TheHive-Project / TheHive-Project/Cortex-Analyzers
[Bug] Submission of file hashes to MISP failing
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 490
- Forks
- 405
- Avg merge
- 2d 43m
- Merged PRs (30d)
- 8
Description
Describe the bug
When I execute an analyzer job to search MISP for file hashes, I get the following error:
When submitting the hash, I receive the following error:
Request headers:{'User-Agent': 'PyMISP 2.4.134 - Python 3.6', 'Accept-Encoding': 'gzip, deflate', 'Accept': 'application/json', 'Connection': 'keep-alive', 'Cookie': 'MISP-ba7f1640-8e16-48b3-8761-e21906a9d5a5=7mjnurnjj6nv6frhe2nvkh1q6b', 'Content-Length': '661', 'Authorization': '[REDACTED]', 'content-type': 'application/json'}Request body:{"returnFormat": "json", "value": "fd77b5dd0ca45d110a897d650e9fb146d4b4aae5", "type": ["md5", "sha1", "sha256", "ssdeep", "sha224", "sha384", "sha512", "sha512/224", "sha512/256", "tlsh", "authentihash", "filename|md5", "filename|sha1", "filename|sha256", "filename|ssdeep", "filename|sha224", "filename|sha384", "filename|sha512", "filename|sha512/224", "filename|sha512/256", "filename|tlsh", "filename|authentihash"], "withAttachments": 0, "metadata": 0, "enforceWarninglist": 0, "includeEventUuid": 0, "includeEventTags": 0, "sgReferenceOnly": 0, "includeContext": 0, "headerless": 0, "includeSightings": 0, "includeDecayScore": 0, "includeCorrelations": 0}Response (if any):{"name":"An Internal Error Has Occurred.","message":"An Internal Error Has Occurred.","url":"/events/restSearch"}Traceback (most recent call last): File "/opt/Cortex-Analyzers/analyzers/MISP/misp.py", line 80, in MISPAnalyzer().run() File "/opt/Cortex-Analyzers/analyzers/MISP/misp.py", line 60, in run response = self.misp.search_hash(self.get_data()) File "/opt/Cortex-Analyzers/analyzers/MISP/mispclient.py", line 252, in search_hash return self.__search(type_attribute=self.__misphashtypes(), value=searchterm) File "/opt/Cortex-Analyzers/analyzers/MISP/mispclient.py", line 225, in __search misp_response = connection.search(type_attribute=type_attribute, value=value) File "/usr/local/lib/python3.6/dist-packages/pymisp/api.py", line 2050, in search normalized_response = self._check_json_response(response) File "/usr/local/lib/python3.6/dist-packages/pymisp/api.py", line 2943, in _check_json_response r = self._check_response(response, expect_json=True) File "/usr/local/lib/python3.6/dist-packages/pymisp/api.py", line 2952, in _check_response raise MISPServerError(f'Error code 500:\n{response.text}')pymisp.exceptions.MISPServerError: Error code 500:{"name":"An Internal Error Has Occurred.","message":"An Internal Error Has Occurred.","url":"/events/restSearch"}
Weirdly, I am able to successfully submit IPs and domains for analysis against MISP.
To Reproduce
Steps to reproduce the behavior:
- Create observable (file hash) within thehive;
- Select for analysis via the MISP analyzer for Cortex;
- Receive error.
Expected behavior
Submit file hash for analysis via the MISP Cortex analyzer and receive results.
Work environment
- Client OS: Windows 10
- Server OS: Ubuntu 18
- Browse type and version: Chrome
- Cortex version: 3.1.0 RC1
- Cortex Analyzer/Responder name: MISP_2_1
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with analyzers/MISP/misp.py and analyzers/MISP/mispclient.py, especially the search_hash and __search entry points shown in the traceback. Reproduce the file-hash request against the MISP analyzer and compare it with the working IP and domain searches. Done means file-hash analysis returns results instead of the reported MISPServerError.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100