Analyzers in TheHive not updating?

[RtKelleher]

Analyzers in TheHive not updating?

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Ubuntu
OS version (client)	18.04 LTS
TheHive version / git hash	Hive 3.4 RC2, Cortex 3.0.0-RC4, Devel-Analyzers
Package Type	RPM
Browser type & version	Chrome Latest

Problem Description

The analyzers in HiveRC2 are not updating from Cortex correctly.

Specifically the following analyzers no longer exist and the catalog has been updated via .sh

• EMLParser_1
• FileInfo_5
• File_Strings

Complementary information

[nadouani]

If the analyzer has already been enabled in Cortex, then it will be always listed even if you update your catalog.

So, please double check that these analyzers are no longer available on Cortex. TheHive doesn't store the analyzers list.

[RtKelleher]

@nadouani Where is the Analyzers tab generated from? Without /Cortex_Analyzers present it's still reporting as available.

[RtKelleher]

After finally getting fed up with this issue, I installed Kibana and tracked down the issue. Cortex is storing the analyzers in Elasticsearch and the record isn't being delete, updated, or retired when the analyzer is deleted.

This may only be an issue for people who updated from 5/6, which was our upgrade path. However I had to delete the record of origin for FileInfo_6 in Cortex_4 to remove the entry from the responders due to the FileInfo_7 usage/release in Devel.

[To-om]

This issue is related to Cortex and is similar to TheHive-Project/Cortex#234.