Skip to content

Commit 3da19d4

Browse files
nusantara-selfnusantara-self
committed
Merge branch 'release/3.5.20'
2 parents 9230e07 + 2ce778e commit 3da19d4

4 files changed

Lines changed: 165 additions & 20 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
11
# Changelog
22

3+
## [3.5.19](https://github.com/TheHive-Project/Cortex-Analyzers/tree/3.5.19) (2025-07-24)
4+
5+
[Full Changelog](https://github.com/TheHive-Project/Cortex-Analyzers/compare/3.5.18...3.5.19)
6+
7+
**Merged pull requests:**
8+
9+
- JA4 FoxIO - JA4 fingerprint analyzer [\#1364](https://github.com/TheHive-Project/Cortex-Analyzers/pull/1364) ([nusantara-self](https://github.com/nusantara-self))
10+
- Gatewatcher - Add new features [\#1363](https://github.com/TheHive-Project/Cortex-Analyzers/pull/1363) ([remydewaGW](https://github.com/remydewaGW))
11+
- URLHaus - Add API Key requirement [\#1362](https://github.com/TheHive-Project/Cortex-Analyzers/pull/1362) ([Lohuss](https://github.com/Lohuss))
12+
313
## [3.5.18](https://github.com/TheHive-Project/Cortex-Analyzers/tree/3.5.18) (2025-06-23)
414

515
[Full Changelog](https://github.com/TheHive-Project/Cortex-Analyzers/compare/3.5.17...3.5.18)

‎analyzers/CIRCLVulnerabilityLookup/CIRCLVulnerabilityLookup.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
"registration_required": true,
3232
"subscription_required": false,
3333
"free_subscription": true,
34-
"serviceHomepage": "https://www.vulnerability-lookup.org/",
34+
"service_homepage": "https://www.vulnerability-lookup.org/",
3535
"service_logo": {
3636
"path": "assets/circl_vulnerabilitylookup.png",
3737
"caption": "CIRCL Vulnerability Lookup logo"

‎analyzers/FoxIO/JA4_FoxIO.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,9 @@ def run(self):
3535
"ja4tscan_fingerprint"
3636
]
3737

38-
for item in jsoned:
39-
if any(self.data == item.get(field) for field in fingerprint_fields):
40-
report_content.append(item)
38+
for item in jsoned:
39+
if any(self.data == item.get(field) for field in fingerprint_fields):
40+
report_content.append(item)
4141

4242
self.report({"report": report_content})
4343

@@ -57,4 +57,4 @@ def summary(self, report_content):
5757

5858

5959
if __name__ == "__main__":
60-
JA4_FoxIO().run()
60+
JA4_FoxIO().run()

‎thehive-templates/DomainMailSPFDMARC_1_1/long.html‎

Lines changed: 150 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,10 @@ <h4 class="panel-title">Domain SPF & DMARC Information: <strong>{{artifact.data}
1111
<dt>Base Domain:</dt>
1212
<dd>{{content.DomainMailSPFDMARC.base_domain}}</dd>
1313
<dt>DNSSEC:</dt>
14-
<dd>{{content.DomainMailSPFDMARC.dnssec}}</dd>
14+
<dd>
15+
<span ng-if="content.DomainMailSPFDMARC.dnssec">&#10003;</span>
16+
<span ng-if="!content.DomainMailSPFDMARC.dnssec">&#10007;</span>
17+
</dd>
1518
</dl>
1619
</div>
1720
<div class="col-md-6">
@@ -21,37 +24,119 @@ <h4 class="panel-title">Domain SPF & DMARC Information: <strong>{{artifact.data}
2124
</dl>
2225
<dl class="dl-horizontal" ng-if="content.DomainMailSPFDMARC.ns.warnings.length">
2326
<dt>NS Warnings:</dt>
24-
<dd><pre>{{content.DomainMailSPFDMARC.ns.warnings.join('\n')}}</pre></dd>
25-
</dl>
26-
<dl class="dl-horizontal" ng-if="content.DomainMailSPFDMARC.mx.hosts.length">
27-
<dt>MX Hosts:</dt>
28-
<dd>{{content.DomainMailSPFDMARC.mx.hosts.join(', ')}}</dd>
29-
</dl>
30-
<dl class="dl-horizontal" ng-if="content.DomainMailSPFDMARC.mx.warnings.length">
31-
<dt>MX Warnings:</dt>
32-
<dd><pre>{{content.DomainMailSPFDMARC.mx.warnings.join('\n')}}</pre></dd>
27+
<dd>
28+
<pre>{{content.DomainMailSPFDMARC.ns.warnings.join('\n')}}</pre>
29+
</dd>
3330
</dl>
3431
</div>
3532
</div>
3633

34+
<dl class="dl-horizontal" ng-if="content.DomainMailSPFDMARC.mx.hosts.length">
35+
<dt>MX Hosts:</dt>
36+
<dd>
37+
<table class="table table-striped">
38+
<thead>
39+
<tr>
40+
<th>Preference</th>
41+
<th>Hostname</th>
42+
<th>Addresses</th>
43+
<th>DNSSEC</th>
44+
<th>TLS</th>
45+
<th>STARTTLS</th>
46+
</tr>
47+
</thead>
48+
<tbody>
49+
<tr ng-repeat="mx in content.DomainMailSPFDMARC.mx.hosts">
50+
<td>{{mx.preference}}</td>
51+
<td>{{mx.hostname}}</td>
52+
<td>{{mx.addresses.join(', ')}}</td>
53+
<td>
54+
<span ng-if="mx.dnssec">&#10003;</span>
55+
<span ng-if="!mx.dnssec">&#10007;</span>
56+
</td>
57+
<td>
58+
<span ng-if="mx.tls">&#10003;</span>
59+
<span ng-if="!mx.tls">&#10007;</span>
60+
</td>
61+
<td>
62+
<span ng-if="mx.starttls">&#10003;</span>
63+
<span ng-if="!mx.starttls">&#10007;</span>
64+
</td>
65+
</tr>
66+
</tbody>
67+
</table>
68+
</dd>
69+
</dl>
70+
<dl class="dl-horizontal" ng-if="content.DomainMailSPFDMARC.mx.warnings.length">
71+
<dt>MX Warnings:</dt>
72+
<dd>
73+
<pre>{{content.DomainMailSPFDMARC.mx.warnings.join('\n')}}</pre>
74+
</dd>
75+
</dl>
76+
3777
<hr>
3878

3979
<h4 class="text-info">SPF Record</h4>
4080
<dl class="dl-horizontal">
4181
<dt>Record:</dt>
42-
<dd>{{content.DomainMailSPFDMARC.spf.record}}</dd>
82+
<dd><code>{{content.DomainMailSPFDMARC.spf.record}}</code></dd>
4383
<dt>Valid:</dt>
4484
<dd>{{content.DomainMailSPFDMARC.spf.valid}}</dd>
4585
<dt>Error:</dt>
4686
<dd>{{content.DomainMailSPFDMARC.spf.error || 'None'}}</dd>
87+
88+
<dt>DNS Lookups:</dt>
89+
<dd>
90+
{{content.DomainMailSPFDMARC.spf.dns_lookups}}
91+
<span ng-if="content.DomainMailSPFDMARC.spf.dns_lookups > 10" class="text-danger">⚠ Too many
92+
lookups</span>
93+
</dd>
94+
<dt>Void Lookups:</dt>
95+
<dd>{{content.DomainMailSPFDMARC.spf.dns_void_lookups}}</dd>
96+
4797
</dl>
4898

99+
<div ng-if="content.DomainMailSPFDMARC.spf.parsed">
100+
<h5 style="cursor: pointer;" ng-click="spfDetailsVisible = !spfDetailsVisible">
101+
<span class="text-info">SPF Parsed Tree</span>
102+
<span class="pull-right">
103+
<span ng-if="!spfDetailsVisible">[+]</span>
104+
<span ng-if="spfDetailsVisible">[−]</span>
105+
</span>
106+
</h5>
107+
<div ng-show="spfDetailsVisible" style="margin-top:10px;">
108+
<table class="table table-bordered table-condensed">
109+
<thead>
110+
<tr>
111+
<th>Mechanism</th>
112+
<th>Value</th>
113+
</tr>
114+
</thead>
115+
<tbody>
116+
<tr ng-repeat="entry in content.DomainMailSPFDMARC.spf.parsed.pass">
117+
<td>pass ({{entry.mechanism}})</td>
118+
<td>{{entry.value}}</td>
119+
</tr>
120+
<tr ng-repeat="entry in content.DomainMailSPFDMARC.spf.parsed.include">
121+
<td>include</td>
122+
<td>{{entry.domain}}</td>
123+
</tr>
124+
<tr ng-if="content.DomainMailSPFDMARC.spf.parsed.all">
125+
<td>all</td>
126+
<td>{{content.DomainMailSPFDMARC.spf.parsed.all}}</td>
127+
</tr>
128+
</tbody>
129+
</table>
130+
</div>
131+
</div>
132+
133+
49134
<hr>
50135

51136
<h4 class="text-info">DMARC Record</h4>
52137
<dl class="dl-horizontal">
53138
<dt>Record:</dt>
54-
<dd>{{content.DomainMailSPFDMARC.dmarc.record}}</dd>
139+
<dd><code>{{content.DomainMailSPFDMARC.dmarc.record}}</code></dd>
55140
<dt>Valid:</dt>
56141
<dd>{{content.DomainMailSPFDMARC.dmarc.valid}}</dd>
57142
<dt>Error:</dt>
@@ -61,7 +146,9 @@ <h4 class="text-info">DMARC Record</h4>
61146
</dl>
62147
<dl class="dl-horizontal" ng-if="content.DomainMailSPFDMARC.dmarc.warnings.length">
63148
<dt>Warnings:</dt>
64-
<dd><pre>{{content.DomainMailSPFDMARC.dmarc.warnings.join('\n')}}</pre></dd>
149+
<dd>
150+
<pre>{{content.DomainMailSPFDMARC.dmarc.warnings.join('\n')}}</pre>
151+
</dd>
65152
</dl>
66153

67154
<hr>
@@ -78,11 +165,59 @@ <h4 class="text-info">DMARC Tags</h4>
78165
<tbody>
79166
<tr ng-repeat="(tag, value) in content.DomainMailSPFDMARC.dmarc.tags">
80167
<td>{{tag}}</td>
81-
<td>{{value.value}}</td>
168+
<td>
169+
<span ng-if="tag === 'p'" ng-class="{
170+
'text-success': value.value === 'reject',
171+
'text-warning': value.value === 'quarantine',
172+
'text-danger': value.value === 'none'
173+
}">{{value.value}}</span>
174+
<span ng-if="tag !== 'p'">{{value.value}}</span>
175+
</td>
82176
<td>{{value.explicit ? 'Yes' : 'No'}}</td>
83177
</tr>
84178
</tbody>
85179
</table>
180+
181+
<hr>
182+
183+
<h4 class="text-info">MTA-STS</h4>
184+
<dl class="dl-horizontal">
185+
<dt>Valid:</dt>
186+
<dd>{{content.DomainMailSPFDMARC.mta_sts.valid ? 'Yes' : 'No'}}</dd>
187+
<dt>Error:</dt>
188+
<dd>{{content.DomainMailSPFDMARC.mta_sts.error || 'None'}}</dd>
189+
</dl>
190+
191+
<hr>
192+
193+
<h4 class="text-info">SMTP TLS Reporting</h4>
194+
<dl class="dl-horizontal">
195+
<dt>Valid:</dt>
196+
<dd>{{content.DomainMailSPFDMARC.smtp_tls_reporting.valid ? 'Yes' : 'No'}}</dd>
197+
<dt>Error:</dt>
198+
<dd>{{content.DomainMailSPFDMARC.smtp_tls_reporting.error || 'None'}}</dd>
199+
</dl>
200+
201+
<hr>
202+
203+
<h4 class="text-info">BIMI</h4>
204+
<dl class="dl-horizontal">
205+
<dt>Record:</dt>
206+
<dd><code>{{content.DomainMailSPFDMARC.bimi.record}}</code></dd>
207+
<dt>Valid:</dt>
208+
<dd>{{content.DomainMailSPFDMARC.bimi.valid ? 'Yes' : 'No'}}</dd>
209+
<dt>Selector:</dt>
210+
<dd>{{content.DomainMailSPFDMARC.bimi.selector}}</dd>
211+
<dt>Image Error:</dt>
212+
<dd>{{content.DomainMailSPFDMARC.bimi.image.error || 'None'}}</dd>
213+
</dl>
214+
<dl class="dl-horizontal" ng-if="content.DomainMailSPFDMARC.bimi.warnings.length">
215+
<dt>Warnings:</dt>
216+
<dd>
217+
<pre>{{content.DomainMailSPFDMARC.bimi.warnings.join('\n')}}</pre>
218+
</dd>
219+
</dl>
220+
86221
</div>
87222
</div>
88223

@@ -93,4 +228,4 @@ <h4 class="text-info">DMARC Tags</h4>
93228
<div class="panel-body">
94229
<p>{{content.errorMessage}}</p>
95230
</div>
96-
</div>
231+
</div>

0 commit comments

Comments
 (0)