yampelo / beagle

Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Crash when 'File Of' edges are selected (Windows EVTX)

szym3n opened this issue · comments

I am experiencing an issue where if the 'file of' Edge Type is selected, and a 'File' is linked to a process node (in a Windows EVTX file), when I click on a 'timeline' or any of the edges do display their info, the GUI for beagle will kick me out onto a completely blank page, and my progress on the chart gets completely wiped:
image
image

The CLI which is running the docker run command is not showing any errors.

Can you open up the chrome developer console and copy paste the javascript error?

Is the tool intended to be used with Chrome?
I'm currently running it on Firefox .

Chrome JS Errors when clicking on an 'EDGE'

:8000/static/manifest.json:1 Failed to load resource: the server responded with a status of 404 (NOT FOUND)
:8000/static/manifest.json:1 Manifest: Line: 1, column: 1, Syntax error.
:8000/static/favicon.ico:1 Failed to load resource: the server responded with a status of 404 (NOT FOUND)
react-dom.production.min.js:4408 TypeError: Cannot convert undefined or null to object
at Function.keys ()
at EdgeInfoTable.tsx:24
at Array.map ()
at t.render (EdgeInfoTable.tsx:23)
at Do (react-dom.production.min.js:3785)
at Mo (react-dom.production.min.js:3776)
at Ao (react-dom.production.min.js:3960)
at Va (react-dom.production.min.js:5514)
at qa (react-dom.production.min.js:5536)
at Ds (react-dom.production.min.js:5958)
da @ react-dom.production.min.js:4408
react-dom.production.min.js:5940 Uncaught TypeError: Cannot convert undefined or null to object
at Function.keys ()
at EdgeInfoTable.tsx:24
at Array.map ()
at t.render (EdgeInfoTable.tsx:23)
at Do (react-dom.production.min.js:3785)
at Mo (react-dom.production.min.js:3776)
at Ao (react-dom.production.min.js:3960)
at Va (react-dom.production.min.js:5514)
at qa (react-dom.production.min.js:5536)
at Ds (react-dom.production.min.js:5958)

Chrome Error when going to 'timeline' after selecting the File Of Edge to be displayed

TypeError: Cannot use 'in' operator to search for 'timestamp' in null
at EventTimeline.tsx:29
at Array.filter ()
at EventTimeline.tsx:29
at Array.map ()
at t.getDerivedStateFromProps (EventTimeline.tsx:44)
at or (react-dom.production.min.js:2769)
at cr (react-dom.production.min.js:2852)
at Mo (react-dom.production.min.js:3759)
at Ao (react-dom.production.min.js:3960)
at Va (react-dom.production.min.js:5514)
da @ react-dom.production.min.js:4408
n.callback @ react-dom.production.min.js:4773
ra @ react-dom.production.min.js:4271
ia @ react-dom.production.min.js:4259
Wa @ react-dom.production.min.js:4999
Ya @ react-dom.production.min.js:5123
(anonymous) @ react-dom.production.min.js:5975
e.unstable_runWithPriority @ scheduler.production.min.js:274
Ps @ react-dom.production.min.js:5974
Ds @ react-dom.production.min.js:5958
Cs @ react-dom.production.min.js:5925
Rs @ react-dom.production.min.js:6020
En @ react-dom.production.min.js:1737
react-dom.production.min.js:5940 Uncaught TypeError: Cannot use 'in' operator to search for 'timestamp' in null
at EventTimeline.tsx:29
at Array.filter ()
at EventTimeline.tsx:29
at Array.map ()
at t.getDerivedStateFromProps (EventTimeline.tsx:44)
at or (react-dom.production.min.js:2769)
at cr (react-dom.production.min.js:2852)
at Mo (react-dom.production.min.js:3759)
at Ao (react-dom.production.min.js:3960)
at Va (react-dom.production.min.js:5514)
(anonymous) @ EventTimeline.tsx:29
(anonymous) @ EventTimeline.tsx:29
t.getDerivedStateFromProps @ EventTimeline.tsx:44
or @ react-dom.production.min.js:2769
cr @ react-dom.production.min.js:2852
Mo @ react-dom.production.min.js:3759
Ao @ react-dom.production.min.js:3960
Va @ react-dom.production.min.js:5514
qa @ react-dom.production.min.js:5536
Ds @ react-dom.production.min.js:5958
Cs @ react-dom.production.min.js:5925
Rs @ react-dom.production.min.js:6020
En @ react-dom.production.min.js:1737

Ok - looks like im trying to access an object that doesn't exist, ill push a fix after work today

When there's no underyling events the following table is now shown. Thanks for reporting the bug!

image

Fixed via #63, pull down the newest docker image in about 30 minutes

Hi @yampelo
It seems like hte issue was fixed when i Double click the edge node, however when I switch views from 'Graph' to Timeline or while I have the 'File of' selected, I still get redirected to a blank page and the following error occurs in chrome:

Failed to load resource: the server responded with a status of 404 (NOT FOUND)
3:8000/api/new:1 Failed to load resource: the server responded with a status of 500 (INTERNAL SERVER ERROR)
react-dom.production.min.js:4408 TypeError: Cannot use 'in' operator to search for 'timestamp' in null
at EventTimeline.tsx:29
at Array.filter ()
at EventTimeline.tsx:29
at Array.map ()
at t.getDerivedStateFromProps (EventTimeline.tsx:44)
at or (react-dom.production.min.js:2769)
at cr (react-dom.production.min.js:2852)
at Mo (react-dom.production.min.js:3759)
at Ao (react-dom.production.min.js:3960)
at Va (react-dom.production.min.js:5514)
da @ react-dom.production.min.js:4408
react-dom.production.min.js:5940 Uncaught TypeError: Cannot use 'in' operator to search for 'timestamp' in null
at EventTimeline.tsx:29
at Array.filter ()
at EventTimeline.tsx:29
at Array.map ()
at t.getDerivedStateFromProps (EventTimeline.tsx:44)
at or (react-dom.production.min.js:2769)
at cr (react-dom.production.min.js:2852)
at Mo (react-dom.production.min.js:3759)
at Ao (react-dom.production.min.js:3960)
at Va (react-dom.production.min.js:5514)