Fix: HybridAnalysis hash search: switch POST to GET + add overview fallback (#2934) #3073
Conversation
PranavShukla7 force-pushed the fix/hybrid-analysis-hash-get branch from 16ecba7 to f863ea8 Compare 
Refactor methods for fetching and processing observable data, enhancing clarity and reducing complexity.
| Hey @mlodic , I’ve also refactored the logic into smaller helper functions to make the flow cleaner and easier to maintain. |
| can you please show us the output from this analyzer from the GUI? |
mlodic left a comment
mlodic left a comment There was a problem hiding this comment.
it seems fine, can you please provide 3 examples of execution with real data:
- 1 with hash and minimal result
- 1 with hash and full result
- 1 for a domain
This fasten our review because we need to have proof that this works in this platform too and not only in the unitests
| self._add_permalink_list(result) | ||
| | ||
| return result | ||
| |
There was a problem hiding this comment.
we are not using monkeypatch anymore, you can change the related test here: https://github.com/intelowlproject/IntelOwl/blob/develop/tests/api_app/analyzers_manager/unit_tests/observable_analyzers/test_ha_get.py
There was a problem hiding this comment.
Thanks for the clarification
Since we’re no longer using monkeypatch for this analyzer, I can update the related unit test to use standard request mocking instead.
Before I proceed, just wanted to confirm with you: should I completely remove the monkeypatch logic and adapt the test to validate the analyzer behavior using regular mocked HTTP responses?
There was a problem hiding this comment.
Yes that's correct. You can take a look at other existing tests for other analyzers as example.
fgibertoni left a comment
fgibertoni left a comment There was a problem hiding this comment.
I do like the general approach of using functions.
If you're performing more than one call to APIs per analyzer run I think it would be better to use a Session object, just to make things more clear. Let me know what you think :)
| @classmethod | ||
| def update(cls) -> bool: | ||
| pass | ||
| return True |
There was a problem hiding this comment.
I think this can be left as pass. Have you changed it for any particular reason?
There was a problem hiding this comment.
I’ve updated the update() method to return True instead of pass.
This matches the expected analyzer interface, where update() should explicitly signal a successful metadata update (even though it’s a no-op for this analyzer).
Let me know if you’d prefer a different behavior here.
There was a problem hiding this comment.
I'd prefer to leave it as pass as every other analyzer if that's not a problem 😃
| This pull request has been marked as stale because it has had no activity for 10 days. If you are still working on this, please provide some updates or it will be closed in 5 days. |
| Hey @PranavShukla7 any updates? |
| @fgibertoni yes i need some time please...will do it by the end of the week |
| Sure, no hurries. Just to be sure you're still working on it 😄 |
| @fgibertoni that makes sense That said, I’m totally open to switching to a Session if you feel it improves clarity or consistency with the rest of the codebase |
| Ok I understand your point, no problem in leaving it as single requests. |
4 participants
Description
Fixes #2934
This PR updates the HybridAnalysis analyzer to support API changes introduced in
API v2.35.0, where the POST /search/hash endpoint was deprecated and replaced by a GET version.
The new GET endpoint returns a minimal response instead of a full SampleSummary.
To maintain backward compatibility, this PR adds a fallback request to
/overview/ to restore the previous output structure.
Type of change
Checklist
developdumpplugincommand and added it in the project as a data migration. ("How to share a plugin with the community")test_files.zipand you added the default tests for that mimetype in test_classes.py.FREE_TO_USE_ANALYZERSplaybook by following this guide.urlthat contains this information. This is required for Health Checks (HEAD HTTP requests)._monkeypatch()was used in its class to apply the necessary decorators.MockUpResponseof the_monkeypatch()method. This serves us to provide a valid sample for testing.DataModelfor the new analyzer following the documentation# This file is a part of IntelOwl https://github.com/intelowlproject/IntelOwl # See the file 'LICENSE' for copying permission.Black,Flake,Isort) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.testsfolder). All the tests (new and old ones) gave 0 errors.DeepSource,Django Doctorsor other third-party linters have triggered any alerts during the CI checks, I have solved those alerts.