Skip to content

Commit 5098329

Browse files
nusantara-selfnusantara-self
authored
Merge pull request #1447 from TheHive-Project/opencti-v6-backwards-compatability-analyzers
OpenCTI v6 Analyzers
2 parents ad2ff56 + bf364d5 commit 5098329

5 files changed

Lines changed: 150 additions & 2 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,11 +133,13 @@ jobs:
133133
version=$(jq -r '.version // empty' "$json_file")
134134
description=$(jq -r '.description // empty' "$json_file")
135135
command=$(jq -r '.command // empty' "$json_file")
136+
requirements=$(jq -r '.requirements // "requirements.txt"' "$json_file")
136137
137138
echo "LOWERCASE_NAME=${lower_name}" >> $GITHUB_ENV
138139
echo "VERSION=${version}" >> $GITHUB_ENV
139140
echo "DESCRIPTION=${description}" >> $GITHUB_ENV
140141
echo "COMMAND=${command}" >> $GITHUB_ENV
142+
echo "REQUIREMENTS=${requirements}" >> $GITHUB_ENV
141143
142144
if [[ "$version" == *.* ]]; then
143145
version_split=$(echo "$version" | cut -d '.' -f 1)
@@ -296,6 +298,7 @@ jobs:
296298
platforms: ${{ env.PLATFORMS }}
297299
push: true
298300
tags: ${{ env.IMAGE_TAGS }}
301+
build-args: REQUIREMENTS=${{ env.REQUIREMENTS }}
299302
cache-from: type=gha
300303
cache-to: type=gha,mode=max,scope=shared
301304
labels: |
@@ -614,11 +617,13 @@ jobs:
614617
version=$(jq -r '.version // empty' "$json_file")
615618
description=$(jq -r '.description // empty' "$json_file")
616619
command=$(jq -r '.command // empty' "$json_file")
620+
requirements=$(jq -r '.requirements // "requirements.txt"' "$json_file")
617621
618622
echo "LOWERCASE_NAME=${lower_name}" >> $GITHUB_ENV
619623
echo "VERSION=${version}" >> $GITHUB_ENV
620624
echo "DESCRIPTION=${description}" >> $GITHUB_ENV
621625
echo "COMMAND=${command}" >> $GITHUB_ENV
626+
echo "REQUIREMENTS=${requirements}" >> $GITHUB_ENV
622627
623628
if [[ "$version" == *.* ]]; then
624629
version_split=$(echo "$version" | cut -d '.' -f 1)
@@ -777,6 +782,7 @@ jobs:
777782
platforms: ${{ env.PLATFORMS }}
778783
push: true
779784
tags: ${{ env.IMAGE_TAGS }}
785+
build-args: REQUIREMENTS=${{ env.REQUIREMENTS }}
780786
cache-from: type=gha
781787
cache-to: type=gha,mode=max,scope=shared
782788
labels: |
@@ -1095,11 +1101,13 @@ jobs:
10951101
version=$(jq -r '.version // empty' "$json_file")
10961102
description=$(jq -r '.description // empty' "$json_file")
10971103
command=$(jq -r '.command // empty' "$json_file")
1104+
requirements=$(jq -r '.requirements // "requirements.txt"' "$json_file")
10981105
10991106
echo "LOWERCASE_NAME=${lower_name}" >> $GITHUB_ENV
11001107
echo "VERSION=${version}" >> $GITHUB_ENV
11011108
echo "DESCRIPTION=${description}" >> $GITHUB_ENV
11021109
echo "COMMAND=${command}" >> $GITHUB_ENV
1110+
echo "REQUIREMENTS=${requirements}" >> $GITHUB_ENV
11031111
11041112
if [[ "$version" == *.* ]]; then
11051113
version_split=$(echo "$version" | cut -d '.' -f 1)
@@ -1258,6 +1266,7 @@ jobs:
12581266
platforms: ${{ env.PLATFORMS }}
12591267
push: true
12601268
tags: ${{ env.IMAGE_TAGS }}
1269+
build-args: REQUIREMENTS=${{ env.REQUIREMENTS }}
12611270
cache-from: type=gha
12621271
cache-to: type=gha,mode=max,scope=shared
12631272
labels: |

‎analyzers/OpenCTI/Dockerfile‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
FROM python:3-alpine
22
WORKDIR /worker
33

4+
ARG REQUIREMENTS=requirements.txt
5+
46
# Install libmagic (development package provides libmagic.so symlink)
57
RUN apk add --no-cache file-dev
68

7-
COPY requirements.txt OpenCTI/
8-
RUN test ! -e OpenCTI/requirements.txt || pip install --no-cache-dir -r OpenCTI/requirements.txt
9+
COPY requirements*.txt OpenCTI/
10+
RUN test ! -e OpenCTI/${REQUIREMENTS} || pip install --no-cache-dir -r OpenCTI/${REQUIREMENTS}
911
COPY . OpenCTI/
1012

1113
ENTRYPOINT ["python", "OpenCTI/opencti.py"]

‎analyzers/OpenCTI/OpenCTI_v6_SearchExactObservable.json‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"name": "OpenCTI_v6_SearchExactObservable",
3+
"author": "ANSSI",
4+
"license": "AGPL-V3",
5+
"url": "https://github.com/TheHive-Project/Cortex-Analyzers/",
6+
"version": "2.0",
7+
"description": "Query multiple OpenCTI v6 instances for a specific observable.",
8+
"dataTypeList": [
9+
"domain",
10+
"ip",
11+
"url",
12+
"fqdn",
13+
"uri_path",
14+
"user-agent",
15+
"hash",
16+
"mail",
17+
"mail_subject",
18+
"registry",
19+
"regexp",
20+
"other",
21+
"filename",
22+
"mail-subject"
23+
],
24+
"config": {
25+
"service": "search_exact"
26+
},
27+
"requirements": "requirements_v6.txt",
28+
"baseConfig": "OpenCTI_v6",
29+
"command": "OpenCTI/opencti.py",
30+
"configurationItems": [
31+
{
32+
"name": "name",
33+
"description": "Name of OpenCTI servers",
34+
"multi": true,
35+
"required": false,
36+
"type": "string"
37+
},
38+
{
39+
"name": "url",
40+
"description": "URL of OpenCTI servers",
41+
"type": "string",
42+
"multi": true,
43+
"required": true
44+
},
45+
{
46+
"name": "key",
47+
"description": "API key for each server",
48+
"type": "string",
49+
"multi": true,
50+
"required": true
51+
},
52+
{
53+
"name": "cert_check",
54+
"description": "Verify server certificate",
55+
"type": "boolean",
56+
"multi": false,
57+
"required": true,
58+
"defaultValue": true
59+
}
60+
],
61+
"registration_required": true,
62+
"subscription_required": false,
63+
"free_subscription": false,
64+
"service_homepage": "https://www.opencti.io",
65+
"service_logo": {"path":"assets/logo_opencti.png", "caption": "logo"},
66+
"screenshots": []
67+
}

‎analyzers/OpenCTI/OpenCTI_v6_SearchObservables.json‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"name": "OpenCTI_v6_SearchObservables",
3+
"author": "ANSSI",
4+
"license": "AGPL-V3",
5+
"url": "https://github.com/TheHive-Project/Cortex-Analyzers/",
6+
"version": "2.0",
7+
"description": "Query multiple OpenCTI v6 instances for a list of observables matching a pattern.",
8+
"dataTypeList": [
9+
"domain",
10+
"ip",
11+
"url",
12+
"fqdn",
13+
"uri_path",
14+
"user-agent",
15+
"hash",
16+
"mail",
17+
"mail_subject",
18+
"registry",
19+
"regexp",
20+
"other",
21+
"filename",
22+
"mail-subject"
23+
],
24+
"config": {
25+
"service": "search_observables"
26+
},
27+
"requirements": "requirements_v6.txt",
28+
"baseConfig": "OpenCTI_v6",
29+
"command": "OpenCTI/opencti.py",
30+
"configurationItems": [
31+
{
32+
"name": "name",
33+
"description": "Name of OpenCTI servers",
34+
"multi": true,
35+
"required": false,
36+
"type": "string"
37+
},
38+
{
39+
"name": "url",
40+
"description": "URL of OpenCTI servers",
41+
"type": "string",
42+
"multi": true,
43+
"required": true
44+
},
45+
{
46+
"name": "key",
47+
"description": "API key for each server",
48+
"type": "string",
49+
"multi": true,
50+
"required": true
51+
},
52+
{
53+
"name": "cert_check",
54+
"description": "Verify server certificate",
55+
"type": "boolean",
56+
"multi": false,
57+
"required": true,
58+
"defaultValue": true
59+
}
60+
],
61+
"registration_required": true,
62+
"subscription_required": false,
63+
"free_subscription": false,
64+
"service_homepage": "https://www.opencti.io",
65+
"service_logo": {"path":"assets/logo_opencti.png", "caption": "logo"},
66+
"screenshots": []
67+
}

‎analyzers/OpenCTI/requirements_v6.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
cortexutils
2+
pycti>=6.0.0,<7.0.0
3+
six>=1.14.0

0 commit comments

Comments
 (0)