[Bug] Analyzers that take more than 10 Minutes run into timeout

[Tobrabo]

We wrote some analyzers that take rather long to finisch (from minutes to several hours). They work and cortex shows their correct output once they are finished but TheHive waits only 10 minutes for them to finish and then shows and empty return field.

To Reproduce
run any analyzer that takes longer than 10 minutes.
For example calculate hash for a big image file or run yara over an entire mounted image.

Expected behavior
It should just wait for the analyzer to finish just as cortex does.

Work environment

• Client OS: linux
• Server OS: linux
• Browse type and version: firefox 68
• Cortex version: 3.0

Possible solutions
Where do you change the timeout? can you edit timeouts for individual analyzers?

[3c7]

To clarify:
The Analyzer completes successfully and Cortex displays the correct result. The real issue is TheHive running in some kind of timeout.

[KRUXLEX]

I have the same bug. It's very annoying. I wait for fix it.
Workaround:
In cortex-> analyzer->global configuration set a job.cache on more time (In my case it's a 60min). Then when you analyze the same observer again, Then hive gets a analyze from the same observer from last hour.

Logical It's should work, but in my case technically don't work.

[maugertg]

I have this issue with an Analyzer I'm building as well. The Hive timeout is ~420 seconds (7 minutes). If you run an analyzer for 419 seconds The Hive will sometimes successfully fetch the results. At 420 seconds results will almost never be successfully fetched by The Hive.

I wrote a super basic analyzer that can reproduce the issue here:
https://github.com/maugertg/the-hive-delay-error