Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] Requirements don't get installed for new responder #1259

Open
Kusko25 opened this issue Apr 22, 2024 · 0 comments
Open

[Bug] Requirements don't get installed for new responder #1259

Kusko25 opened this issue Apr 22, 2024 · 0 comments

Comments

@Kusko25
Copy link

Kusko25 commented Apr 22, 2024

I am trying to write a new Responder following the instructions here (http://docs.thehive-project.org/cortex/api/how-to-create-a-responder/) but if I try to run it I get
Traceback (most recent call last): File "/opt/Custom-Analyzers/responders/Nailer/nailer.py", line 6, in <module> from cortexutils.responder import ResponderModuleNotFoundError: No module named 'cortexutils'

To Reproduce
Cortex is running in a Docker container with the Responder directory mounted to a Windows filesystem.
This is what my filetree looks like:

└── NOKI_Cortex_Responder
    ├── noki_responder.json
    ├── requirements.txt
    ├── responder.py

And the contents of noki_responder.json:

    "name" : "NOKI Reporter",
    "version" : "1.0",
    "author" : "Fraunhofer",
    "url": "TODO",
    "license": "TODO",
    "description": "Prepares a NOKI report and shares it via MISP",
    "dataTypeList": ["thehive:case"],
    "command": "NOKI_Cortex_Responder/responder.py",
    "baseConfig": "noki_responder",
    "config": {
      "misp-url": "http://localhost:8082",
      "misp-key": "LEbYEjTaco9247MpziThmiVc7yJATnOgDdRaneDF"
    },
    "configurationItems": [
      {
        "name": "misp-url",
        "description": "The URL of the MISP instance",
        "type": "string",
        "multi": false,
        "required": true
      },
      {
        "name": "misp-key",
        "description": "MISP API key",
        "type": "string",
        "multi": false,
        "required": true
      },
      {
        "name": "timeformat",
        "description": "The format of the time in the report (timestamp, iso or as taken by the python strftime function)",
        "type": "string",
        "multi": false,
        "required": true
      }
    ]
  }

I'd expect Cortex to install the requirements from the file and run the Responder (probably still with errors but at least get past the import statements)

Work environment

  • Client OS: Windows 11
  • Cortex version: 3.1.7-1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant