TheHive-Project / TheHive-Project/Cortex

Can't run any analyzer

Open
#353 6 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Scala
Stars
1.6k
Forks
264
PR merge metrics
No merged PRs in 30d

Description

Describe the bug
Running any analyzer in cortex gives the following error :

Traceback (most recent call last):
  File "Cyberprotect/CyberprotectAnalyzer.py", line 46, in <module>
    CyberprotectAnalyzer().run()
  File "Cyberprotect/CyberprotectAnalyzer.py", line 12, in __init__
    Analyzer.__init__(self)
  File "/usr/local/lib/python3.8/site-packages/cortexutils/analyzer.py", line 17, in __init__
    Worker.__init__(self, job_directory)
  File "/usr/local/lib/python3.8/site-packages/cortexutils/worker.py", line 31, in __init__
    self._input = json.load(sys.stdin)
  File "/usr/local/lib/python3.8/json/__init__.py", line 293, in load
    return loads(fp.read(),
  File "/usr/local/lib/python3.8/json/__init__.py", line 357, in loads
    return _default_decoder.decode(s)
  File "/usr/local/lib/python3.8/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/local/lib/python3.8/json/decoder.py", line 355, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

To Reproduce
Steps to reproduce the behavior:

  1. Start Cortex version 3.1.1-1
    image

  2. Add any analyzer

  3. run analyzer

image

Expected behavior
Analyzer return a report for the observables

Environment:
-Docker version 20.10.5, build 55c4c88

  • ubuntu server 20.04

Additional Context
docker-compose.yml

version: "2"
services:
  elasticsearch:
    image: elasticsearch:7.8.1
    environment:
      - http.host=0.0.0.0
      - discovery.type=single-node
      - script.allowed_types=inline
      - thread_pool.search.queue_size=100000
      - thread_pool.write.queue_size=10000
  cortex:
    image: thehiveproject/cortex:latest
    environment:
      - job_directory=./cortex-jobs
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      #- ./tmp:/tmp
#- ${job_directory}:${job_directory}
    depends_on:
      - elasticsearch
    ports:
      - "0.0.0.0:9001:9001"

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the docker-compose.yml configuration and the traceback entries in Cyberprotect/CyberprotectAnalyzer.py and cortexutils/worker.py. Reproduce the failure with Cortex 3.1.1-1 and inspect how the analyzer receives its input through stdin and the configured job directory. Done means an analyzer runs successfully and returns a report for the observable.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, docker-compose, python
Domain
backend, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.