Thehive: Automated Observable Extraction

[swannysec]

Request Type

Feature Request

Description

Automatic observable extraction from uploaded text or PDF files or from text blocks pasted into notes would be a huge workflow accelerator. It would likely be helpful if the user had to confirm the observables in some way so as to avoid unwanted/false positive results.

Complementary Information

Some potential starting points include iocminion, cacador, ioc_parser, or IOCextractor.

[megan201296]

I would also love to see this! Email attachment parsers would also be helpful.

[saadkadhi]

@megan201296 an email attachment is a file that you can add as an observable. When you do so, TheHive will perform some operations on it such as compute hashes. You may also apply analyzers to it.

As of 2.9.0, your browser determines the filetype but we are planning to improve file parsing in future releases (no date yet).

I hope you have noted that TheHive is supplied with an Outlook Msg Parser for parsing emails vs. attachments.

[mfosse71]

I agree this is a good idea!
IoC parser might be a good input for this

[vacmf]

I also like this idea. But together with a "flag" to say: "add all extracted observables" or "let me confirm and categorise extracted observables before adding".
This prevents unwanted findings like 8.8.8.8 or crl.microsoft.com to end up in the observables. I believe it's easier and more consistent to "review wanted" and "add", instead of "add" and "delete unwanted"

[jojoob]

Just a thought while I stumble over this request:
This could maybe be done with a cortex analyzer or responder. The file from which observable should be extracted must be added as an observable itself. Then it can be analyzed with an "extract observable analyzer" that creates the extracted ips, domains, etc. as new observables.

[nadouani]

This is possible today, but we need the validation of the analyst.

In the current version, when you run an analyzer, that extracts observables, the observable details page shows that list, and allows adding the selected extracted observables.

[nadouani]

[jojoob]

This is possible today, but we need the validation of the analyst.

Ah ok, so whats the problem then / why is this case still open?