Elasticsearch-Analyzer

Elasticsearch Cortex analyzer implementation

Use Case

Make Elasticsearch queries from extracted observables

Done

JSON configuration file
Analyzer skeleton
Elasticsearch functions
Cortex input integration
Support several Elasticsearch hosts to query
Observable as query argument
Template writing
Elasticsearch query tuning (aggregations, based on timestamp...)

To Be Tested

Add proxy support
Add Certificate verification

To Be Done

Make new flavors

How to make a new flavor

Clone this repository
Install python requirement (pip install -r requirements.txt)
Add execution right to python script (chmod +x elasticsearch_analyzer.py)
Copy paste Elasticsearch_base.json.template to Elasticsearch_NAME.json
Fulfill Elasticsearch_NAME.json, replace XXXX vy values that are matching your environment
Add Elasticsearch_NAME as name value
Add your name as author value
Add your Elasticsearch Query (make always an aggregation for matching TheHive template output)
Add observable types on which users will launch your analyzer
DO NOT CHANGE baseConfig and service
Optional : Update Cortex configuration in order to use your own analyzers if it's already done
Restart Cortex
Make the analyzer configuration (set up ES URL, authentication settings ...)
Upload the template in TheHive
Analyze ! should be working