maybe that is the reason why...
Traceback (most recent call last): File "/usr/local/lib/python3.6/dist-packages/ipwhois/net.py", line 589, in get_whois conn.connect((server, port))ConnectionRefusedError: [Errno 111] Connection refusedDuring handling of the above exception, another exception occurred:Traceback (most recent call last): File "/usr/local/lib/python3.6/dist-packages/ipwhois/net.py", line 589, in get_whois conn.connect((server, port))ConnectionRefusedError: [Errno 111] Connection refusedDuring handling of the above exception, another exception occurred:Traceback (most recent call last): File "/usr/local/lib/python3.6/dist-packages/ipwhois/net.py", line 589, in get_whois conn.connect((server, port))ConnectionRefusedError: [Errno 111] Connection refusedDuring handling of the above exception, another exception occurred:Traceback (most recent call last): File "/usr/local/lib/python3.6/dist-packages/ipwhois/net.py", line 589, in get_whois conn.connect((server, port))ConnectionRefusedError: [Errno 111] Connection refusedDuring handling of the above exception, another exception occurred:Traceback (most recent call last): File "/opt/Cortex-Analyzers/analyzers/Abuse_Finder/abusefinder.py", line 48, in <module> AbuseFinderAnalyzer().run() File "/opt/Cortex-Analyzers/analyzers/Abuse_Finder/abusefinder.py", line 44, in run self.report({'abuse_finder': self.abuse()}) File "/opt/Cortex-Analyzers/analyzers/Abuse_Finder/abusefinder.py", line 31, in abuse return ip_abuse(self.get_data()) File "/usr/local/lib/python3.6/dist-packages/abuse_finder/ip.py", line 44, in ip_abuse results = obj.lookup_whois(inc_raw=True) File "/usr/local/lib/python3.6/dist-packages/ipwhois/ipwhois.py", line 179, in lookup_whois field_list=field_list File "/usr/local/lib/python3.6/dist-packages/ipwhois/whois.py", line 678, in lookup extra_blacklist=extra_blacklist File "/usr/local/lib/python3.6/dist-packages/ipwhois/net.py", line 649, in get_whois server=server, port=port, extra_blacklist=extra_blacklist File "/usr/local/lib/python3.6/dist-packages/ipwhois/net.py", line 649, in get_whois server=server, port=port, extra_blacklist=extra_blacklist File "/usr/local/lib/python3.6/dist-packages/ipwhois/net.py", line 649, in get_whois server=server, port=port, extra_blacklist=extra_blacklist File "/usr/local/lib/python3.6/dist-packages/ipwhois/net.py", line 655, in get_whois 'WHOIS lookup failed for {0}.'.format(self.address_str)ipwhois.exceptions.WhoisLookupError: WHOIS lookup failed for 8.8.8.8.
So my new Cortex Analyzer for CAPE Sandbox is returning a sample artifact "artifacts": [
{
"data": "127.0.0.1",
"dataType": "ip",
"message": null,
"tags": [],
"tlp": 2
} If I start the Analyzer from TheHive my current understanding is, that there should be a new observable attached to the case with this IP once the analyzer is returned. Am I wrong?
{
"data": "127.0.0.1",
"dataType": "ip",
"message": null,
"tags": [],
"tlp": 2
} If I start the Analyzer from TheHive my current understanding is, that there should be a new observable attached to the case with this IP once the analyzer is returned. Am I wrong?
this should help
Johannes yes, we do. why?
im trying this:
version: "3.4"
services:
cassandra:
image: cassandra:3.11.6
environment:
- CASSANDRA_CLUSTER_NAME=thp
- JVM_EXTRA_OPTS=-Dcassandra.config=file:///tmp/cassandra.yaml
volumes:
- ./config/cassandra.yaml:/tmp/cassandra.yaml
ports:
- 0.0.0.0:9042:9042
container_name: cassandra
# cortex:
# image: thehiveproject/cortex:latest
# ports:
# - "0.0.0.0:9001:9001"
thehive:
image: thehiveproject/thehive:3.4.0
volumes:
- ./config/hive.conf:/etc/thehive/application.conf
depends_on:
- cassandra
# - cortex
ports:
- "0.0.0.0:9000:9000"
container_name: thehive
command: ["--no-config-es"]
just getting error : No configuration setting found for key 'search.uri'
hive config :
db {
provider: janusgraph
janusgraph {
storage {
backend: cql
hostname: [
"cassandra"
] # seed node ip addresses
#username: "<cassandra_username>" # login to connect to database (if configured in Cassandra)
#password: "<cassandra_passowrd"
cql {
cluster-name: thp # cluster name
keyspace: thehive # name of the keyspace
local-datacenter: datacenter1 # name of the datacenter where TheHive runs (relevant only on multi datacenter setup)
# replication-factor: 2 # number of replica
read-consistency-level: ONE
write-consistency-level: ONE
}
}
}
}
storage {
provider = localfs
localfs.location = /opt/files/thehive
}
all technologies used are there: https://github.com/TheHive-Project/TheHive#architecture
FROM thehiveproject/cortex:latest
USER root
RUN pip3 install elasticsearch
USER daemon
Hi, I'm in the process of setting up The Hive and Cortex. Our Elasticsearch cluster is already built and is separate from the Console applications. To save on resources (and cost) does anyone know if there would be any negatives to installing both TheHive and Cortex consoles on the same host or is it a better idea to have then separated?
@Xeteskian having both hosted under the same machine imply a risk that you can consider to take or not: cortex is designed to communicate with internet (via analyzers). Having your company security cases/incidents stored on a machine that communicate with internet is by design something not recommended
also.. why is the time picker/date format not ISO..