Updating Cuckoo Analyzer/Report Templates #418
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 3 commits
February 5, 2019 08:47
The issue with using hosts with the latest Cuckoo is that the hosts data only contains IP addresses and no domains or countries like it did in the past. Instead we can use the domains data parameter to pull in IP and Domain which is much more beneficial then the reports today. We will need to update the report template as well.
This template update will allow the report to use the newly modified domains category for IP/Domain instead of hosts which only provided an IP address.
This will update the report template to use the newly modified domains data instead of hosts which only includes IP addresses.
|
This will break old cuckoo reports. I know this is compatible with the latest Cuckoo 2.0.6 build. |
|
This still might not cover everything. I am re-evaluating this report/analyzer. Instead of using Domains and having a single IP it will be better to get the DNS responses since one hostname could have many IP Addresses.
|
saadkadhi
added
category:enhancement
jeromeleonard
added a commit
that referenced
this pull request
Feb 20, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Request Type
Analyzer
Work Environment
N/A
Description
The current Cuckoo Sandbox reports do not fully function with 2.0.6 Cuckoo Reports. Instead of using just hosts for the report data, we need to use domains to retrieve ip/domain combination.
Possible Solutions
The solution is to update the analyzer and report templates to properly show the report data.
Complementary information
I have a fix for the solution however it would also then be nice to extract the observables from the newly added ip/domain combinations.
Here is what a report currently looks with Cuckoo 2.0.6:
And this is after the analyzer and report fix:
