TheHive-Project / TheHive-Project/Cortex-Analyzers

[Bug] Migrating from .RPM (& local python) to Docker Installation. Online analyzers won't work (Self Signed Certificates)

Open
#1,011 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
490
Forks
405
Avg merge
2d 43m
Merged PRs (30d)
8

Description

The Bug
I used to have a Cortex Instance installed from an .RPM with local Python environment for the analyzers (and directory with source code). With time, it gets difficult to maintain this deployment method compared to docker Images. (As an example, I installed a >2.4.138 MISP instance and pymisp was outdated on cortex server, so no MISP analysis for me without manually updating the pymisp package).

I followed the tutorial in order to run a dockerized Cortex instance able to run other containers (analyzers).
The MISP analyzer seems to work : Manual analysis of well-known IOCs give me some results, using HTTPS config and API KEY.

Things get trickier when I reconfigure online Cortex analyzers :
Virustotal_GetReport throws a -1, Ipinfo tells me it doesn't trust self signed certificates etc.
As I am using a proxy between my Cortex instance and online analyzers, I think something's wrong with my global config.
I compared the ancient Cortex installation (which works perfectly fine) and the new one : they are exactly the same (checked this with searching ES indices on a Kibana instance).

Maybe passing by dockerized analyzers requires some further configuration when using a proxy ?

Would be glad to receive any help.

To Reproduce
Steps to reproduce the behavior:

  1. Have a perfectly running Cortex Instance from .rpm archive and local Python environment. (3.1.0)
  2. Install a new Cortex with docker Images and use docker versions of analyzers. (3.1.1)
  3. Configure properly MISP analyzer on your MISP instance.
  4. Configure VirusTotal, IPInfo, Passivetotal analyzers on the new Cortex admin UI with same parameters as the old one.
  5. Online Analysis will throw errors about Self Signed certificates.

Expected behavior
My proxy settings being exactly the same, I should not receive Self Signed Certificate Errors on online Analyzers (the proxy is the same as before, old Cortex instance worked fine with it)

Complementary information

Work environment

  • Client OS: Windows
  • Server OS: CentOS
  • Browse type and version: Chrome
  • Cortex version: 3.1.1
  • Cortex Analyzer/Responder name: virustotal_getreport
  • Cortex Analyzer/Responder version:

Possible solutions

Additional context

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is identified. Start by reproducing the failure with the Dockerized VirusTotal, IPInfo, and Passivetotal analyzers, then compare their proxy and certificate configuration with the working RPM installation; done means online analyses work without self-signed-certificate errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, python
Domain
infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.