TheHive-Project / TheHive-Project/Cortex-Analyzers

[Bug] Inoitsu Analyzer Bug - 'NoneType' object has no attribute 'group' AND config json Error

Open
#1,032 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
490
Forks
405
Avg merge
2d 43m
Merged PRs (30d)
8

Description

Describe the bug
Issue 1:
The Analyzer is throwing an NoneType Error when starting an Analysis with an email address. On the URL https://www.hotsheet.com/inoitsu/ there is no Critical Identity Alerts information anymore (at least when checked on 29.08.2021). It seems like this was removed from the URL and therefore the python code runs into errors during information harvesting.

Issue 2:
In the Inoitsu.json file the "config": {} part is missing which causes Elastic NotFoundError in the log file.

To Reproduce
Steps to reproduce the behavior:

  1. Configure the Analyzer under the Cortex Analyzer Config.
  2. Enable the Inoitsu Analyzer.
  3. Run a new Analysis with the Inoitsu Analyzer.

Expected behavior
The Analyzer should start the Analysis and request a reputation check against the URL https://www.hotsheet.com/inoitsu/ with the given e-mail address provided as input.

Complementary information
The Cortex WEB UI Error when starting an Analysis
Issue 1:
image

Issue 2:
The Elastic NotFoundError in the Cortex application.log, when starting an Analysis with the Analyzer:

2021-08-12 13:49:01,638 [INFO] from org.thp.cortex.services.ErrorHandler in application-akka.actor.default-dispatcher-9 - GET /api/analyzerconfig/Inoitsu returned 404 org.elastic4play.NotFoundError: config Inoitsu not found

Work environment

  • Cortex version: 3.1.1-1
  • Cortex Analyzer/Responder name: Inoitsu
  • Cortex Analyzer/Responder version: 1.0

Possible solutions
Issue 1:
Remove Critical Identity Alerts from the result, because this information is not available on the URL anymore.

Issue 2:
Adding the a config part to the Inoitsu.json file liek:

  "config": {
    "check_tlp": true,
    "max_tlp": 2,
    "auto_extract": false
  },

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names the Inoitsu analyzer and Inoitsu.json; start by locating the Python harvesting code and that configuration file, then reproduce through Cortex Analyzer Config with an email input. Done means the analysis starts without the NoneType/group failure, no longer expects Critical Identity Alerts, and the Inoitsu config is present so the 404 is gone.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.