TheHive-Project / TheHive-Project/Cortex

No responders available to enable in Cortex 3.1.7-1 Web UI

Open
#437 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Scala
Stars
1.6k
Forks
264
PR merge metrics
No merged PRs in 30d

Description

Request Type

Bug Fix - code change in org.thp.cortex.services.WorkerSrv

Work Environment
Question Answer
OS version (server) Ubuntu 20.04 LTS
OS version (client) MSEdge web browser
Cortex version / git hash 3.1.7-1
Package Type From source
Browser type & version Version 107.0.1418.56 (Official build) (64-bit)
Problem Description

There are no available responers to be enabled in the web-ui even though they are all installed in directory - /opt/Cortex-Analyzers/responders

Steps to Reproduce

1.Install Ubuntu 20.04 LTS
2. Install Cortex via provided installation script via below

wget -q -O /tmp/install.sh https://archives.strangebee.com/scripts/install.sh ; sudo -v ; bash /tmp/install.sh
Possible Solutions

On investigating the logs in /var/log/cortex/application.log i noticed the following entry

image

2022-11-28 14:35:40,025 [WARN] from org.thp.cortex.services.WorkerSrv in application-akka.actor.default-dispatcher-7 - **Worker path (/opt/Cortex-Analzers/responders) is not found**
java.net.MalformedURLException: no protocol: /opt/Cortex-Analzers/responders
        at java.base/java.net.URL.<init>(URL.java:674)
        at java.base/java.net.URL.<init>(URL.java:569)
        at java.base/java.net.URL.<init>(URL.java:516)
        at org.thp.cortex.services.WorkerSrv.$anonfun$scan$21(WorkerSrv.scala:200)
        at scala.concurrent.Future$.$anonfun$apply$1(Future.scala:659)
        at scala.util.Success.$anonfun$map$1(Try.scala:255)
        at scala.util.Success.map(Try.scala:213)
        at scala.concurrent.Future.$anonfun$map$1(Future.scala:292)
        at scala.concurrent.impl.Promise.liftedTree1$1(Promise.scala:33)
        at scala.concurrent.impl.Promise.$anonfun$transform$1(Promise.scala:33)
        at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:64)
        at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:63)
        at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:100)
        at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:23)
        at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:85)
        at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:100)
        at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:49)
        at akka.dispatch.ForkJoinExecutorConfigurator$AkkaForkJoinTask.exec(ForkJoinExecutorConfigurator.scala:48)
        at java.base/java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:373)
        at java.base/java.util.concurrent.ForkJoinPool$WorkQueue.topLevelExec(ForkJoinPool.java:1182)
        at java.base/java.util.concurrent.ForkJoinPool.scan(ForkJoinPool.java:1655)
        at java.base/java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1622)
        at java.base/java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:165)

It appears that there is a typo in the code in org.thp.cortex.services.WorkerSrv--akka.actor.default-dispatcher-7.

To confirm, this I did the following

  1. Create the directory /opt/Cortex-Analzers/responders.
  2. Change the owner to cortex:cortex recursively.
  3. Change to /opt/Cortex-Analzers/responders/ directory
  4. Link the /opt/Cortex-Analzers/responders to the correct directory of /opt/Cortex-Analyzers/responders/
sudo ln -s /opt/Cortex-Analyzers/responders/ .

image

Complementary information

Responders are now available to be enabled
image

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in WorkerSrv.scala around line 200 and compare how the configured worker path is handled with the installed /opt/Cortex-Analyzers/responders directory. Use the application.log warning and the reported installation steps to reproduce the scan failure. Done means installed responders are found and become available to enable in the Web UI without the path error.

Written by the indexing model from the issue text.

Assessment

Tech stack
scala
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.