TheHive-Project / TheHive-Project/Cortex-Analyzers

[Bug] Submission of file hashes to MISP failing

Open
#913 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
490
Forks
405
Avg merge
2d 43m
Merged PRs (30d)
8

Description

Describe the bug
When I execute an analyzer job to search MISP for file hashes, I get the following error:

When submitting the hash, I receive the following error:

Request headers:{'User-Agent': 'PyMISP 2.4.134 - Python 3.6', 'Accept-Encoding': 'gzip, deflate', 'Accept': 'application/json', 'Connection': 'keep-alive', 'Cookie': 'MISP-ba7f1640-8e16-48b3-8761-e21906a9d5a5=7mjnurnjj6nv6frhe2nvkh1q6b', 'Content-Length': '661', 'Authorization': '[REDACTED]', 'content-type': 'application/json'}Request body:{"returnFormat": "json", "value": "fd77b5dd0ca45d110a897d650e9fb146d4b4aae5", "type": ["md5", "sha1", "sha256", "ssdeep", "sha224", "sha384", "sha512", "sha512/224", "sha512/256", "tlsh", "authentihash", "filename|md5", "filename|sha1", "filename|sha256", "filename|ssdeep", "filename|sha224", "filename|sha384", "filename|sha512", "filename|sha512/224", "filename|sha512/256", "filename|tlsh", "filename|authentihash"], "withAttachments": 0, "metadata": 0, "enforceWarninglist": 0, "includeEventUuid": 0, "includeEventTags": 0, "sgReferenceOnly": 0, "includeContext": 0, "headerless": 0, "includeSightings": 0, "includeDecayScore": 0, "includeCorrelations": 0}Response (if any):{"name":"An Internal Error Has Occurred.","message":"An Internal Error Has Occurred.","url":"/events/restSearch"}Traceback (most recent call last): File "/opt/Cortex-Analyzers/analyzers/MISP/misp.py", line 80, in MISPAnalyzer().run() File "/opt/Cortex-Analyzers/analyzers/MISP/misp.py", line 60, in run response = self.misp.search_hash(self.get_data()) File "/opt/Cortex-Analyzers/analyzers/MISP/mispclient.py", line 252, in search_hash return self.__search(type_attribute=self.__misphashtypes(), value=searchterm) File "/opt/Cortex-Analyzers/analyzers/MISP/mispclient.py", line 225, in __search misp_response = connection.search(type_attribute=type_attribute, value=value) File "/usr/local/lib/python3.6/dist-packages/pymisp/api.py", line 2050, in search normalized_response = self._check_json_response(response) File "/usr/local/lib/python3.6/dist-packages/pymisp/api.py", line 2943, in _check_json_response r = self._check_response(response, expect_json=True) File "/usr/local/lib/python3.6/dist-packages/pymisp/api.py", line 2952, in _check_response raise MISPServerError(f'Error code 500:\n{response.text}')pymisp.exceptions.MISPServerError: Error code 500:{"name":"An Internal Error Has Occurred.","message":"An Internal Error Has Occurred.","url":"/events/restSearch"}

Weirdly, I am able to successfully submit IPs and domains for analysis against MISP.

To Reproduce
Steps to reproduce the behavior:

  1. Create observable (file hash) within thehive;
  2. Select for analysis via the MISP analyzer for Cortex;
  3. Receive error.

Expected behavior
Submit file hash for analysis via the MISP Cortex analyzer and receive results.

Work environment

  • Client OS: Windows 10
  • Server OS: Ubuntu 18
  • Browse type and version: Chrome
  • Cortex version: 3.1.0 RC1
  • Cortex Analyzer/Responder name: MISP_2_1

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with analyzers/MISP/misp.py and analyzers/MISP/mispclient.py, especially the search_hash and __search entry points shown in the traceback. Reproduce the file-hash request against the MISP analyzer and compare it with the working IP and domain searches. Done means file-hash analysis returns results instead of the reported MISPServerError.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.