TheHive-Project / TheHive-Project/Cortex
analyzer 404 errors, worker not found
Open
Nobody has claimed this yet.
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Description
Request Type
Bug
Work Environment
| Question | Answer |
|---|---|
| OS version (server) | Debian 18.04 |
| OS version (client) | |
| Cortex version / git hash | 3.0.1 relese |
| Package Type | From source |
| Browser type & version | Any |
Problem Description
Describe the problem/bug as clearly as possible.
Steps to Reproduce
- Install Cortex release and add Cortex to TheHive 4 configuration
- Install Analyzers with git
- Configure analyzers (about 20 are configured with verifed UIDs/Keys)
- Create case in TheHive, add observables and run Responders
Complementary information
Get repeated errors of the form:
2020-10-02 12:53:48,226 [INFO] from org.thp.cortex.services.ErrorHandler in application-akka.actor.default-dispatcher-32 - GET /api/analyzer/URLhaus_2_0 returned 404 org.elastic4play.NotFoundError: worker URLhaus_2_0 not found
at org.thp.cortex.services.WorkerSrv.$anonfun$getForOrganization$2(WorkerSrv.scala:83)
at scala.Option.getOrElse(Option.scala:138)
at org.thp.cortex.services.WorkerSrv.$anonfun$getForOrganization$1(WorkerSrv.scala:83)
at scala.util.Success.$anonfun$map$1(Try.scala:255)
at scala.util.Success.map(Try.scala:213)
at scala.concurrent.Future.$anonfun$map$1(Future.scala:292)
at scala.concurrent.impl.Promise.liftedTree1$1(Promise.scala:33)
at scala.concurrent.impl.Promise.$anonfun$transform$1(Promise.scala:33)
at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:64)
at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55)
at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:91)
at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:23)
at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:85)
at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:91)
at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:40)
at akka.dispatch.ForkJoinExecutorConfigurator$AkkaForkJoinTask.exec(ForkJoinExecutorConfigurator.scala:44)
at akka.dispatch.forkjoin.ForkJoinTask.doExec(ForkJoinTask.java:260)
at akka.dispatch.forkjoin.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1339)
at akka.dispatch.forkjoin.ForkJoinPool.runWorker(ForkJoinPool.java:1979)
at akka.dispatch.forkjoin.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:107)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the GET /api/analyzer/URLhaus_2_0 request and inspect WorkerSrv.scala around line 83. Reproduce the analyzer configuration and compare the configured worker UID with the worker Cortex can find; done means the configured analyzer no longer produces the reported 404, or the missing-worker cause is clearly documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- scala
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100