Skip to content

Commit ace3f90

Browse files
nusantara-selfnusantara-self
committed
Merge branch 'release/3.5.8'
2 parents bc66151 + e14bbab commit ace3f90

File tree

9 files changed

+548
-49
lines changed

9 files changed

+548
-49
lines changed

‎.github/workflows/build.yml

Lines changed: 466 additions & 10 deletions
Large diffs are not rendered by default.

‎CHANGELOG.md

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,17 @@
11
# Changelog
22

3+
## [3.5.7](https://github.com/TheHive-Project/Cortex-Analyzers/tree/3.5.7) (2025-03-28)
4+
5+
[Full Changelog](https://github.com/TheHive-Project/Cortex-Analyzers/compare/3.5.6...3.5.7)
6+
7+
## [3.5.6](https://github.com/TheHive-Project/Cortex-Analyzers/tree/3.5.6) (2025-03-28)
8+
9+
[Full Changelog](https://github.com/TheHive-Project/Cortex-Analyzers/compare/3.5.5...3.5.6)
10+
11+
## [3.5.5](https://github.com/TheHive-Project/Cortex-Analyzers/tree/3.5.5) (2025-03-28)
12+
13+
[Full Changelog](https://github.com/TheHive-Project/Cortex-Analyzers/compare/3.5.4...3.5.5)
14+
315
## [3.5.4](https://github.com/TheHive-Project/Cortex-Analyzers/tree/3.5.4) (2025-03-28)
416

517
[Full Changelog](https://github.com/TheHive-Project/Cortex-Analyzers/compare/3.5.3...3.5.4)
@@ -8,6 +20,11 @@
820

921
- \[FR\] CI Refactor - ARM64 support & GHCR migration [\#1343](https://github.com/TheHive-Project/Cortex-Analyzers/issues/1343)
1022

23+
**Merged pull requests:**
24+
25+
- CI Refactor - GHCR.io migration / ARM64 Support [\#1341](https://github.com/TheHive-Project/Cortex-Analyzers/pull/1341) ([nusantara-self](https://github.com/nusantara-self))
26+
- CI Refactor - GHCR.io migration / ARM64 Support [\#1342](https://github.com/TheHive-Project/Cortex-Analyzers/pull/1342) ([nusantara-self](https://github.com/nusantara-self))
27+
1128
## [3.5.3](https://github.com/TheHive-Project/Cortex-Analyzers/tree/3.5.3) (2025-03-18)
1229

1330
[Full Changelog](https://github.com/TheHive-Project/Cortex-Analyzers/compare/3.5.2...3.5.3)

‎analyzers/EmlParser/Dockerfile

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,11 @@
1212
#
1313
#
1414

15-
16-
1715
FROM python:3-slim
1816
WORKDIR /worker
19-
COPY . EmlParser
20-
RUN test ! -e EmlParser/requirements.txt || pip install --no-cache-dir -r EmlParser/requirements.txt
2117
RUN apt update
22-
RUN apt install -y wkhtmltopdf libmagic1
23-
ENTRYPOINT EmlParser/parse.py
18+
RUN apt install -y wkhtmltopdf python3-magic
19+
COPY requirements.txt EmlParser/
20+
RUN test ! -e EmlParser/requirements.txt || pip install --no-cache-dir -r EmlParser/requirements.txt
21+
COPY . EmlParser/
22+
ENTRYPOINT ["python", "EmlParser/parse.py"]

‎analyzers/Maltiverse/Dockerfile

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎analyzers/Maltiverse/requirements.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
cortexutils
22
future
33
requests
4-
git+https://github.com/maltiverse/python-maltiverse
4+
maltiverse
55
PyJWT

‎analyzers/MalwareClustering/Dockerfile

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,14 @@
1-
FROM python:3.7
1+
FROM python:3-slim
22

33
WORKDIR /worker
44
COPY . MalwareClustering
5-
RUN apt update && \
6-
apt install -y -q libfuzzy-dev libimage-exiftool-perl && \
7-
rm -rf /var/lib/apt/lists/*
5+
# Install build tools and dependencies for C extensions
6+
RUN apt update && apt install -y --no-install-recommends \
7+
build-essential \
8+
python3-dev \
9+
libfuzzy-dev \
10+
python3-magic \
11+
libimage-exiftool-perl && \
12+
rm -rf /var/lib/apt/lists/*
813
RUN pip3 install --no-cache-dir -r MalwareClustering/requirements.txt
9-
ENTRYPOINT MalwareClustering/malwareclustering.py
14+
ENTRYPOINT ["python", "MalwareClustering/malwareclustering.py"]

‎responders/Jupyter_Responder/Dockerfile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
FROM python:3.9
1+
FROM python:3-slim
22
WORKDIR /worker
33
COPY . Jupyter_Responder
44
RUN test ! -e Jupyter_Responder/requirements.txt || pip install --no-cache-dir -r Jupyter_Responder/requirements.txt
55

66
RUN apt update &&\
77
apt install patch &&\
88
patch $(python3 -c "from papermill import iorw; print(iorw.__file__)") Jupyter_Responder/papermill_iorw.patch
9-
ENTRYPOINT Jupyter_Responder/jupyter.py
9+
ENTRYPOINT ["python", "Jupyter_Responder/jupyter.py"]

‎responders/MSDefenderOffice365/Dockerfile

Lines changed: 43 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,51 @@
1-
FROM python:3.10-slim
1+
FROM python:3-alpine
22

3-
# Install system components
4-
RUN apt-get update && apt-get install -y curl gnupg apt-transport-https
3+
# See : https://learn.microsoft.com/en-us/powershell/scripting/install/install-alpine?view=powershell-7.5
54

6-
# Import the public repository GPG keys
7-
RUN curl -sS https://packages.microsoft.com/keys/microsoft.asc | apt-key add -
5+
# Install base dependencies
6+
RUN apk add --no-cache \
7+
ca-certificates \
8+
less \
9+
ncurses-terminfo-base \
10+
krb5-libs \
11+
libgcc \
12+
libintl \
13+
libssl3 \
14+
libstdc++ \
15+
tzdata \
16+
userspace-rcu \
17+
zlib \
18+
icu-libs \
19+
curl
820

9-
# Register the Microsoft Product feed
10-
RUN sh -c 'echo "deb [arch=amd64] https://packages.microsoft.com/repos/microsoft-debian-bullseye-prod bullseye main" > /etc/apt/sources.list.d/microsoft.list'
21+
# Install additional packages from Alpine edge main repository
22+
RUN apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main \
23+
lttng-ust \
24+
openssh-client
1125

12-
# Install PowerShell (/usr/bin/pwsh)
13-
RUN apt-get update && apt-get install -y powershell
26+
# Download the PowerShell .tar.gz archive
27+
RUN curl -L https://github.com/PowerShell/PowerShell/releases/download/v7.5.0/powershell-7.5.0-linux-musl-x64.tar.gz -o /tmp/powershell.tar.gz
1428

15-
COPY install_deps.ps1 .
16-
RUN pwsh -File install_deps.ps1
29+
# Create the target folder where PowerShell will be placed
30+
RUN mkdir -p /opt/microsoft/powershell/7
31+
32+
# Extract PowerShell into the target folder
33+
RUN tar zxf /tmp/powershell.tar.gz -C /opt/microsoft/powershell/7
34+
35+
# Set execute permissions on the PowerShell binary
36+
RUN chmod +x /opt/microsoft/powershell/7/pwsh
37+
38+
# Create a symbolic link to pwsh in /usr/bin for easy access
39+
RUN ln -s /opt/microsoft/powershell/7/pwsh /usr/bin/pwsh
1740

1841
WORKDIR /worker
19-
COPY requirements.txt .
20-
RUN pip3 install --no-cache-dir -r requirements.txt
21-
COPY . .
2242

23-
ENTRYPOINT ["python3", "ms_defender_office.py"]
43+
# Copy the requirements for MSDefenderOffice365 and install them
44+
COPY requirements.txt MSDefenderOffice365/
45+
RUN pip3 install --no-cache-dir -r MSDefenderOffice365/requirements.txt
46+
47+
# Copy the rest of the analyzer code into the MSDefenderOffice365 folder
48+
COPY . MSDefenderOffice365/
49+
50+
# Set the entrypoint using JSON array syntax for proper OS signal handling
51+
ENTRYPOINT ["python3", "MSDefenderOffice365/ms_defender_office.py"]

‎responders/VirustotalDownloader/Dockerfile

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@ WORKDIR /worker
55
# install runtime dependencies.
66
RUN apk add --no-cache file-dev
77

8-
COPY requirements.txt VirusTotalDownloader/
8+
COPY requirements.txt VirustotalDownloader/
99

1010
# Install Python dependencies from requirements.txt
11-
RUN test ! -e VirusTotalDownloader/requirements.txt || pip install --no-cache-dir -r VirusTotalDownloader/requirements.txt
11+
RUN test ! -e VirustotalDownloader/requirements.txt || pip install --no-cache-dir -r VirustotalDownloader/requirements.txt
1212

13-
COPY . VirusTotalDownloader
13+
COPY . VirustotalDownloader
1414

15-
ENTRYPOINT ["python", "VirusTotalDownloader/VirustotalDownloader.py"]
15+
ENTRYPOINT ["python", "VirustotalDownloader/VirustotalDownloader.py"]

0 commit comments

Comments
 (0)