TheHive-Project / TheHive-Project/Cortex
No responders available to enable in Cortex 3.1.7-1 Web UI
Nobody has claimed this yet.
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Description
Request Type
Bug Fix - code change in org.thp.cortex.services.WorkerSrv
Work Environment
| Question | Answer |
|---|---|
| OS version (server) | Ubuntu 20.04 LTS |
| OS version (client) | MSEdge web browser |
| Cortex version / git hash | 3.1.7-1 |
| Package Type | From source |
| Browser type & version | Version 107.0.1418.56 (Official build) (64-bit) |
Problem Description
There are no available responers to be enabled in the web-ui even though they are all installed in directory - /opt/Cortex-Analyzers/responders
Steps to Reproduce
1.Install Ubuntu 20.04 LTS
2. Install Cortex via provided installation script via below
wget -q -O /tmp/install.sh https://archives.strangebee.com/scripts/install.sh ; sudo -v ; bash /tmp/install.sh
Possible Solutions
On investigating the logs in /var/log/cortex/application.log i noticed the following entry

2022-11-28 14:35:40,025 [WARN] from org.thp.cortex.services.WorkerSrv in application-akka.actor.default-dispatcher-7 - **Worker path (/opt/Cortex-Analzers/responders) is not found**
java.net.MalformedURLException: no protocol: /opt/Cortex-Analzers/responders
at java.base/java.net.URL.<init>(URL.java:674)
at java.base/java.net.URL.<init>(URL.java:569)
at java.base/java.net.URL.<init>(URL.java:516)
at org.thp.cortex.services.WorkerSrv.$anonfun$scan$21(WorkerSrv.scala:200)
at scala.concurrent.Future$.$anonfun$apply$1(Future.scala:659)
at scala.util.Success.$anonfun$map$1(Try.scala:255)
at scala.util.Success.map(Try.scala:213)
at scala.concurrent.Future.$anonfun$map$1(Future.scala:292)
at scala.concurrent.impl.Promise.liftedTree1$1(Promise.scala:33)
at scala.concurrent.impl.Promise.$anonfun$transform$1(Promise.scala:33)
at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:64)
at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:63)
at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:100)
at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:23)
at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:85)
at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:100)
at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:49)
at akka.dispatch.ForkJoinExecutorConfigurator$AkkaForkJoinTask.exec(ForkJoinExecutorConfigurator.scala:48)
at java.base/java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:373)
at java.base/java.util.concurrent.ForkJoinPool$WorkQueue.topLevelExec(ForkJoinPool.java:1182)
at java.base/java.util.concurrent.ForkJoinPool.scan(ForkJoinPool.java:1655)
at java.base/java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1622)
at java.base/java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:165)
It appears that there is a typo in the code in org.thp.cortex.services.WorkerSrv--akka.actor.default-dispatcher-7.
To confirm, this I did the following
- Create the directory /opt/Cortex-Analzers/responders.
- Change the owner to cortex:cortex recursively.
- Change to /opt/Cortex-Analzers/responders/ directory
- Link the /opt/Cortex-Analzers/responders to the correct directory of /opt/Cortex-Analyzers/responders/
sudo ln -s /opt/Cortex-Analyzers/responders/ .

Complementary information
Responders are now available to be enabled

Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in WorkerSrv.scala around line 200 and compare how the configured worker path is handled with the installed /opt/Cortex-Analyzers/responders directory. Use the application.log warning and the reported installation steps to reproduce the scan failure. Done means installed responders are found and become available to enable in the Web UI without the path error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- scala
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100