TheHive-Project / TheHive-Project/Cortex-Analyzers
[Bug] OpenCTI analyzers
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 490
- Forks
- 405
- Avg merge
- 2d 43m
- Merged PRs (30d)
- 8
Description
Describe the bug
Once the analyzer config is set for OpenCTI. Create a observable and launch a worker analyzer the above error is show.
ERROR:pycti.api:Cannot query field "x_opencti_reliability" on type "Identity". Did you mean to use an inline fragment on "Organization"?
Traceback (most recent call last):
File "/worker/OpenCTI/opencti.py", line 110, in <module>
OpenCTIAnalyzer().run()
File "/worker/OpenCTI/opencti.py", line 80, in run
reports = opencti["api_client"].report.list(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/site-packages/pycti/entities/opencti_report.py", line 307, in list
result = self.opencti.query(
^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/site-packages/pycti/api/opencti_api_client.py", line 358, in query
raise ValueError(
ValueError: {'name': 'Cannot query field "x_opencti_reliability" on type "Identity". Did you mean to use an inline fragment on "Organization"?', 'message': 'Cannot query field "x_opencti_reliability" on type "Identity". Did you mean to use an inline fragment on "Organization"?'}
I am using the last version of both OpenCTI workers analyzer.
It seems that this only fails if the workers find a least a result. If no results the worker end without error.
To Reproduce
Steps to reproduce the behavior:
- Configure the OpenCTI in Cortex
- Launch a job with an observable.
- It fails
Expected behavior
A list of potential observables.
Work environment
- Client OS: Windows
- Server OS: Docker Cortex image thehiveproject/cortex:latest
- Cortex version: thehiveproject/cortex:latest
- Cortex Analyzer name: OpenCTI_SearchExactObservable and OpenCTI_SearchObservables
- Cortex Analyzer version: 2.0
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in /worker/OpenCTI/opencti.py around line 80, where report.list is called, and review the OpenCTI analyzer configuration and pycti query shown in the traceback. Reproduce with an observable that returns at least one result; done means both OpenCTI analyzers return the expected list without the x_opencti_reliability GraphQL error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100