB
SinkDB is a private service provided by abuse.ch which collects sinkholed IPs. Access to the service is allowed to trusted partners only. If you think you qualify, you can request an access using the form available on the SinkDB website. This is most likely only granted to certain CSIRTs and CERTs and not to individuals.
Provide the API key associated with your account as a value for the key parameter and add the lines below to the config section of /etc/cortex/application.conf then restart the cortex service.
SinkDB {
key="<insert API key here>"
}
When ran from TheHive, the analyzer produces short and long reports such as the following:
TheHive: SinkDB 1.0 Analyzer – Short and Long Report Samples
Tor Blutmagie
Tor Blutmagie analyzer extracts data from torstatus.blutmagie.de and checks if an observable is linked to a Tor node. The observable can be an IP address, a FQDN or a domain.
In order to check if an IP, domain or FQDN is a Tor exit node, this analyzer queries the Tor status service at Blutmagie.de. The analyzer uses a caching mechanism in order to save some time when doing multiple queries, so the configuration includes parameters for the cache directory and the caching duration.
Provide the lines below to the config section of /etc/cortex/application.conf then restart the cortex service.
When ran from TheHive, the analyzer produces short and long reports such as the following:
TheHive: Tor Blutmagie 1.0 Analyzer – Short and Long Report Samples
Tor Project
Tor Project analyzer has also been contributed by Marc-André Doll. As the above analyzer, this one checks if an observable is a Tor exit node. This time, however, the source of information is the official Tor network status which can be queried for IP addresses only.
The accepts another parameter, ttl, which is the threshold in seconds for exit nodes before they get discarded. Provide the lines below to the config section of /etc/cortex/application.conf then restart the cortex service.
Shall you encounter any difficulty, please join our user forum, contact us on Gitter, or send us an email at support@thehive-project.org. We will be more than happy to help!
Correction: January 12, 2018
The post was updated to add the full name of the author of the PayloadSecurity analyzer.
Update: 2 days after publishing this blog post, we’ve released Cerana 0.1 (TheHive 3.0.1) which fixes a number of issues. We encourage you to use 3.0.1 instead of 3.0.0.
The friendly honeybees at TheHive’s code kitchen were pretty busy lately even though winter came and temperatures have been close to zero Celsius in Paris, France. As we wrote a couple of weeks ago on this very blog, we are happy to announce Cerana to the world, available immediately.
Cerana or TheHive 3.0.0 is the latest (and obviously greatest) release of a now highly popular open source, free Security Incident Response Platform (or SIRP for short). Its flagship feature in comparison to previous releases is Dynamic Dashboards.
Dynamic Dashboards
Dynamic Dashboards replace the Statistics module in Cerana to allow you to explore the data available in Elasticsearch, which TheHive uses for storage, in many ways. For example, you can have a usage breakdown of Cortex analyzers, the number of open cases per assignee, the number of alerts per source (MISP, email notifications, DigitalShadows, Zerofox, Splunk, …), the number of observables that have been flagged as IOCs in a given time period, how many attributes were imported from MISP instances, top 10 tags of imported MISP attributes or incident categories.
Dynamic Dashboards
Dynamic Dashboards can be created by an analyst and kept private or shared with the other team members. Dashboards can also be exported and imported into another instance. This would facilitate community participation in the establishment of valuable data exploration graphs to drive DFIR activity and seek continuous improvement.
When you’ll migrate to Cerana, you won’t have to build dashboards from scratch. We recreated more or less those which were available under the Statistics view and included them in the Cerana build.
Cortex and MISP Health Status
Cerana will also allow you to monitor the health status of all the Cortex and MISP instances that it is connected to. In the bottom right corner of TheHive’s Web UI, the Cortex and MISP logos appear when you have configured the integration with those products as in previous releases. However, the logos will have a small outer circle which color will change depending on whether Cortex and/or MISP instances are reachable or not.
Cortex & MISP Health
If TheHive can’t reach N out of M Cortex/MISP instances, the outer circle will be orange. If it can’t reach all M instances, the circle will red. If everything is fine, the circle will be green. The exact status of each Cortex/MISP instance can be seen in the About page. And when you try to run analyzers on a Cortex which cannot be reached, TheHive will tell you so as well.
Cortex & MISP: Version & Status
Sighted IOCs
In previous releases of TheHive, observables can be flagged as IOCs. However, this doesn’t necessarily mean you’ve seen them in your network. Think for example of a suspicious attachment which you’ve submitted to Cuckoo or Joe Sandbox through Cortex. The analyzer returns some C2 addresses to which the sample tries to connect to. You’d be right to add those C2 addresses to your case and flag them as IOCs. Then you search for them in your proxy logs and you find connection attempts to one out of four. In previous versions, you’d add a seen label but this would be inconsistent among analysts. One may use found instead. Another will add a description and no labels.
To avoid such situations and give you a simple way to declare an IOC as seen, Cerana adds a sighted toggle which you can switch on/off. We will leverage this toggle in future versions to indicate sightings when sharing back cases to MISP.
Other Features and Improvements
Cerana contains numerous other features and improvements such as:
Case template import, export
The ability to assign default values to metrics and custom fields to case templates
The ability to assign by default tasks to their rightful owners in case templates
Show already known observables when previewing MISP events in the Alerts page
Add autonomous systems to the list of default datatypes
Single-sign on using X.509 certificates (in BETA currently)
We will update the documentation for Cerana in the upcoming weeks. So stay tuned.
Download & Get Down to Work
If you have an existing installation of TheHive, please follow the migration guide.
If you are performing a fresh installation, read the installation guide corresponding to your needs and enjoy. Please note that you can install TheHive using an RPM or DEB package, use Docker, install it from a binary or build it from sources.
Support
Something does not work as expected? You have troubles installing or upgrading? No worries, please join our user forum, contact us on Gitter, or send us an email at support@thehive-project.org. We are here to help.
We are pleased to announce the availability of 2 new Cortex analyzers and an update to 2 existing ones:
New: VMRay and FireHOL
Updated: Joe Sandbox and Fortiguard URL Category
We would like to thank Nils Kuhnert from CERT-BUND, CERT-BDF and Eric Capuano for their precious contributions.
To install the new analyzers, grab the Cortex-Analyzers repository and unpack its content (or git pull the master branch) in your existing /path/to/cortex-analyzers. Then follow the Cortex analyzers guide.
To import the new report templates in your instance of TheHive:
click on Import templates button and select the downloaded package
VMRay
The VMRay analyzer has been submitted by Nils Kunhert from CERT-BUND. It lets you run a file in a local or remote (cloud) VMRay sandbox. The analyzer also lets you check existing analysis reports.
The analyzer accepts files and hashes as input. VMRay is a commercial service and you need an API key to run the analyzer. To make it work, install the requestsPython library. It should already have been installed since it is used by other analyzers as well.
To use the analyzer, add the following section to the Cortex configuration file (application.conf):
VMRay {
url = ""
key = ""
certpath = ""
}
When called from TheHive, the following output is produced:
TheHive: VMRay Analyzer – Short and Long Report Samples
Important note: an analysis on VMRay, like on any other sandbox, can take a long time. That is why the analyzer tries to fetch the report until it is ready.
FireHOL
The FireHOL analyzer has been submitted by Nils Kuhnert from CERT-BUND. It lets you use the lists maintained by FireHOL project and check if an IP resides in one of them. FireHOL is an open source project. The analyzer reports the block lists in which an IP resides with the latest updated ones displayed first. To make it work, you’ll need to download the lists in a directory first (and it would be wise to do it on a regular fashion using a cron entry for example):
The ignoreolderthandays parameter lets you tell the analyzer to ignore matches found in lists that have not been refreshed in <int> days where <int> is an integer.
When called from TheHive, the following output is produced:
TheHive: FireHOL Analyzer – Short and Long Report Samples
Joe Sandbox
Thanks to CERT-BDF, the Joe Sandbox analyzer has been updated to support Joe Sandbox Cloud service beside the on-premises version (Ultimate). Like with other Joe Sandbox services, you need to add the following section to the Cortex configuration file (application.conf):
JoeSandbox {
url = ""
apikey = ""
}
Fortiguard URL Category
Thanks to Eric Capuano, the Fortiguard URL Category analyzer is working again. Eric has modified it to handle the changes made by Fortiguard to their free online API.
Correction: May 23, 2017
An earlier version of this post used ignoredays instead of ignoreolderthandays for the FireHOL Blocklists analyzer. This parameter has also been described.
We are thrilled to announce that Cortex has two new analyzers: Joe Sandbox and MISP Search. Moreover, we have produced new analyzer report templates for TheHive and improved existing ones.
Joe Sandbox
Cortex: New Joe Sandbox Analyzer
Joe Sandbox, by Joe Security LLC, is a very powerful malware analysis platform that has been around for many years and comes in two flavors: cloud and on-premises. The Joe Sandbox Cortex analyzer has been tested using an on-prem Joe Sandbox Ultimate version and can process URLs and files. The analyzer can process files with or without Internet access.
To use the analyzer, you must provide the API key of your Joe Sandbox instance. You must log in to Joe Sandbox, click on your account name, then on Settings and on the API Key tab.
Cortex: Joe Sandbox Output Example
We have produced a report template for the Joe Sandbox analyzer output resulting from file analysis. The URL analysis report template is not yet available but it should be in a few days.
TheHive: Joe Sandbox Analyzer – Short and Long Report Samples
MISP Search
Cortex: New MISP Search Analyzer
It is no longer necessary to present MISP, the de facto standard of threat sharing. The new MISP Search analyzer will let you search events containing the observable you provide as an input. It applies to a lot of observable types as you can see in the screenshot above.
To use it, you’ll need to supply the API key available in the MISP UI interface.
Cortex: MISP Analyzer Output Sample
Nils Kuhnert created an alternate MISP Search analyzer which has the ability to query multiple MISP instances. We are currently reviewing his submission along with several other analyzers he contributed before improving the newly released MISP Search analyzer.
PassiveTotal Report Templates
While we published the PassiveTotal analyzer weeks ago, TheHive didn’t have report templates for it at the time. We have now new, shiny short and long report templates for most of the services provided by the PT analyzer.
TheHive: PassiveTotal PassiveDNS – Long Report Sample
DomainTools Whois Lookup Report Template
The short report templates of the DomainTools Whois Lookup analyzer has been improved. We now use a taxonomy to provide more context and differentiate between the DomainTools and PassiveTotal Whois results.
VirusTotal Get Report and VirusTotal Scan Report Templates
The short report templates for both services have also been improved to use a taxonomy to provide additional context and distinguish their results from the PassiveTotal Malware service.
Get the new analyzers
To install the new analyzers, grab the Cortex-Analyzers repository and unpack its content (or git pull the master branch) in your existing /path/to/cortex-analyzers.
The Joe Sandbox analyzer does not need any additional Python library if you have already installed Cortex and the analyzers following the guide we provide. To use it, edit your Cortex configuration file (/path/to/cortex/application.conf) and add the following lines in the analyzer section:
JoeSandbox {
apikey="..."
url="..."
}
By default, Joe Sandbox will time out the analysis after 30*60 seconds (30 minutes). Additionally, the analyzer will wait for the Joe Sandbox server to respond within 30 seconds. If no response is received within this period, it will time out. If you want to override these values, you’ll need to add the following lines in the analyzer section:
The MISP Search analyzer requires pymisp. Use the following command line to install the required library:
sudo pip install pymisp
Then edit your Cortex configuration file (/path/to/cortex/application.conf) and add the following lines in the analyzer section:
MISP {
api_key="..."
url="..."
}
Please note that you must restart Cortex to take the changes into account. The current version has no persistence so you’ll lose all your existing jobs.
click on Import templates button and select the downloaded package
Running Into Trouble?
Shall you encounter any difficulty, please join our user forum, contact us on Gitter, or send us an email at support@thehive-project.org. We will be more than happy to help you!