add Docker files

analyzers/Censys-platform/Censys_search.json

@@ -8,6 +8,7 @@
   "dataTypeList": ["other","ip","domain"],
   "baseConfig": "Censys Platform",
   "command": "Censys-platform/censys_search.py",
+  "dockerImage": "censys-platform:1.0",
   "configurationItems": [
     {
       "name": "oid",

analyzers/Censys-platform/Dockerfile

@@ -0,0 +1,8 @@
+FROM python:3.14-slim
+
+WORKDIR /worker
+COPY . Censys-platform
+
+RUN pip install --no-cache-dir -r Censys-platform/requirements.txt
+
+ENTRYPOINT Censys-platform/censys_search.py

analyzers/Censys-platform/requirements.txt

@@ -1,2 +1,2 @@
-cortexutils
-censys-platform
+cortexutils==2.2.1
+censys-platform==0.16.1

analyzers/CustomProxy/CustomProxy.json

@@ -10,6 +10,7 @@
   "description": "Query a custom proxy",
   "dataTypeList": ["url"],
   "command": "CustomProxy/custom_proxy.py",
+  "dockerImage": "customproxy:1.0",
   "configurationItems": [
     {
       "name": "base_url",

analyzers/CustomProxy/Dockerfile

@@ -0,0 +1,8 @@
+FROM python:3.14-slim
+
+WORKDIR /worker
+COPY . CustomProxy
+
+RUN pip install --no-cache-dir -r CustomProxy/requirements.txt
+
+ENTRYPOINT CustomProxy/custom_proxy.py

analyzers/CustomProxy/custom_proxy.py

@@ -17,6 +17,10 @@ def __init__(self):
             None,
             "No base URL configuration in Cortex.",
         )
+        # the request url is built by plain concatenation below, so tolerate a
+        # base url configured without its trailing slash
+        if not self.base_url.endswith("/"):
+            self.base_url += "/"
 
     def do_request(self, method, module, url, headers, post_data, post_data_hex):
         try:

analyzers/CustomProxy/requirements.txt

@@ -1,3 +1,2 @@
-cortexutils
-requests
-
+cortexutils==2.2.1
+requests==2.34.2

analyzers/PublicWWW/Dockerfile

@@ -0,0 +1,8 @@
+FROM python:3.14-slim
+
+WORKDIR /worker
+COPY . PublicWWW
+
+RUN pip install --no-cache-dir -r PublicWWW/requirements.txt
+
+ENTRYPOINT PublicWWW/publicwww_analyzer.py

analyzers/PublicWWW/PublicWWW_Search.json

@@ -8,6 +8,7 @@
   "description": "Search pattern on publicWWW",
   "dataTypeList": ["other"],
   "command": "PublicWWW/publicwww_analyzer.py",
+  "dockerImage": "publicwww:0.1.1",
   "configurationItems": [
     {
       "name": "api_key",

analyzers/PublicWWW/requirements.txt

@@ -1,3 +1,2 @@
-cortexutils
-requests
-import urllib
+cortexutils==2.2.1
+requests==2.34.2

analyzers/Shodan/Dockerfile

@@ -0,0 +1,8 @@
+FROM python:3.14-slim
+
+WORKDIR /worker
+COPY . Shodan
+
+RUN pip install --no-cache-dir -r Shodan/requirements.txt
+
+ENTRYPOINT Shodan/shodan_analyzer.py

analyzers/Shodan/Shodan_DNSResolve.json

@@ -7,6 +7,7 @@
   "description": "Retrieve domain resolutions on Shodan.",
   "dataTypeList": ["domain", "fqdn"],
   "command": "Shodan/shodan_analyzer.py",
+  "dockerImage": "shodan:1.0",
   "baseConfig": "Shodan",
   "config": {
       "service": "dns_resolve"

analyzers/Shodan/Shodan_Host.json

@@ -7,6 +7,7 @@
   "description": "Retrieve key Shodan information on an IP address.",
   "dataTypeList": ["ip"],
   "command": "Shodan/shodan_analyzer.py",
+  "dockerImage": "shodan:1.0",
   "baseConfig": "Shodan",
   "config": {
       "service": "host"

analyzers/Shodan/Shodan_Host_History.json

@@ -7,6 +7,7 @@
   "description": "Retrieve Shodan history scan results  for an IP address.",
   "dataTypeList": ["ip"],
   "command": "Shodan/shodan_analyzer.py",
+  "dockerImage": "shodan:1.0",
   "baseConfig": "Shodan",
   "config": {
       "service": "host_history"

analyzers/Shodan/Shodan_InfoDomain.json

@@ -7,6 +7,7 @@
   "description": "Retrieve key Shodan information on a domain.",
   "dataTypeList": ["domain", "fqdn"],
   "command": "Shodan/shodan_analyzer.py",
+  "dockerImage": "shodan:1.0",
   "baseConfig": "Shodan",
   "config": {
       "service": "info_domain"

analyzers/Shodan/Shodan_ReverseDNS.json

@@ -7,6 +7,7 @@
   "description": "Retrieve ip reverse DNS resolutions on Shodan.",
   "dataTypeList": ["ip"],
   "command": "Shodan/shodan_analyzer.py",
+  "dockerImage": "shodan:1.0",
   "baseConfig": "Shodan",
   "config": {
       "service": "reverse_dns"

analyzers/Shodan/Shodan_Search.json

@@ -7,6 +7,7 @@
   "description": "Search query on Shodan",
   "dataTypeList": ["other"],
   "command": "Shodan/shodan_analyzer.py",
+  "dockerImage": "shodan:2.0",
   "baseConfig": "Shodan",
   "config": {
       "service": "search"

analyzers/Shodan/requirements.txt

@@ -1,3 +1,3 @@
-shodan
-cortexutils
-requests
+shodan==1.31.0
+cortexutils==2.2.1
+requests==2.34.2

analyzers/Urlscan.io/Dockerfile

@@ -0,0 +1,8 @@
+FROM python:3.14-slim
+
+WORKDIR /worker
+COPY . Urlscan.io
+
+RUN pip install --no-cache-dir -r Urlscan.io/requirements.txt
+
+ENTRYPOINT Urlscan.io/urlscan_analyzer.py

analyzers/Urlscan.io/Urlscan_Scan.json

@@ -7,6 +7,7 @@
   "description": "Scan URLs on urlscan.io",
   "dataTypeList": ["url", "domain", "fqdn"],
   "command": "Urlscan.io/urlscan_analyzer.py",
+  "dockerImage": "urlscan.io:0.1.0",
   "baseConfig": "Urlscan.io",
   "config": {
     "service":"scan"

analyzers/Urlscan.io/Urlscan_Search.json

@@ -8,6 +8,7 @@
   "description": "Search IPs, domains, hashes or URLs on urlscan.io",
   "dataTypeList": ["ip", "domain", "hash", "url", "other"],
   "command": "Urlscan.io/urlscan_analyzer.py",
+  "dockerImage": "urlscan.io:0.1.2",
   "config": {
     "service":"search"
   },

analyzers/Urlscan.io/Urlscan_SearchSubrequests.json

@@ -8,6 +8,7 @@
   "description": "Search a filter in subrequests",
   "dataTypeList": ["other"],
   "command": "Urlscan.io/urlscan_analyzer.py",
+  "dockerImage": "urlscan.io:0.1",
   "config": {
     "service":"search_subrequests"
   },

analyzers/Urlscan.io/requirements.txt

@@ -1,4 +1,3 @@
-cortexutils
-requests
-pyopenssl
-jmespath
+cortexutils==2.2.1
+requests==2.34.2
+jmespath==1.1.0

analyzers/VirusTotal/Dockerfile

@@ -1,11 +1,8 @@
-FROM python:3.9
+FROM python:3.14-slim
 
 WORKDIR /worker
 COPY . VirusTotal
-RUN apt update
-RUN apt install -y -q libimage-exiftool-perl       && \
-    rm -rf /var/lib/apt/lists/*
 
 RUN pip install --no-cache-dir -r VirusTotal/requirements.txt
 
-ENTRYPOINT VirusTotal/virustotal.py
+ENTRYPOINT VirusTotal/virustotal.py

analyzers/VirusTotal/VirusTotal_DownloadSample.json

@@ -26,5 +26,6 @@
     "path": "assets/virustotal-logo.png",
     "caption": "logo"
   },
-  "command": "VirusTotal/virustotal.py"
+  "command": "VirusTotal/virustotal.py",
+  "dockerImage": "virustotal:3.1"
 }

analyzers/VirusTotal/VirusTotal_File_Relationships.json

@@ -19,5 +19,6 @@
       "required": true
     }
   ],
-  "command": "VirusTotal/virustotal.py"
+  "command": "VirusTotal/virustotal.py",
+  "dockerImage": "virustotal:1.0"
 }

analyzers/VirusTotal/VirusTotal_GetReport.json

@@ -7,6 +7,7 @@
   "description": "Get the latest VirusTotal report for a file, hash, domain or an IP address.",
   "dataTypeList": ["file", "hash", "domain", "fqdn", "ip", "url"],
   "command": "VirusTotal/virustotal.py",
+  "dockerImage": "virustotal:3.1",
   "baseConfig": "VirusTotal",
   "config": {
     "service": "get"

analyzers/VirusTotal/VirusTotal_Rescan.json

@@ -55,5 +55,6 @@
     "path": "assets/virustotal-logo.png",
     "caption": "logo"
   },
-  "command": "VirusTotal/virustotal.py"
+  "command": "VirusTotal/virustotal.py",
+  "dockerImage": "virustotal:3.1"
 }

analyzers/VirusTotal/VirusTotal_Scan.json

@@ -41,5 +41,6 @@
     "path": "assets/virustotal-logo.png",
     "caption": "logo"
   },
-  "command": "VirusTotal/virustotal.py"
+  "command": "VirusTotal/virustotal.py",
+  "dockerImage": "virustotal:3.1"
 }

analyzers/VirusTotal/VirusTotal_Search.json

@@ -19,5 +19,6 @@
       "required": true
     }
   ],
-  "command": "VirusTotal/virustotal.py"
+  "command": "VirusTotal/virustotal.py",
+  "dockerImage": "virustotal:1.0"
 }

analyzers/VirusTotal/requirements.txt

@@ -1,6 +1,3 @@
-cortexutils
-future
-requests
-vt-py
-python-magic
-filetype
+cortexutils==2.2.1
+requests==2.34.2
+virustotal-api==1.1.11