Fix: HybridAnalysis hash search: switch POST to GET + add overview fallback (#2934) #3073
Conversation
PranavShukla7
force-pushed
the
fix/hybrid-analysis-hash-get
branch
from
16ecba7 to
f863ea8
Compare
Refactor methods for fetching and processing observable data, enhancing clarity and reducing complexity.
|
Hey @mlodic , I’ve also refactored the logic into smaller helper functions to make the flow cleaner and easier to maintain. |
|
can you please show us the output from this analyzer from the GUI? |
mlodic
left a comment
mlodic
left a comment
There was a problem hiding this comment.
it seems fine, can you please provide 3 examples of execution with real data:
- 1 with hash and minimal result
- 1 with hash and full result
- 1 for a domain
This fasten our review because we need to have proof that this works in this platform too and not only in the unitests
| self._add_permalink_list(result) | ||
|
|
||
| return result | ||
|
|
There was a problem hiding this comment.
we are not using monkeypatch anymore, you can change the related test here: https://github.com/intelowlproject/IntelOwl/blob/develop/tests/api_app/analyzers_manager/unit_tests/observable_analyzers/test_ha_get.py
fgibertoni
left a comment
fgibertoni
left a comment
There was a problem hiding this comment.
I do like the general approach of using functions.
If you're performing more than one call to APIs per analyzer run I think it would be better to use a Session object, just to make things more clear. Let me know what you think :)
| @classmethod | ||
| def update(cls) -> bool: | ||
| pass | ||
| return True |
There was a problem hiding this comment.
I think this can be left as pass. Have you changed it for any particular reason?
4 participants
Description
Fixes #2934
This PR updates the HybridAnalysis analyzer to support API changes introduced in
API v2.35.0, where the POST /search/hash endpoint was deprecated and replaced by a GET version.
The new GET endpoint returns a minimal response instead of a full SampleSummary.
To maintain backward compatibility, this PR adds a fallback request to
/overview/ to restore the previous output structure.
Type of change
Checklist
developdumpplugincommand and added it in the project as a data migration. ("How to share a plugin with the community")test_files.zipand you added the default tests for that mimetype in test_classes.py.FREE_TO_USE_ANALYZERSplaybook by following this guide.urlthat contains this information. This is required for Health Checks (HEAD HTTP requests)._monkeypatch()was used in its class to apply the necessary decorators.MockUpResponseof the_monkeypatch()method. This serves us to provide a valid sample for testing.DataModelfor the new analyzer following the documentation# This file is a part of IntelOwl https://github.com/intelowlproject/IntelOwl # See the file 'LICENSE' for copying permission.Black,Flake,Isort) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.testsfolder). All the tests (new and old ones) gave 0 errors.DeepSource,Django Doctorsor other third-party linters have triggered any alerts during the CI checks, I have solved those alerts.