Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FR] Upgrade OpenCTI analyzer for v4 compatibility #929

Closed
amr-cossi opened this issue Jan 20, 2021 · 2 comments
Closed

[FR] Upgrade OpenCTI analyzer for v4 compatibility #929

amr-cossi opened this issue Jan 20, 2021 · 2 comments
Assignees

Comments

@amr-cossi
Copy link
Contributor

Feature description
The current analyzer is only compatible with OpenCTI v3.
A new major version of OpenCTI (v4) has been released and support for v3 has been dropped.
This feature modifies the OpenCTI analyzer to have it compatible with OpenCTI v4 only.

Describe the solution you'd like
Two flavors are now available instead of one:

  • The first one searches for an exact match and returns only 1 observable when there is a hit
  • The second one does a fulltext search to return a list of observables matching a pattern. It is usefull to know if a domain name is present inside a URL in the platform for eg.

Additional context
As with the first version, I have provided TheHive templates which haven't been tested. If someone wants to have a look at them on a TheHive test instance before the merge it would be nice.

@amr-cossi
Copy link
Contributor Author

#928

@amr-cossi
Copy link
Contributor Author

Fixes the following bug: #919

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants