TheHive-Project / TheHive-Project/Cortex

Cortex Censys Analyzer failed to authenticate

Open
#443 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Scala
Stars
1.6k
Forks
264
PR merge metrics
No merged PRs in 30d

Description

Cortex Censys Analyzer failed to authenticate

Work Environment
Question Answer
OS version (server) Ubuntu 20.04.4 LTS (Focal Fossa)
OS version (client) Windows 11 ...
Cortex version / git hash 3.1.7-1
Package Type From source
Problem Description

I try to authenticate with Censys analyzer but it shows that I don't provide a proper credentials.
I did provide a proper credential which is both uid and secret_key collected from Censys-My Account but when I run analyzer within Thehive, it shows:

{
"errorMessage": "Censys raised NotAuthorizedException. Please check your credentials.",
"success": false
}

I did change the version of Censys to 2.x.x and the credential is working well but it shows another error:

"Traceback (most recent call last): File "/opt/Cortex-Analyzers/analyzers/Censys/censys_analyzer.py", line 5, in from censys.ipv4 import CensysIPv4ModuleNotFoundError: No module named 'censys.ipv4''"

I think the problem is that censys.ipv4 is deprecate so we need to make some changes on the analyzer code.
What I do to

Steps to Reproduce
  1. Enable Cencys analyzer on Cortex with uid-key corresponding to Censys Account
  2. Go to Thehive and create an Observable
  3. Fill out the requirement field with Type is IP and choose Create observable.
  4. Choose the Observable and run analyzer Censys.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with analyzers/Censys/censys_analyzer.py and review how it imports and authenticates through the Censys dependency. Reproduce the analyzer run using the documented uid and secret_key, then verify that the current dependency works without the reported import or authorization errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.