Merge pull request #1460 from marvinuku/clusterhawk-ipv6-support

Platform supports IPv6 now, clarification

Author: nusantara-self

analyzers/ClusterHawk/README.md

@@ -92,7 +92,7 @@ Before using this analyzer, you must:
 
 ### Supported Data Types
 
-- **ip**: IPv4 addresses
+- **ip**: IPv4 and IPv6 addresses
 
 ## Output Format
 
@@ -146,6 +146,16 @@ For prebuilt models, additional fields are included:
           "candidates": [{ "cluster_id": 2, "confidence": 0.94 }],
           "label": "['Web Crawler']"
         },
+        {
+          "ip": "2001:db8:3c4d:15::1a2f",
+          "predicted_cluster": 5,
+          "confidence": 0.91,
+          "kind": "confident_match",
+          "top1_minus_top2": 0.77,
+          "effective_n": 1.28,
+          "candidates": [{ "cluster_id": 5, "confidence": 0.91 }],
+          "label": "['Botnet C2']"
+        },
         {
           "ip": "10.0.0.50",
           "predicted_cluster": 1,
@@ -171,7 +181,7 @@ For prebuilt models, additional fields are included:
           "label": null
         }
       ],
-      "total_predictions": 3,
+      "total_predictions": 4,
       "model_info": {
         "model_id": "job_abc123def456"
       }

thehive-templates/ClusterHawk_1_0/long.html

@@ -1,3 +1,6 @@
+<style>
+  .kh-ip { overflow-wrap: anywhere; word-break: break-all; }
+</style>
 <div ng-if="success">
     <div ng-if="content">
 
@@ -93,7 +96,7 @@ <h4>Cluster Analysis</h4>
               <tr>
                 <th>IP Addresses</th>
                 <td>
-                  <span class="kh-chip" ng-repeat="ip in info.ips track by $index">{{ ip }}</span>
+                  <span class="kh-chip kh-ip" ng-repeat="ip in info.ips track by $index">{{ ip }}</span>
                 </td>
               </tr>
             </table>
@@ -117,7 +120,7 @@ <h4>Predictions</h4>
             </thead>
             <tbody>
               <tr ng-repeat-start="p in content.predictions track by $index">
-                <td><span class="kh-chip">{{ p.ip }}</span></td>
+                <td><span class="kh-chip kh-ip">{{ p.ip }}</span></td>
                 <td>
                   <span class="label label-default" ng-if="p.cluster === null || p.cluster === undefined">
                     No match