TheHive-Project / TheHive-Project/Cortex
Can't run any analyzer
Nobody has claimed this yet.
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
Running any analyzer in cortex gives the following error :
Traceback (most recent call last):
File "Cyberprotect/CyberprotectAnalyzer.py", line 46, in <module>
CyberprotectAnalyzer().run()
File "Cyberprotect/CyberprotectAnalyzer.py", line 12, in __init__
Analyzer.__init__(self)
File "/usr/local/lib/python3.8/site-packages/cortexutils/analyzer.py", line 17, in __init__
Worker.__init__(self, job_directory)
File "/usr/local/lib/python3.8/site-packages/cortexutils/worker.py", line 31, in __init__
self._input = json.load(sys.stdin)
File "/usr/local/lib/python3.8/json/__init__.py", line 293, in load
return loads(fp.read(),
File "/usr/local/lib/python3.8/json/__init__.py", line 357, in loads
return _default_decoder.decode(s)
File "/usr/local/lib/python3.8/json/decoder.py", line 337, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/usr/local/lib/python3.8/json/decoder.py", line 355, in raw_decode
raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
To Reproduce
Steps to reproduce the behavior:
-
Start Cortex version 3.1.1-1

-
Add any analyzer
-
run analyzer

Expected behavior
Analyzer return a report for the observables
Environment:
-Docker version 20.10.5, build 55c4c88
- ubuntu server 20.04
Additional Context
docker-compose.yml
version: "2"
services:
elasticsearch:
image: elasticsearch:7.8.1
environment:
- http.host=0.0.0.0
- discovery.type=single-node
- script.allowed_types=inline
- thread_pool.search.queue_size=100000
- thread_pool.write.queue_size=10000
cortex:
image: thehiveproject/cortex:latest
environment:
- job_directory=./cortex-jobs
volumes:
- /var/run/docker.sock:/var/run/docker.sock
#- ./tmp:/tmp
#- ${job_directory}:${job_directory}
depends_on:
- elasticsearch
ports:
- "0.0.0.0:9001:9001"
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the docker-compose.yml configuration and the traceback entries in Cyberprotect/CyberprotectAnalyzer.py and cortexutils/worker.py. Reproduce the failure with Cortex 3.1.1-1 and inspect how the analyzer receives its input through stdin and the configured job directory. Done means an analyzer runs successfully and returns a report for the observable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, docker-compose, python
- Domain
- backend, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100