TheHive-Project / TheHive-Project/Cortex-Analyzers
[Bug] A custom responder return with an empty error
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 490
- Forks
- 405
- Avg merge
- 2d 43m
- Merged PRs (30d)
- 8
Description
Describe the bug
I have written a bare minimal responder that just returns a success message for a request from TheHive. However, I get the status failure without much information.
#!/usr/bin/env python3
from cortexutils.responder import Responder
class SampleService(Responder):
def __init__(self):
Responder.__init__(self)
def run(self):
Responder.run(self)
self.report({'message': "success"})
def operations(self, raw):
return [self.build_operation("AddTagToCase", tag="sampleId:id-1")]
if __name__ == "__main__":
SampleService().run()
When I run the responder from TheHive, I get the below output in the application logs with a warning saying
[warn] o.t.c.s.DockerJobRunnerSrv - The worker didn't generate output file.
[info] o.t.c.s.DockerJobRunnerSrv - Execute container bf99c645848c9ca0f9f00d573b7f1b8d21220f272f9003b4fb44b8c87c0370b9
timeout: 30 minutes
image : cortex-neurons/sample_service:0.2
volume : /tmp/cortex-jobs/cortex-job-Fk2v5ocBSFpERmG9YbQq-7518629213985387577:/job
[info] c.s.d.c.DefaultDockerClient - Starting container with Id: bf99c645848c9ca0f9f00d573b7f1b8d21220f272f9003b4fb44b8c87c0370b9
[info] o.t.c.s.AccessLogFilter - 192.168.65.205 GET /api/alert took 17ms and returned 200 2 bytes
[warn] o.t.c.s.DockerJobRunnerSrv - The worker didn't generate output file.
[info] o.t.c.s.JobSrv - Job Fk2v5ocBSFpERmG9YbQq has finished with status Failure
[info] o.t.c.s.AuditActor - Job Fk2v5ocBSFpERmG9YbQq has be updated (JsDefined("Failure"))
In cortex UI I can see the observable information as input and output(Report) only contains,
{
"errorMessage": "",
"input": null,
"success": false
}
Work environment
- Cortex version: thehiveproject/cortex:3.1.7-withdeps
- TheHive version: strangebee/thehive:5.1
- Elasticsearch version: docker.elastic.co/elasticsearch/elasticsearch:7.17.9
- Cassandra version: cassandra:4
Additional information
- I have setup services based on information provided at https://docs.strangebee.com/thehive/setup/installation/docker/#using-your-own-configuration-file
- I can successfully run MISP Analyser without any issues and get the correct output in TheHive
- I have been pulling my hair for hours
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the custom responder entry points shown in the report: cortexutils.responder.Responder.run, operations, and report. Reproduce the responder from the issue and compare its behavior with the working MISP Analyser; done means the responder generates the expected output file and the Cortex report no longer shows an empty errorMessage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100