TheHive-Project / TheHive-Project/Cortex

MISP_2_0 analyzer throws error when executed on an IP observable inside Cortex docker image

Open
#149 5 comments 0 reactions 2 assignees View on GitHub

@jeromeleonard is already working on this.

Since Oct 17, 2018.

Dominant language
Scala
Stars
1.6k
Forks
264
PR merge metrics
No merged PRs in 30d

Description

Request Type

Bug

Work Environment
Question Answer
OS version (server) n/a
OS version (client) n/a
Cortex version / git hash thehiveproject/cortex:2.1.2-1
Package Type Docker (Swarm)
Problem Description

Not sure if it is caused by the Cortex docker image or the analyzer's code, but when the latest MISP_2_0 analyzer is run on an IP, Cortex chokes with the following traceback:

Invalid output
WARNING [__init__.py:49 - <module>() ] Unable to load pymisp properly: No module named enum
Traceback (most recent call last):
  File "MISP/misp.py", line 80, in <module>
    MISPAnalyzer().run()
  File "MISP/misp.py", line 29, in __init__
    proxies={'http': self.http_proxy, 'https': self.https_proxy})
  File "/opt/Cortex-Analyzers/analyzers/MISP/mispclient.py", line 59, in __init__
    self.misp_connections.append(pymisp.PyMISP(url=server,
AttributeError: 'module' object has no attribute 'PyMISP'
Steps to Reproduce
  1. Deploy Cortex as a docker container or Swarm service
  2. Supply latest analyzers as a docker volume
  3. Use MISP_2_0 analyzer on an IP observable
Possible Solutions

Perhaps a dependency issue in Cortex docker image for PyMISP? The only place it imports from enum import Enum is here

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.