TheHive and Cortex

TheHive runs analyzers through Cortex. A Cortex analyzer is a folder with a JSON definition and a script; this one scores IP observables, and the result shows up as a taxonomy tag (safe, suspicious or malicious) on the observable in TheHive.

Install the analyzer

1. Create the folder isIPsafe inside a directory listed in Cortex's analyzer.urls (for example /opt/cortex/analyzers/isIPsafe).
2. Add the definition as isIPsafe.json:

   {
     "name": "isIPsafe",
     "version": "1.0",
     "author": "isIPsafe",
     "url": "https://isipsafe.com/integrations/thehive",
     "license": "MIT",
     "description": "Abuse confidence, reports and categories for an IP address from isIPsafe.",
     "dataTypeList": ["ip"],
     "command": "isIPsafe/isipsafe.py",
     "baseConfig": "isIPsafe",
     "configurationItems": [
       {"name": "key", "description": "isIPsafe API key", "type": "string", "multi": false, "required": true}
     ]
   }

3. Add the script as isipsafe.py (executable), with requirements.txt listing cortexutils and requests:

   #!/usr/bin/env python3
   import requests
   from cortexutils.analyzer import Analyzer
   
   
   class IsIPsafe(Analyzer):
       def __init__(self):
           Analyzer.__init__(self)
           self.key = self.get_param("config.key", None, "Missing isIPsafe API key")
   
       def run(self):
           r = requests.get(
               "https://isipsafe.com/api/v1/check",
               params={"ip": self.get_data(), "maxAgeInDays": 90, "verbose": "true"},
               headers={"Authorization": "Bearer " + self.key},
               timeout=15,
           )
           if r.status_code != 200:
               self.error("isIPsafe returned HTTP %d: %s" % (r.status_code, r.text[:200]))
           self.report(r.json()["data"])
   
       def summary(self, raw):
           score = raw.get("abuseConfidenceScore", 0)
           level = "safe" if score == 0 else "suspicious" if score < 75 else "malicious"
           return {"taxonomies": [self.build_taxonomy(level, "isIPsafe", "Score", score)]}
   
   
   if __name__ == "__main__":
       IsIPsafe().run()

4. Restart Cortex, then enable isIPsafe_1_0 under Organization › Analyzers and enter your key. In TheHive, run it on any IP observable; the full report (score, reports, categories, network) is on the analyzer's result page.

Running Cortex with Docker images for analyzers? Build a small image from python:3-slim with the two files and the requirements, and point the definition's dockerImage at it instead of command.

Need a hand?

If something here does not work with your version of TheHive and Cortex, or you have improved it, tell us. We update these pages with what people send.

TheHive and Cortex and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.