Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[HARFANGLAB-INCIDENTS] AttributeError: 'NoneType' object has no attribute 'name' #3153

Closed
breizh33 opened this issue Dec 18, 2024 · 0 comments · Fixed by #3187
Closed

[HARFANGLAB-INCIDENTS] AttributeError: 'NoneType' object has no attribute 'name' #3153

breizh33 opened this issue Dec 18, 2024 · 0 comments · Fixed by #3187
Assignees
Labels
bug use for describing something not working as expected filigran support [optional] use to identify an issue related to feature developed & maintained by Filigran. solved use to identify issue that has been solved (must be linked to the solving PR)
Milestone

Comments

@breizh33
Copy link

Description

No synchronisation with harfanglabs incidents :

{"timestamp": "2024-12-18T08:25:04.266251Z", "level": "INFO", "name": "HarfangLab", "message": "[API] HTTP GET Request to endpoint", "attributes": {"url": "https://xxxxx//api/data/alert/alert/Alert?status=new%2Cinvestigating%2Cclosed&alert_type=yara%2Csigma%2Cioc&maturity=stable&ordering=alert_time&limit=100&from=2024-01-01T00%3A00%3A00%2B00%3A00"}}
{"timestamp": "2024-12-18T08:25:04.667991Z", "level": "INFO", "name": "HarfangLab", "message": "[API] HTTP GET Request to endpoint", "attributes": {"url": "https://XXXXXXXXXX//api/data/threat_intelligence/SigmaRule"}}
{"timestamp": "2024-12-18T08:25:04.671117Z", "level": "ERROR", "name": "HarfangLab", "message": "'NoneType' object has no attribute 'name'", "exc_info": "Traceback (most recent call last):\n File "/opt/opencti-harfanglab-incidents/harfanglab_incidents_connector/connector.py", line 296, in process_message\n stix_bundle = self.create_stix_bundle()\n ^^^^^^^^^^^^^^^^^^^^^^^^^\n File "/opt/opencti-harfanglab-incidents/harfanglab_incidents_connector/connector.py", line 267, in create_stix_bundle\n stix_objects = self._collect_incident_intelligence()\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n File "/opt/opencti-harfanglab-incidents/harfanglab_incidents_connector/connector.py", line 170, in _collect_incident_intelligence\n stix_observables = self.converter_to_stix.create_observables(\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n File "/opt/opencti-harfanglab-incidents/harfanglab_incidents_connector/converter_to_stix.py", line 343, in create_observables\n observable = self._create_file(alert.process)\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n File "/opt/opencti-harfanglab-incidents/harfanglab_incidents_connector/converter_to_stix.py", line 67, in _create_file\n name=process.name,\n ^^^^^^^^^^^^\nAttributeError: 'NoneType' object has no attribute 'name'"}
{"timestamp": "2024-12-18T08:25:04.672808Z", "level": "INFO", "name": "HarfangLab", "message": "[INFO] Schedule next run of connector: ", "attributes": {"next_run_datetime": "2024-12-18T08:26:04Z"}}

Environment

  1. OS (where OpenCTI server runs): redhat 9.4, with podman
  2. OpenCTI version: 6.4.4
  3. Other environment details:

My dockerconfiguration is :

harfanglab-incidents:
image: opencti/connector-harfanglab-incidents:rolling
environment:

  • OPENCTI_URL=http://opencti:8080/
  • OPENCTI_TOKEN=${OPENCTI_CONNECTOR_TOKEN}
  • CONNECTOR_ID=${CONNECTOR_HARFANGLAB_ID}
  • CONNECTOR_TYPE=EXTERNAL_IMPORT
  • CONNECTOR_NAME=HarfangLab
  • CONNECTOR_SCOPE=harfanglab
  • CONNECTOR_LOG_LEVEL=debug
  • CONNECTOR_DURATION_PERIOD=PT1M
  • HARFANGLAB_INCIDENTS_URL=https://xxxxxx/
  • HARFANGLAB_INCIDENTS_SSL_VERIFY=true
  • HARFANGLAB_INCIDENTS_TOKEN=${TOKEN_HARGFANLAB}
  • HARFANGLAB_INCIDENTS_IMPORT_THREATS=false
  • HARFANGLAB_INCIDENTS_ALERT_STATUSES=new,investigating,closed
  • HARFANGLAB_INCIDENTS_ALERT_TYPES=yara,sigma,ioc
  • HARFANGLAB_INCIDENTS_DEFAULT_MARKING=TLP:AMBER
  • HARFANGLAB_INCIDENTS_DEFAULT_SCORE=50
  • HARFANGLAB_INCIDENTS_IMPORT_START_DATE=2024-01-01
  • HTTP_PROXY=${PROXY}
  • HTTPS_PROXY=${PROXY}
  • NO_PROXY=${NO_PROXY}
    restart: always
    depends_on:
  • opencti
@breizh33 breizh33 added bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team labels Dec 18, 2024
@breizh33 breizh33 changed the title [HARRFANGLAB-INCIDENTS] AttributeError: 'NoneType' object has no attribute 'name' [HARFANGLAB-INCIDENTS] AttributeError: 'NoneType' object has no attribute 'name' Dec 18, 2024
@romain-filigran romain-filigran added filigran support [optional] use to identify an issue related to feature developed & maintained by Filigran. and removed needs triage use to identify issue needing triage from Filigran Product team labels Dec 18, 2024
@flavienSindou flavienSindou self-assigned this Dec 24, 2024
@flavienSindou flavienSindou added the solved use to identify issue that has been solved (must be linked to the solving PR) label Dec 24, 2024
@flavienSindou flavienSindou added this to the Release 6.4.6 milestone Dec 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug use for describing something not working as expected filigran support [optional] use to identify an issue related to feature developed & maintained by Filigran. solved use to identify issue that has been solved (must be linked to the solving PR)
Projects
None yet
3 participants