Giters

ninoseki / mihari

A query aggregator for OSINT based threat hunting

Home Page:https://ninoseki.github.io/mihari/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

[BUG] - alert.rule_id issues after upgrade from 4.9.0 to 5.2.3

Canon5616 opened this issue · comments

commented

Describe the bug

After upgrade from 4.9.0 to 5.2.3 via (sudo gem upgrade mihari) I've ran the following:

mihari rule init (no errors)
mihari rule validate /path/to/search (no errors)
mihari web (error below)
mihari search /path/to/file (error below)

When i run mihari web i get the following error:
127.0.0.1 - - [31/May/2023:15:53:48 +0100] "GET / HTTP/1.1" 200 714 0.3043
127.0.0.1 - - [31/May/2023:15:53:48 +0100] "GET /assets/index-eed1bcd8.css HTTP/1.1" 304 - 0.0047
127.0.0.1 - - [31/May/2023:15:53:48 +0100] "GET /assets/index-cbe1734c.js HTTP/1.1" 304 - 0.0064
127.0.0.1 - - [31/May/2023:15:53:49 +0100] "GET /assets/fa-solid-900-7152a693.woff2 HTTP/1.1" 200 150124 0.0372
[ERROR glean_core] Error setting metrics feature config: Json(Error("EOF while parsing a value", line: 1, column: 0))
127.0.0.1 - - [31/May/2023:15:53:50 +0100] "GET /api/tags HTTP/1.1" 200 - 0.5862
127.0.0.1 - - [31/May/2023:15:53:50 +0100] "GET /api/rules/ids HTTP/1.1" 200 - 0.6262
caught error of type NoMethodError in after callback inside Grape::Middleware::Formatter : Mihari::Entities::Alert missing attribute rule_id' on #<Mihari::Alert:0x00005653637dc0f0> 2023-05-31 15:53:50.851249 E [7550:puma srv tp 003 error_notification.rb:12] Mihari -- Exception: NoMethodError: Mihari::Entities::Alert missing attribute rule_id' on #Mihari::Alert:0x00005653637dc0f0
/var/lib/gems/2.7.0/gems/grape-entity-1.0.0/lib/grape_entity/exposure/base.rb:61:in valid?' /var/lib/gems/2.7.0/gems/grape-entity-1.0.0/lib/grape_entity/exposure/base.rb:89:in valid_value'

When i run mihari search i get the error:
2023-05-31 15:59:41.489964 E [8109:7460 error_notification.rb:12] Mihari -- Exception: ActiveRecord::StatementInvalid: SQLite3::SQLException: no such column: alert.rule_id

and on the mihari web interface i have a status code 500 error
"AxiosError:Request failed with status code 500"

Steps to reproduce

  • see above

Expected behavior

Expected web interface to populate with existing rules and expected when searching via the terminal that the search would complete as it did previously

Actual behavior

everything ran but with the errors above and no results

Screenshots

Add screenshots to help explain your problem.

image

  • OS: [Ubuntu 20.04.6]
  • Ruby version: [2.7.0]
  • Mihari version: [5.2.3]

Additional context

please help, as a last resort i ran mihari db migrate but the same errors applied. I need to have this back up and running asap and im completely lost as to whats going wrong.
Any help is greatly appreciated

commented

https://github.com/ninoseki/mihari/releases/tag/v5.0.0
Unfortunately, Mihari does not provide automated DB migration for v4 to v5 upgrade. Please read the above changelog for details.

commented

For anyone else with this issue, to fix my issue, i had to:

  • manually delete mihari.db.
  • Reboot of the server
  • Ran mihari search /path/to/rule (returned an error to migrate the db)
  • Ran mihari db migrate
  • Errors gone
commented

Thanks for the follow up and sorry for the inconvenience.