Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] With TheHive 4.0.1 thehive4py api.get_case_observables() fails #198

Closed
Passimist opened this issue Nov 16, 2020 · 2 comments
Closed
Assignees

Comments

@Passimist
Copy link

Work Environment

Question Answer
OS version (server) Ubuntu 18.04.5 LTS
OS version (client) Ubuntu 18.04.5 LTS
TheHive4py version / git hash thehive4py-1.7.2
TheHive Version TheHive 4.0.1

Problem Description

The get_case_observables method of the thehive4py API fails with: thehive4py.exceptions.CaseObservableException: Case observables search error: ("Connection broken: ConnectionResetError(104, 'Connection reset by peer')", ConnectionResetError(104, 'Connection reset by peer'))
The error logged in TheHive is below.
I used this method a lot on thehive 4.0.0-1 so I assume the bug was introduced with 4.0.1
I have no idea how the TheHive backend works but to me it seems like TheHive fails building a CaseObservable object to send as answer. Maybe because the new ignore for similarity attribute is not known to thehive4py?

Steps to Reproduce

  1. Create case in TheHive 4.0.1
  2. Crreate observable in that case
  3. python:
    from thehive4py.api import TheHiveApi
    api = TheHiveApi(endpoint, key)
    r = api.get_case_observables("caseId")

Complementary information

This is the log entry written when the issue occurrs:

2020-11-13 17:26:58,195 [ERROR] from akka.actor.ActorSystemImpl in application-akka.actor.default-dispatcher-19 [|] Response stream for [POST /api/case/artifact/_search] failed with 'org.thp.thehive.models.Case$
$anon$28$$anon$29 cannot be cast to org.thp.thehive.models.Observable'. Aborting connection.
java.lang.ClassCastException: org.thp.thehive.models.Case$$anon$28$$anon$29 cannot be cast to org.thp.thehive.models.Observable
at org.thp.thehive.services.ObservableOps$ObservableOpsDefs$anon$macro$3$1.to(ObservableSrv.scala:245)
at org.thp.thehive.services.ObservableOps$ObservableOpsDefs$anon$macro$3$1.to(ObservableSrv.scala:245)
at shapeless.ops.tuple$Prepend$$anon$1.apply(tuples.scala:69)
at shapeless.syntax.std.TupleOps.$colon$plus(tuples.scala:59)
at org.thp.scalligraph.traversal.ProjectionBuilder.$anonfun$by$2(ProjectionBuilder.scala:31)
at org.thp.scalligraph.traversal.ProjectionBuilder.$anonfun$by$4(ProjectionBuilder.scala:74)
at org.thp.scalligraph.traversal.ProjectionBuilder.$anonfun$by$4(ProjectionBuilder.scala:74)
at org.thp.scalligraph.traversal.ProjectionBuilder.$anonfun$by$4(ProjectionBuilder.scala:74)
at org.thp.scalligraph.traversal.ProjectionBuilder.$anonfun$by$4(ProjectionBuilder.scala:74)
at org.thp.scalligraph.traversal.ProjectionBuilder.$anonfun$by$4(ProjectionBuilder.scala:74)
at org.thp.scalligraph.traversal.ProjectionBuilder.$anonfun$by$4(ProjectionBuilder.scala:74)
at org.thp.scalligraph.traversal.ProjectionBuilder.org$thp$scalligraph$traversal$ProjectionBuilder$$$anonfun$converter$1(ProjectionBuilder.scala:79)
at org.thp.scalligraph.traversal.ProjectionBuilder$$anonfun$converter$2.apply(ProjectionBuilder.scala:79)
at org.thp.scalligraph.traversal.ProjectionBuilder$$anonfun$converter$2.apply(ProjectionBuilder.scala:79)
at scala.Function1.$anonfun$andThen$1(Function1.scala:57)
at org.thp.scalligraph.traversal.Traversal.org$thp$scalligraph$traversal$Traversal$$$anonfun$domainMap$1(Traversal.scala:44)
at org.thp.scalligraph.traversal.Traversal$$anonfun$domainMap$2.apply(Traversal.scala:44)
at scala.Function1.$anonfun$andThen$1(Function1.scala:57)
at org.thp.scalligraph.traversal.Traversal.org$thp$scalligraph$traversal$Traversal$$$anonfun$domainMap$1(Traversal.scala:44)
at org.thp.scalligraph.traversal.Traversal$$anonfun$domainMap$2.apply(Traversal.scala:44)
at scala.collection.Iterator$$anon$10.next(Iterator.scala:461)
at scala.collection.Iterator$$anon$10.next(Iterator.scala:461)
at akka.stream.impl.fusing.StatefulMapConcat$$anon$49.pushPull(Ops.scala:2181)
at akka.stream.impl.fusing.StatefulMapConcat$$anon$49.onPush(Ops.scala:2192)
at akka.stream.impl.fusing.GraphInterpreter.processPush(GraphInterpreter.scala:541)
at akka.stream.impl.fusing.GraphInterpreter.processEvent(GraphInterpreter.scala:527)
at akka.stream.impl.fusing.GraphInterpreter.execute(GraphInterpreter.scala:390)
at akka.stream.impl.fusing.GraphInterpreterShell.runBatch(ActorGraphInterpreter.scala:625)
at akka.stream.impl.fusing.GraphInterpreterShell.init(ActorGraphInterpreter.scala:595)
at akka.stream.impl.fusing.ActorGraphInterpreter.tryInit(ActorGraphInterpreter.scala:702)
at akka.stream.impl.fusing.ActorGraphInterpreter.finishShellRegistration(ActorGraphInterpreter.scala:745)
at akka.stream.impl.fusing.ActorGraphInterpreter.akka$stream$impl$fusing$ActorGraphInterpreter$$shortCircuitBatch(ActorGraphInterpreter.scala:760)
at akka.stream.impl.fusing.ActorGraphInterpreter$$anonfun$receive$1.applyOrElse(ActorGraphInterpreter.scala:785)
at akka.actor.Actor.aroundReceive(Actor.scala:537)
at akka.actor.Actor.aroundReceive$(Actor.scala:535)
at akka.stream.impl.fusing.ActorGraphInterpreter.aroundReceive(ActorGraphInterpreter.scala:691)
at akka.actor.ActorCell.receiveMessage(ActorCell.scala:577)
at akka.actor.ActorCell.invoke(ActorCell.scala:547)
at akka.dispatch.Mailbox.processMailbox(Mailbox.scala:270)
at akka.dispatch.Mailbox.run(Mailbox.scala:231)
at akka.dispatch.Mailbox.exec(Mailbox.scala:243)
at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289)
at java.util.concurrent.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1056)
at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1692)
at java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:157)

@Passimist
Copy link
Author

This is probably related to TheHive-Project/TheHive#1659

@nadouani
Copy link
Contributor

This is in fact related to a bug in TheHive 4.0.1 that will be fixed in 4.0.2.

@nadouani nadouani removed this from the 1.8.0 milestone Nov 18, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants