Analyzers

Cortex analyzers

Analyzers are included in the Cortex binary package but they are in a dedicated GitHub repository Cortex-Analyzers. Currently, analyzers are autonomous application, hosted in Cortex server. This will change in future (see our road map).

Pre-requisites

Provided analyzers are written in Python. They don't require any build phase but their dependencies must be installed:

apt-get install python-pip python2.7-dev ssdeep libfuzzy-dev libfuzzy2 libimage-exiftool-perl
sudo pip install cortexutils datetime simplejson python-magic pefile2 hashlib pydeep pyexifinfo oletools olefile pyeupi

From repository

If you want to get up-to-date analyzers, you can clone the GitHub repository:

git clone https://github.com/CERT-BDF/Cortex-Analyzers

Don't forget to configure analyzers directory in Cortex configuration:

analyzer {
  path = "path/to/analyzers"
}

Dependencies details

Dependencies of Cortex

apt-get install python-pip python2.7-dev
sudo pip install cortexutils

Analyzers use a base library cortexutils which to common tasks (get configuration parameters, parse inputs, format outputs, ...)

DNSDB

sudo pip install datetime simplejson

Domaintools

No dependencies

File_Info

pehashng is included in analyzers. This step should not be needed

git clone https://github.com/AnyMaster/pehashng
cd pehashng
sudo python setup.py install

Other dependencies:

sudo apt-get install ssdeep libfuzzy-dev libfuzzy2 libimage-exiftool-perl
sudo pip install python-magic pefile2 hashlib pydeep pyexifinfo oletools olefile

PhishingInitiativeLookup

sudo pip install pyeupi