MISP / MISP/misp-modules

Hover enrichment not working, but no problem with "Enrich event" functionality

Open
#518 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
377
Forks
280
Avg merge
2d 2h
Merged PRs (30d)
10

Description

OS : CentOS 8
Instance behind a corporate Proxy
PHP 7.4.22
MISP 2.4.148

Hi, I've had a few problems with the misp-modules, mainly that the misp-modules service initially works fine right after the install but refuses to start again after a reboot. This is what I have as a result :

image

Any attempt at restarting/stopping the service has failed.

This resulted is no plugins being available. I have gone around this by manually launching the modules (with help from issue #354) :

sudo -u apache /var/www/MISP/venv/bin/misp-modules -l 127.0.0.1 -s

The output indicates that all modules were succesfully loaded. In the UI, the plugin settings appear and I can use "Enrich event", for example to generate yara rules from hash values. This works fine. However, as soon as I try using hover enrichment on a single attribute, I only get errors :

image

In the python logs, I see the following :

image

I'm not sure what else I can do to fix this, I didn't have this problem when I tested the install on my personal computer so I don't know if this is somehow related to the proxy. I'd be grateful if anyone has any idea on this one. Mainly, how is it that I get results when I enrich the entire event with "Enrich Event" but the single hover enrichment for one attribute doesn't work ?

Thank you !

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Use the manually launched misp-modules -l 127.0.0.1 -s command as the starting entry point, and compare it with the misp-modules service after reboot on CentOS 8. Review the reported Python logs and hover-enrichment behavior; done means the service starts reliably and single-attribute hover enrichment works while event enrichment remains functional.

Written by the indexing model from the issue text.

Assessment

Tech stack
centos, php, python
Domain
backend, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.