Merge pull request #1382 from TheHive-Project/capa-fix

Analyzer Capa - Fixes

Author: nusantara-self

analyzers/Capa/Dockerfile

@@ -1,12 +1,14 @@
-FROM python:3-alpine
+FROM python:3-slim
 WORKDIR /worker
+
 # Install required tools
-RUN apk add --no-cache \
-    curl \
-    jq \
-    unzip \
-    bash && \
-    rm -rf /var/cache/apk/*
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      curl \
+      jq \
+      unzip \
+      bash \
+      ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
 
 COPY requirements.txt Capa/
 RUN test ! -e Capa/requirements.txt || pip install --no-cache-dir -r Capa/requirements.txt
@@ -17,4 +19,4 @@ RUN chmod +x /worker/fetch_capa.sh && /worker/fetch_capa.sh
 
 COPY . Capa/
 
-ENTRYPOINT ["python", "Capa/CapaAnalyze.py"]
+ENTRYPOINT ["python", "Capa/CapaAnalyze.py"]

analyzers/Capa/fetch_capa.sh

@@ -19,7 +19,8 @@ echo "Downloading from $DOWNLOAD_URL"
 
 # Download and extract capa
 curl -L -o capa.zip "$DOWNLOAD_URL" || { echo "Download failed"; exit 1; }
-unzip capa.zip -d /worker/capa || { echo "Extraction failed"; exit 1; }
+mkdir -p /worker/Capa
+unzip capa.zip -d /worker/Capa || { echo "Extraction failed"; exit 1; }
 
 # Clean up
 rm capa.zip

thehive-templates/Capa_1_0/long.html

@@ -15,7 +15,9 @@
    background-color: black;
    }
 </style>
-<div class="panel panel-info">
+
+<!-- Success -->
+<div class="panel panel-info" ng-if="content.success">
    <div class="panel-heading">Capa Analysis Results</div>
    <div class="panel-body">
       <table class="table">
@@ -60,3 +62,16 @@
       </table>
    </div>
 </div>
+
+<!-- General error  -->
+<div class="panel panel-danger" ng-if="!content.success">
+    <div class="panel-heading">
+        <strong>{{(artifact.data || artifact.attachment.name) | fang}}</strong>
+    </div>
+    <div class="panel-body">
+        <dl class="dl-horizontal" ng-if="content.errorMessage">
+            <dt><i class="fa fa-warning"></i> Capa: </dt>
+            <dd class="wrap">{{content.errorMessage}}</dd>
+        </dl>
+    </div>
+</div>