TheHive-Project / TheHive-Project/Cortex
Failed to get response from Cortex module: HTTP Moved Permanently
Nobody has claimed this yet.
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Description
Possible Bug:
Work Environment
| Question | Answer |
|---|---|
| OS version (server) | CentOS Linux 7 |
| OS version (client) | Linux test-modules 3.10.0-1160.25.1.el7.x86_64 |
| Cortex version / git hash | |
| Cortex3.1.1-1 | |
| Elastic4Play1.13.1 | |
| Play2.8.3 | |
| Elastic4s7.9.1 | |
| ElasticSearch client7.9.1 | |
| Package Type | Binary |
| Browser type & version | n/a |
Problem Description
Hi guys, first of all than you for looking into this. I am trying to integrate MISP with Cortex as described in MISP/Cortex docs.
I am currently using MISP v2.4.143 (3b2100e3d1e21c5c1d5e5cc7627bfe65278f910b).
Once I add the cortex server inside misp pluggin settings, I am getting following:

After digging a bit I see following lines from /var/log/httpd/misp.local_access.log
127.0.0.1 - - [06/Jun/2021:08:48:56 +0000] "GET /:9000/modules HTTP/1.1" 301 238 "-" "CakePHP"
127.0.0.1 - - [06/Jun/2021:08:48:56 +0000] "GET cd /:9000/modules HTTP/1.1" 301 238 "-" "CakePHP"
78.90.118.82 - - [06/Jun/2021:08:48:56 +0000] "POST /servers/serverSettingsEdit/Plugin.Cortex_authkey/3/1 HTTP/1.1" 500 255 "https://129.213.16.193/servers/serverSettings/Plugin" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36"
127.0.0.1 - - [06/Jun/2021:08:48:57 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.20 (internal dummy connection)"
127.0.0.1 - - [06/Jun/2021:08:48:58 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.20 (internal dummy connection)"
127.0.0.1 - - [06/Jun/2021:08:48:59 +0000] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.20 (internal dummy connection)"
127.0.0.1 - - [06/Jun/2021:08:49:00 +0000] "GET /:9000/modules HTTP/1.1" 301 238 "-" "CakePHP"
In addtion configuration from misp cortex module below:

Is this something that should be looked from MISP side?
I do not understand why do we get such strange call and which is the file responsible for it?
Thank you in advance.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the /modules request shown in the Apache access log and the MISP Cortex plugin settings described in the issue. Compare the configured Cortex endpoint with the observed HTTP 301 response and determine whether the request path or deployment configuration is responsible; done means identifying the source of the redirect and documenting the required configuration or fix.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php, scala
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100