Get quota used of analyzer rates

[thehive-project]

Get quota used of analyzer rates

[nadouani]

Hello, I guess the analyzer used quota means the number of jobs of that analyzer, during a given period?

[geekscrapy]

I think, I probably used the wrong terms! was referring to the rate and rateUnit associated with each analyzer.

Each time a submission is sent to the analyzer I presume there is an internal counter which is decremented in order to track the number of submissions?
I would like to access to this counter via the API (and GUI).

E.g. I set my VT analyzer to rate of 100 and a rateUnit of 1 day. This means I can use the VT analyzer 100 times that day.

Throughout the day I want to see how many submissions I have left before I reach my limit (in this case, 100).

[nadouani]

That's what I understood, it's 100 - countAnalyzerCallsOfThatDay

[geekscrapy]

Yes 😁

[nadouani]

I don't remember if you still need something for this question or if it has been answered :)

[geekscrapy]

Hey, yes, I needed to know if getting the remaining quota for an analyzer was possible via the API?

It seems like there is no use for the "rate" variable per analyzer if there isn't?! 🙄

[nadouani]

There is not API that returns the remaining rate but as I said, you can compute it by counting the already executed analysis, during the month, and subtract that count the rate value.

[geekscrapy]

Thanks - I get how to calculate it, however, when Cortex is being used by many clients this would mean that each client would have to implement its own logic to track the analyzers usage. This seems a bit flawed when there is a field to input the rate for a given analyzer/API?

My suggestion is to track the used rate/quota and expose it via the API - this would allow clients to check if there are any API calls left for that particular service before issuing them and potentially be blacklisted from the service?

[nadouani]

Well, once again, this is tricky because 1 analyzer might use several external server calls: Imagine VT scan analyzer polling for analysis status from VT.

What we can try to add is a header that contains the remaining possible analyzer calls.

[geekscrapy]

Yea, this is potentially an issue... This may be something to work into the cortexutils lib (when in an analyzer that makes a call to another service, it calls an endpoint in cortexutils which decreases the amount of quota available to that API). This would require a reworking of the current Analyzers though.

It'd be good to have something which gives an idea of the amount available though.
Thanks