TheHive-Project / TheHive-Project/Cortex
Cortex Analyzers return JSON error when run
Nobody has claimed this yet.
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Description
EDIT THIS TITLE BEFORE POSTING. Use this template for bug reports. If you'd like to request a feature, please be as descriptive as possible and delete the template except the first section (Request Type)
Request Type
Bug
Work Environment
| Question | Answer |
|---|---|
| OS version (server) | Ubuntu |
| OS version (client) | 22.04 LTS |
| Cortex version / git hash | Docker Latest |
| Package Type | Docker, docker-compose |
| Browser type & version | If applicable |
Problem Description
I'm using docker and docker-compose, and I installed the Virtustotal_GetReport_3_1 but when I run it returns me a JSON error.
This is my docker-compose cortex cfg:
cortex.local:
image: thehiveproject/cortex:latest
container_name: cortex
restart: unless-stopped
environment:
- job_directory=/opt/cortex/jobs
- docker_job_directory=/tmp/cortex-jobs
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /tmp/cortex-jobs:/tmp/cortex-jobs
- ./cortex/logs:/var/log/cortex
- ./cortex/application.conf:/cortex/application.conf
depends_on:
- elasticsearch
ports:
- "0.0.0.0:9001:9001"
Complementary information
Traceback (most recent call last):
File "/worker/VirusTotal/virustotal.py", line 404, in <module>
VirusTotalAnalyzer().run()
^^^^^^^^^^^^^^^^^^^^
File "/worker/VirusTotal/virustotal.py", line 23, in __init__
Analyzer.__init__(self)
File "/usr/local/lib/python3.11/site-packages/cortexutils/analyzer.py", line 18, in __init__
Worker.__init__(self, job_directory, secret_phrases)
File "/usr/local/lib/python3.11/site-packages/cortexutils/worker.py", line 35, in __init__
self._input = json.load(sys.stdin)
^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/json/__init__.py", line 293, in load
return loads(fp.read(),
^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/json/__init__.py", line 346, in loads
return _default_decoder.decode(s)
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/json/decoder.py", line 337, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/json/decoder.py", line 355, in raw_decode
raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the Docker Compose configuration and the analyzer entry point at /worker/VirusTotal/virustotal.py, then follow initialization into cortexutils/worker.py where stdin is parsed. Reproduce the analyzer run and verify what input reaches the worker; done means the analyzer no longer fails with the reported JSONDecodeError.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, docker-compose, python
- Domain
- backend, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100