Skip to content
This repository has been archived by the owner on Oct 10, 2019. It is now read-only.

Re-run analysis with Cloud-Phish enabled #154

Open
castle1126 opened this issue Jan 25, 2019 · 1 comment
Open

Re-run analysis with Cloud-Phish enabled #154

castle1126 opened this issue Jan 25, 2019 · 1 comment

Comments

@castle1126
Copy link

We are looking to have emails fed via automated transfers to ACE - and because of that we disabled Cloud Phish in our configuration. After an analysis is done, it would be great for an analyst to look at the email and analysis and say "I would like to re-run the analysis WITH Cloud Phish turned on to traverse the links in the email". Can this be something to be looked at/added possibly to ACE?

@unixfreak0037
Copy link
Collaborator

What we would want here, more generically, is a new settings for analysis modules

[analysis_module_blah]
enabled = yes
manual = yes

These don't run on their own, but in the GUI if any observables would run on them then the analyst has the option to enable that module for that analysis and resubmit the analysis.

Will require storage of additional properties in the RootAnalysis object (probably in state) and some changes to the engine's analysis loop.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants