TheHive-Project / TheHive-Project/Cortex
MISP_2_0 analyzer throws error when executed on an IP observable inside Cortex docker image
Open
@jeromeleonard is already working on this.
Since Oct 17, 2018.
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Description
Request Type
Bug
Work Environment
| Question | Answer |
|---|---|
| OS version (server) | n/a |
| OS version (client) | n/a |
| Cortex version / git hash | thehiveproject/cortex:2.1.2-1 |
| Package Type | Docker (Swarm) |
Problem Description
Not sure if it is caused by the Cortex docker image or the analyzer's code, but when the latest MISP_2_0 analyzer is run on an IP, Cortex chokes with the following traceback:
Invalid output
WARNING [__init__.py:49 - <module>() ] Unable to load pymisp properly: No module named enum
Traceback (most recent call last):
File "MISP/misp.py", line 80, in <module>
MISPAnalyzer().run()
File "MISP/misp.py", line 29, in __init__
proxies={'http': self.http_proxy, 'https': self.https_proxy})
File "/opt/Cortex-Analyzers/analyzers/MISP/mispclient.py", line 59, in __init__
self.misp_connections.append(pymisp.PyMISP(url=server,
AttributeError: 'module' object has no attribute 'PyMISP'
Steps to Reproduce
- Deploy Cortex as a docker container or Swarm service
- Supply latest analyzers as a docker volume
- Use
MISP_2_0analyzer on an IP observable
Possible Solutions
Perhaps a dependency issue in Cortex docker image for PyMISP? The only place it imports from enum import Enum is here
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.