TheHive-Project / TheHive

TheHive: a Scalable, Open Source and Free Security Incident Response Platform
https://thehive-project.org
GNU Affero General Public License v3.0
3.43k stars 623 forks source link

[Feature Request] Custom Observables #1435

Open navhits opened 4 years ago

navhits commented 4 years ago

Custom/Generic Observables field

Request Type

Feature Request

Work Environment

Question Answer
TheHive version / git hash 3.4.2, 7928e97d54abf70421676688bf62d96a85d18624

Description

At times we would need to add analyzers that would perform very specific task for which observables will not be of the provided types. For example: Cloud Account ID/ User ID to check for unauthorised access in logs.

An additional observable with dynamic type would be helpful in such scenarios. The analyzers that we create would specify the type. This might not be useful for tagging observables to analyzers but will be helpful for devs looking to create their own observable type and analyzers.

navhits commented 4 years ago

This might be somewhat relevant to Cortex also. Hence raised an issue 278 there.