Giters

TheHive-Project / Cortex

Cortex: a Powerful Observable Analysis and Active Response Engine

Home Page:https://thehive-project.org

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

No responders available to enable in Cortex 3.1.7-1 Web UI

Paul-Dutot opened this issue · comments

commented

Request Type

Bug Fix - code change in org.thp.cortex.services.WorkerSrv

Work Environment

Question Answer
OS version (server) Ubuntu 20.04 LTS
OS version (client) MSEdge web browser
Cortex version / git hash 3.1.7-1
Package Type From source
Browser type & version Version 107.0.1418.56 (Official build) (64-bit)

Problem Description

There are no available responers to be enabled in the web-ui even though they are all installed in directory - /opt/Cortex-Analyzers/responders

Steps to Reproduce

1.Install Ubuntu 20.04 LTS
2. Install Cortex via provided installation script via below

wget -q -O /tmp/install.sh https://archives.strangebee.com/scripts/install.sh ; sudo -v ; bash /tmp/install.sh

Possible Solutions

On investigating the logs in /var/log/cortex/application.log i noticed the following entry

image

2022-11-28 14:35:40,025 [WARN] from org.thp.cortex.services.WorkerSrv in application-akka.actor.default-dispatcher-7 - **Worker path (/opt/Cortex-Analzers/responders) is not found**
java.net.MalformedURLException: no protocol: /opt/Cortex-Analzers/responders
        at java.base/java.net.URL.<init>(URL.java:674)
        at java.base/java.net.URL.<init>(URL.java:569)
        at java.base/java.net.URL.<init>(URL.java:516)
        at org.thp.cortex.services.WorkerSrv.$anonfun$scan$21(WorkerSrv.scala:200)
        at scala.concurrent.Future$.$anonfun$apply$1(Future.scala:659)
        at scala.util.Success.$anonfun$map$1(Try.scala:255)
        at scala.util.Success.map(Try.scala:213)
        at scala.concurrent.Future.$anonfun$map$1(Future.scala:292)
        at scala.concurrent.impl.Promise.liftedTree1$1(Promise.scala:33)
        at scala.concurrent.impl.Promise.$anonfun$transform$1(Promise.scala:33)
        at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:64)
        at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:63)
        at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:100)
        at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:23)
        at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:85)
        at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:100)
        at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:49)
        at akka.dispatch.ForkJoinExecutorConfigurator$AkkaForkJoinTask.exec(ForkJoinExecutorConfigurator.scala:48)
        at java.base/java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:373)
        at java.base/java.util.concurrent.ForkJoinPool$WorkQueue.topLevelExec(ForkJoinPool.java:1182)
        at java.base/java.util.concurrent.ForkJoinPool.scan(ForkJoinPool.java:1655)
        at java.base/java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1622)
        at java.base/java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:165)

It appears that there is a typo in the code in org.thp.cortex.services.WorkerSrv--akka.actor.default-dispatcher-7.

To confirm, this I did the following

  1. Create the directory /opt/Cortex-Analzers/responders.
  2. Change the owner to cortex:cortex recursively.
  3. Change to /opt/Cortex-Analzers/responders/ directory
  4. Link the /opt/Cortex-Analzers/responders to the correct directory of /opt/Cortex-Analyzers/responders/
sudo ln -s /opt/Cortex-Analyzers/responders/ .

image

Complementary information

Responders are now available to be enabled
image