mirror of
https://github.com/valitydev/Cortex-Analyzers.git
synced 2024-11-06 09:05:19 +00:00
Merge branch 'feature/test_doc' into develop
This commit is contained in:
commit
3d5592c895
@ -397,12 +397,12 @@ If templates are imported into TheHive:
|
||||
- Short reports are displayed in the observable list and in the detailed
|
||||
observable page.
|
||||
|
||||
![VT short report](./images/sc-short-vt.png)
|
||||
![VT short report](../images/sc-short-vt.png)
|
||||
|
||||
- Long reports are displayed when clicking on the short reports or in the
|
||||
detailed observable page.
|
||||
|
||||
![VT long report](./images/sc-long-vt.jpg)
|
||||
![VT long report](../images/sc-long-vt.jpg)
|
||||
|
||||
|
||||
#### Writing Templates
|
113
docs/dev_guides/how-to-test-an-analyzer.md
Normal file
113
docs/dev_guides/how-to-test-an-analyzer.md
Normal file
@ -0,0 +1,113 @@
|
||||
# How to test you analyzers/responder
|
||||
|
||||
## Pre-requisites
|
||||
|
||||
Create 2 folders named `input` and `output` in the folder of the neuron to test, and the file `input.json`:
|
||||
|
||||
```
|
||||
├── input
|
||||
│ └── input.json
|
||||
└── output
|
||||
```
|
||||
|
||||
!!! "These path have been added to .gitignore file and thus are not tracked by git."
|
||||
|
||||
- `input/input.json`
|
||||
|
||||
```json
|
||||
{
|
||||
"data": "185.162.131.25",
|
||||
"tlp": 0,
|
||||
"parameters": {},
|
||||
"dataType": "ip",
|
||||
"config": {
|
||||
"jobTimeout": 30,
|
||||
"service": "",
|
||||
"url": "",
|
||||
"api_key": "",
|
||||
"proxy_http": "",
|
||||
"proxy": {
|
||||
"http": "",
|
||||
"https": ""
|
||||
},
|
||||
"max_tlp": 2,
|
||||
"max_pap": 2,
|
||||
"check_tlp": true,
|
||||
"check_pap": true,
|
||||
"proxy_https": "",
|
||||
"cacerts": "",
|
||||
"auto_extract_artifacts": false,
|
||||
"jobCache": 10
|
||||
},
|
||||
"pap": 2,
|
||||
"message": "1"
|
||||
```
|
||||
|
||||
|
||||
|
||||
## Running the program
|
||||
|
||||
- Using main program
|
||||
```bash
|
||||
/path to/analyzers/DShield/DShield_lookup.py .
|
||||
```
|
||||
|
||||
- Using docker image and docker-compose
|
||||
```bash
|
||||
docker run --rm -v ${PWD}:/job cortexneurons/dshield_lookup:devel
|
||||
```
|
||||
|
||||
|
||||
Running the program successfully should create at least a new file called `output.json` in the output directory:
|
||||
|
||||
- `output/output.json`
|
||||
|
||||
```json
|
||||
{
|
||||
"success": true,
|
||||
"summary": {
|
||||
"taxonomies": [
|
||||
{
|
||||
"level": "safe",
|
||||
"namespace": "DShield",
|
||||
"predicate": "Score",
|
||||
"value": "0 count(s) / 0 attack(s) / 1 threatfeed(s)"
|
||||
}
|
||||
]
|
||||
},
|
||||
"artifacts": [
|
||||
{
|
||||
"type": "autonomous-system",
|
||||
"value": "14576"
|
||||
},
|
||||
{
|
||||
"type": "mail",
|
||||
"value": "abuse@king-servers.com"
|
||||
}
|
||||
],
|
||||
"full": {
|
||||
"ip": "185.162.131.25",
|
||||
"count": 0,
|
||||
"attacks": 0,
|
||||
"lastseen": "None",
|
||||
"firstseen": "None",
|
||||
"updated": "None",
|
||||
"comment": "None",
|
||||
"asabusecontact": "abuse@king-servers.com",
|
||||
"as": 14576,
|
||||
"asname": "HOSTING-SOLUTIONS",
|
||||
"ascountry": "US",
|
||||
"assize": 11264,
|
||||
"network": "185.162.131.0/24",
|
||||
"threatfeedscount": 1,
|
||||
"threatfeeds": {
|
||||
"ciarmy": {
|
||||
"lastseen": "2018-10-06",
|
||||
"firstseen": "2018-10-06"
|
||||
}
|
||||
},
|
||||
"maxrisk": 0,
|
||||
"reputation": "Safe"
|
||||
}
|
||||
}
|
||||
```
|
26
utils/test_doc/testdoc.sh
Normal file
26
utils/test_doc/testdoc.sh
Normal file
@ -0,0 +1,26 @@
|
||||
#!/bin/bash
|
||||
|
||||
|
||||
# this program is for test only. To ensure the documentation is generated as it should.
|
||||
# this program should be run from Cortex-Analyzers/ path only.
|
||||
ROOT_PATH=${PWD}
|
||||
TEST_PATH="./test_doc"
|
||||
|
||||
mkdir ${TEST_PATH}
|
||||
cp -rv . ${TEST_PATH}
|
||||
cd ${TEST_PATH}
|
||||
gh repo clone TheHive-Project/doc-builder
|
||||
|
||||
doc-builder/build/Cortex-Neurons/generate.py
|
||||
|
||||
|
||||
cp -v CHANGELOG.md docs/.
|
||||
cp -v code_of_conduct.md docs/.
|
||||
cp -rv README.md docs/
|
||||
|
||||
|
||||
|
||||
mkdocs serve -a 0.0.0.0:8888
|
||||
|
||||
cd ${ROOT_PATH}
|
||||
rm -rf ${TEST_PATH}
|
Loading…
Reference in New Issue
Block a user