TheHive-Project / TheHive-Project/Cortex-Analyzers

[Bug] A custom responder return with an empty error

Open
#1,184 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
490
Forks
405
Avg merge
2d 43m
Merged PRs (30d)
8

Description

Describe the bug
I have written a bare minimal responder that just returns a success message for a request from TheHive. However, I get the status failure without much information.

#!/usr/bin/env python3

from cortexutils.responder import Responder

class SampleService(Responder):
    def __init__(self):
        Responder.__init__(self)

    def run(self):
        Responder.run(self)
        self.report({'message': "success"})

    def operations(self, raw):
        return [self.build_operation("AddTagToCase", tag="sampleId:id-1")]

if __name__ == "__main__":
    SampleService().run()

When I run the responder from TheHive, I get the below output in the application logs with a warning saying
[warn] o.t.c.s.DockerJobRunnerSrv - The worker didn't generate output file.

[info] o.t.c.s.DockerJobRunnerSrv - Execute container bf99c645848c9ca0f9f00d573b7f1b8d21220f272f9003b4fb44b8c87c0370b9
  timeout: 30 minutes
  image  : cortex-neurons/sample_service:0.2
  volume : /tmp/cortex-jobs/cortex-job-Fk2v5ocBSFpERmG9YbQq-7518629213985387577:/job
[info] c.s.d.c.DefaultDockerClient - Starting container with Id: bf99c645848c9ca0f9f00d573b7f1b8d21220f272f9003b4fb44b8c87c0370b9
[info] o.t.c.s.AccessLogFilter - 192.168.65.205 GET /api/alert took 17ms and returned 200 2 bytes
[warn] o.t.c.s.DockerJobRunnerSrv - The worker didn't generate output file.
[info] o.t.c.s.JobSrv - Job Fk2v5ocBSFpERmG9YbQq has finished with status Failure
[info] o.t.c.s.AuditActor - Job Fk2v5ocBSFpERmG9YbQq has be updated (JsDefined("Failure"))

In cortex UI I can see the observable information as input and output(Report) only contains,

{
  "errorMessage": "",
  "input": null,
  "success": false
}

Work environment

  • Cortex version: thehiveproject/cortex:3.1.7-withdeps
  • TheHive version: strangebee/thehive:5.1
  • Elasticsearch version: docker.elastic.co/elasticsearch/elasticsearch:7.17.9
  • Cassandra version: cassandra:4

Additional information

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the custom responder entry points shown in the report: cortexutils.responder.Responder.run, operations, and report. Reproduce the responder from the issue and compare its behavior with the working MISP Analyser; done means the responder generates the expected output file and the Cortex report no longer shows an empty errorMessage.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.