Urlscan Analyzer

[Vince147]

Request Type

Analyzer

Work Environment

N/A

Description

Create an analyzer using Urlscan.io api. Urlscan is another service similar to Urlquery to scan URL to search urls, files, etc.

[Vince147]

I will check with the owner of that service if that ok.

[Vince147]

Email was sent. Waiting for Urlscan answer.

[Vince147]

Still no answer.

[Vince147]

Alright i will start the coding.

[3c7]

Hey @Vince147, how's the status on this one? Need help?

[heywoodlh]

I'm just getting into Hive/Cortex and never developed anything for it, but I've written a Python based API wrapper for urlscan.io: https://github.com/heywoodlh/urlscan-py.

Perhaps this could help with the integration? If I can help at all I would love to.

[mhgeay]

Hello @heywoodlh, @Vince147,
If you need help on that, ping me !
Good luck

[heywoodlh]

Yeah, I would love to help but don't know how to start. Please let me know the best way to contact you @mhgeay

[3c7]

Hello @heywoodlh,

there is some documentation about how to create an analyzer: https://github.com/TheHive-Project/CortexDocs/blob/master/api/how-to-create-an-analyzer.md#writing-an-analyzer.

Does it help you how to get started? Do you have specific questions?

[3c7]

There's also a gitter channel (https://gitter.im/TheHive-Project/TheHive) with people who are willing to help.

[BrevilleBro]

Hi,

We are currently building this analyser. We have built the Python component and are currently working on the template for it.

[mhgeay]

@BrevilleBro Ok great, no need to do the same stuff ! tell me if you need help for the documentation.

[BrevilleBro]

Hi @mhgeay, please feel free to modify the code to your liking and submit a PR with improvements if necessary.

I have released our initial version: https://github.com/BrevilleBro/cortex-analyzer-urlscanio

Please test it out, if all is good and working I will submit a PR to this repo.

[ninoseki]

Hi all, I've created a yet another urlscan.io analyzer.
https://github.com/ninoseki/cortex_urlscan_analyzer
It doesn't make a scan request, just only makes a search by ip, domain, hash or url.
(Because in my use case, I don't want to make a scan via the analyzer)

How is this?

[3c7]

Merged @ninoseki's PR.