Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] OpenCTI analyzers #1223

Open
hackjc opened this issue Sep 26, 2023 · 0 comments
Open

[Bug] OpenCTI analyzers #1223

hackjc opened this issue Sep 26, 2023 · 0 comments

Comments

@hackjc
Copy link

hackjc commented Sep 26, 2023

Describe the bug
Once the analyzer config is set for OpenCTI. Create a observable and launch a worker analyzer the above error is show.

ERROR:pycti.api:Cannot query field "x_opencti_reliability" on type "Identity". Did you mean to use an inline fragment on "Organization"?

Traceback (most recent call last):
  File "/worker/OpenCTI/opencti.py", line 110, in <module>
    OpenCTIAnalyzer().run()
  File "/worker/OpenCTI/opencti.py", line 80, in run
    reports = opencti["api_client"].report.list(
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/pycti/entities/opencti_report.py", line 307, in list
    result = self.opencti.query(
             ^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/pycti/api/opencti_api_client.py", line 358, in query
    raise ValueError(
ValueError: {'name': 'Cannot query field "x_opencti_reliability" on type "Identity". Did you mean to use an inline fragment on "Organization"?', 'message': 'Cannot query field "x_opencti_reliability" on type "Identity". Did you mean to use an inline fragment on "Organization"?'}

I am using the last version of both OpenCTI workers analyzer.

It seems that this only fails if the workers find a least a result. If no results the worker end without error.

To Reproduce
Steps to reproduce the behavior:

  1. Configure the OpenCTI in Cortex
  2. Launch a job with an observable.
  3. It fails

Expected behavior
A list of potential observables.

Work environment

  • Client OS: Windows
  • Server OS: Docker Cortex image thehiveproject/cortex:latest
  • Cortex version: thehiveproject/cortex:latest
  • Cortex Analyzer name: OpenCTI_SearchExactObservable and OpenCTI_SearchObservables
  • Cortex Analyzer version: 2.0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant