Persistence and Report Caching

[saadkadhi]

Request Type

Feature Request

Work Environment

NA

Problem Description

The current version of Cortex (1.0.0) has no persistence. When it is restarted, all jobs are lost hence the associated results are no longer available.

Moreover, if an analyst runs an analyzer through the Web UI or the REST API, they can't retrieve the report from TheHive or any other 3rd party tool that leverages the API. They need to re-run the analysis. This is a serious problem:

• if the report contains useful information that may be lost if the analysis is executed again (time-based results)
• if the analyzer must not be run more than required (quota-based services)

Possible Solutions

1. Implement persistence to allow analysts to retrieve past reports even after a reboot
2. Implement report caching and specific API replies to indicate to TheHive or a 3rd party tool that reports are already available and let them retrieve those if interested instead of re-running the analysis.