Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[VirusTotal] Error with internal enrichment #1271

Closed
peasead opened this issue Jun 30, 2023 · 1 comment
Closed

[VirusTotal] Error with internal enrichment #1271

peasead opened this issue Jun 30, 2023 · 1 comment
Labels
bug use for describing something not working as expected solved use to identify issue that has been solved (must be linked to the solving PR)
Milestone

Comments

@peasead
Copy link

peasead commented Jun 30, 2023

Description

When I try to perform a manual or automated enrichment with the VirusTotal internal enrichment, it partially fails.

It doesn't collect labels and other values...but it seems to know it came from VT? When looking at the connector, it has this error.

Retry.__init__() got an unexpected keyword argument 'method_whitelist'

I don't know if it's related to this Issue based on this comment

Removed deprecated Retry options method_whitelist, DEFAULT_REDIRECT_HEADERS_BLACKLIST (#​2086 urllib3/urllib3#2086__).

Environment

  1. OS (where OpenCTI server runs): Ubuntu
  2. OpenCTI version: 8.5.7
  3. OpenCTI client: Frontend
  4. Other environment details:
image

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Download an EICAR file
  2. Upload it as an Artifact, it returns the following
image

Similar things happen if I use the hash and manually create a File entity.

image

Expected Output

Add the VT enrichment data.

Actual Output

Stated above

Additional information

I've tried to restart the VT connector, clear the state, etc.

I'm not sure what version the VT connector is at (not sure how to check that).

@FIying-Scotsman
Copy link
Contributor

FIying-Scotsman commented Jul 4, 2023

Having the exact same issue on 5.8.7. Likely related to this change which replaced the deprecated term method_whitelist with allowed_methods

Full error below - reproduced by attempting to enrich an IP but an identical error is thrown for hashes as well (get_ip_info is swapped out for the method which handles hashes):-

  File "/usr/local/lib/python3.11/site-packages/pycti/connector/opencti_connector_helper.py", line 235, in _process_message
    json_data["internal"]["work_id"], message_task.result()
                                      ^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/concurrent/futures/_base.py", line 449, in result
    return self.__get_result()
           ^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/concurrent/futures/_base.py", line 401, in __get_result
    raise self._exception
  File "/opt/opencti-connector-virustotal/virustotal/virustotal.py", line 365, in _process_message
    return self._process_ip(observable)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/opencti-connector-virustotal/virustotal/virustotal.py", line 228, in _process_ip
    json_data = self.client.get_ip_info(observable["observable_value"])
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/opencti-connector-virustotal/virustotal/client.py", line 201, in get_ip_info
    return self._query(url)
           ^^^^^^^^^^^^^^^^
  File "/opt/opencti-connector-virustotal/virustotal/client.py", line 51, in _query
    retry_strategy = Retry(
                     ^^^^^^
TypeError: Retry.__init__() got an unexpected keyword argument 'method_whitelist'

@SamuelHassine SamuelHassine added the solved use to identify issue that has been solved (must be linked to the solving PR) label Jul 4, 2023
@SamuelHassine SamuelHassine added this to the Release 5.9.0 milestone Jul 4, 2023
@SamuelHassine SamuelHassine added the bug use for describing something not working as expected label Jul 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug use for describing something not working as expected solved use to identify issue that has been solved (must be linked to the solving PR)
Projects
None yet
Development

No branches or pull requests

3 participants