TheHive-Project / TheHive-Project/Cortex

Cortex Analyzers return JSON error when run

Open
#441 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Scala
Stars
1.6k
Forks
264
PR merge metrics
No merged PRs in 30d

Description

EDIT THIS TITLE BEFORE POSTING. Use this template for bug reports. If you'd like to request a feature, please be as descriptive as possible and delete the template except the first section (Request Type)

Request Type

Bug

Work Environment
Question Answer
OS version (server) Ubuntu
OS version (client) 22.04 LTS
Cortex version / git hash Docker Latest
Package Type Docker, docker-compose
Browser type & version If applicable
Problem Description

I'm using docker and docker-compose, and I installed the Virtustotal_GetReport_3_1 but when I run it returns me a JSON error.

This is my docker-compose cortex cfg:

cortex.local:
    image: thehiveproject/cortex:latest
    container_name: cortex
    restart: unless-stopped
    environment:
      - job_directory=/opt/cortex/jobs
      - docker_job_directory=/tmp/cortex-jobs
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /tmp/cortex-jobs:/tmp/cortex-jobs
      - ./cortex/logs:/var/log/cortex
      - ./cortex/application.conf:/cortex/application.conf
    depends_on:
      - elasticsearch
    ports:
      - "0.0.0.0:9001:9001"
Complementary information
Traceback (most recent call last):
  File "/worker/VirusTotal/virustotal.py", line 404, in <module>
    VirusTotalAnalyzer().run()
    ^^^^^^^^^^^^^^^^^^^^
  File "/worker/VirusTotal/virustotal.py", line 23, in __init__
    Analyzer.__init__(self)
  File "/usr/local/lib/python3.11/site-packages/cortexutils/analyzer.py", line 18, in __init__
    Worker.__init__(self, job_directory, secret_phrases)
  File "/usr/local/lib/python3.11/site-packages/cortexutils/worker.py", line 35, in __init__
    self._input = json.load(sys.stdin)
                  ^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/json/__init__.py", line 293, in load
    return loads(fp.read(),
           ^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/json/__init__.py", line 346, in loads
    return _default_decoder.decode(s)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/json/decoder.py", line 355, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the Docker Compose configuration and the analyzer entry point at /worker/VirusTotal/virustotal.py, then follow initialization into cortexutils/worker.py where stdin is parsed. Reproduce the analyzer run and verify what input reaches the worker; done means the analyzer no longer fails with the reported JSONDecodeError.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, docker-compose, python
Domain
backend, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.