TheHive-Project / TheHive-Project/Cortex-Analyzers
[Bug] Migrating from .RPM (& local python) to Docker Installation. Online analyzers won't work (Self Signed Certificates)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 490
- Forks
- 405
- Avg merge
- 2d 43m
- Merged PRs (30d)
- 8
Description
The Bug
I used to have a Cortex Instance installed from an .RPM with local Python environment for the analyzers (and directory with source code). With time, it gets difficult to maintain this deployment method compared to docker Images. (As an example, I installed a >2.4.138 MISP instance and pymisp was outdated on cortex server, so no MISP analysis for me without manually updating the pymisp package).
I followed the tutorial in order to run a dockerized Cortex instance able to run other containers (analyzers).
The MISP analyzer seems to work : Manual analysis of well-known IOCs give me some results, using HTTPS config and API KEY.
Things get trickier when I reconfigure online Cortex analyzers :
Virustotal_GetReport throws a -1, Ipinfo tells me it doesn't trust self signed certificates etc.
As I am using a proxy between my Cortex instance and online analyzers, I think something's wrong with my global config.
I compared the ancient Cortex installation (which works perfectly fine) and the new one : they are exactly the same (checked this with searching ES indices on a Kibana instance).
Maybe passing by dockerized analyzers requires some further configuration when using a proxy ?
Would be glad to receive any help.
To Reproduce
Steps to reproduce the behavior:
- Have a perfectly running Cortex Instance from .rpm archive and local Python environment. (3.1.0)
- Install a new Cortex with docker Images and use docker versions of analyzers. (3.1.1)
- Configure properly MISP analyzer on your MISP instance.
- Configure VirusTotal, IPInfo, Passivetotal analyzers on the new Cortex admin UI with same parameters as the old one.
- Online Analysis will throw errors about Self Signed certificates.
Expected behavior
My proxy settings being exactly the same, I should not receive Self Signed Certificate Errors on online Analyzers (the proxy is the same as before, old Cortex instance worked fine with it)
Complementary information
Work environment
- Client OS: Windows
- Server OS: CentOS
- Browse type and version: Chrome
- Cortex version: 3.1.1
- Cortex Analyzer/Responder name: virustotal_getreport
- Cortex Analyzer/Responder version:
Possible solutions
Additional context
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file or test is identified. Start by reproducing the failure with the Dockerized VirusTotal, IPInfo, and Passivetotal analyzers, then compare their proxy and certificate configuration with the working RPM installation; done means online analyses work without self-signed-certificate errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, python
- Domain
- infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100