search

CrowdStrike / MISP-tools

Import CrowdStrike Threat Intelligence into your instance of MISP
MIT License
41 stars 10 forks source link

kao.add_tag(f"CrowdStrike:adversary:branch: {actor_branch}") AttributeError: 'NoneType' object has no attribute 'add_tag' #110

Closed packet-rat closed 1 year ago

packet-rat commented 1 year ago 
python3 misp_import.py -f -nb -d --fullmonty
[2023-03-31 19:23:50,002] INFO     misp_tools    MISP Import for CrowdStrike Threat Intelligence v0.6.8
[2023-03-31 19:23:50,002] INFO     config  CHECK CONFIG
[2023-03-31 19:23:50,003] DEBUG    config  client_id                                   value redacted, check config file
[2023-03-31 19:23:50,003] DEBUG    config  client_secret                               value redacted, check config file
[2023-03-31 19:23:50,003] DEBUG    config  crowdstrike_url                             US1
[2023-03-31 19:23:50,003] DEBUG    config  api_request_max                             5000
[2023-03-31 19:23:50,003] DEBUG    config  api_enable_ssl                              True
[2023-03-31 19:23:50,003] DEBUG    config  reports_timestamp_filename                  lastReportsUpdate.dat
[2023-03-31 19:23:50,003] DEBUG    config  indicators_timestamp_filename               lastIndicatorsUpdate.dat
[2023-03-31 19:23:50,003] DEBUG    config  actors_timestamp_filename                   lastActorsUpdate.dat
[2023-03-31 19:23:50,003] DEBUG    config  init_reports_days_before                    365
[2023-03-31 19:23:50,003] DEBUG    config  init_indicators_minutes_before              20220
[2023-03-31 19:23:50,003] DEBUG    config  init_actors_days_before                     730
[2023-03-31 19:23:50,003] DEBUG    config  reports_unique_tag                          CrowdStrike: REPORT
[2023-03-31 19:23:50,004] DEBUG    config  indicators_unique_tag                       CrowdStrike: INDICATOR
[2023-03-31 19:23:50,004] DEBUG    config  actors_unique_tag                           CrowdStrike: ADVERSARY
[2023-03-31 19:23:50,004] DEBUG    config  reports_tags                                att:source="Crowdstrike.Report"
[2023-03-31 19:23:50,004] DEBUG    config  indicators_tags                             att:source="Crowdstrike.Indicators"
[2023-03-31 19:23:50,004] DEBUG    config  actors_tags                                 att:source="Crowdstrike.Actors"
[2023-03-31 19:23:50,004] DEBUG    config  unknown_mapping                             CrowdStrike:indicator:galaxy: UNATTRIBUTED
[2023-03-31 19:23:50,004] DEBUG    config  unattributed_title                          Unattributed indicators:
[2023-03-31 19:23:50,004] DEBUG    config  indicator_type_title                        Indicator Type:
[2023-03-31 19:23:50,004] DEBUG    config  malware_family_title                        Malware Family:
[2023-03-31 19:23:50,004] DEBUG    config  log_duplicates_as_sightings                 True
[2023-03-31 19:23:50,004] DEBUG    config  misp_url                                    https://3samisp
[2023-03-31 19:23:50,004] DEBUG    config  misp_auth_key                               value redacted, check config file
[2023-03-31 19:23:50,004] DEBUG    config  crowdstrike_org_uuid                        ca4f4b5d-db04-4a5e-a6de-e60636dc01be
[2023-03-31 19:23:50,004] DEBUG    config  misp_enable_ssl                             False
[2023-03-31 19:23:50,004] WARNING  config  misp_enable_ssl                             SSL is disabled for MISP API requests
[2023-03-31 19:23:50,004] DEBUG    config  ind_attribute_batch_size                    2500
[2023-03-31 19:23:50,004] DEBUG    config  event_save_memory_refresh_interval          180
[2023-03-31 19:23:50,004] DEBUG    config  max_threads                                 16
[2023-03-31 19:23:50,004] DEBUG    config  miss_track_file                             no_galaxy_mapping.log
[2023-03-31 19:23:50,004] DEBUG    config  galaxies_map_file                           galaxy.ini
[2023-03-31 19:23:50,004] DEBUG    config  tag_unknown_galaxy_maps                     True
[2023-03-31 19:23:50,004] DEBUG    config  taxonomic_kill-chain                        True
[2023-03-31 19:23:50,004] DEBUG    config  taxonomic_information-security-data-source  True
[2023-03-31 19:23:50,004] DEBUG    config  taxonomic_type                              True
[2023-03-31 19:23:50,004] DEBUG    config  taxonomic_iep                               False
[2023-03-31 19:23:50,004] DEBUG    config  taxonomic_iep2                              True
[2023-03-31 19:23:50,004] DEBUG    config  taxonomic_iep2_version                      False
[2023-03-31 19:23:50,004] DEBUG    config  taxonomic_tlp                               True
[2023-03-31 19:23:50,004] DEBUG    config  taxonomic_workflow                          True
[2023-03-31 19:23:50,892] INFO     config  No configuration errors found (1 warning)
[2023-03-31 19:23:50,892] INFO     config  
[2023-03-31 19:23:50,892] INFO     config  ____ _  _ ____ ____ _  _ ____    ___  ____ ____ ____ ____ ___
[2023-03-31 19:23:50,892] INFO     config  |    |__| |___ |    |_/  [__     |__] |__| [__  [__  |___ |  \
[2023-03-31 19:23:50,892] INFO     config  |___ |  | |___ |___ | \_ ___]    |    |  | ___] ___] |___ |__/
[2023-03-31 19:23:50,892] INFO     config  
[2023-03-31 19:23:52,593] INFO     processor/main       BEGIN ADVERSARIES IMPORT
[2023-03-31 19:23:52,593] INFO     processor/main       Start importing CrowdStrike Adversaries as events into MISP (past 730 days).
[2023-03-31 19:23:52,593] INFO     processor/main       Retrieving all adversaries.
[2023-03-31 19:23:53,656] INFO     processor/main       Got 54 adversaries from the Crowdstrike Intel API.
[2023-03-31 19:23:55,700] WARNING  processor/thread_0   Adversary OCTANE PANDA missing field first_activity_date.
[2023-03-31 19:23:55,723] DEBUG    processor/thread_3   Created adversary event for SHATTERED PANDA
[2023-03-31 19:23:55,737] DEBUG    processor/thread_4   Created adversary event for CYBORG SPIDER
[2023-03-31 19:23:55,739] DEBUG    processor/thread_5   Created adversary event for ALCHEMIST SPIDER
[2023-03-31 19:23:55,744] DEBUG    processor/thread_14  Created adversary event for CHRONO KITTEN
[2023-03-31 19:23:55,746] DEBUG    processor/thread_1   Created adversary event for FERAL SPIDER
[2023-03-31 19:23:55,747] DEBUG    processor/thread_8   Created adversary event for HIDDEN SPIDER
[2023-03-31 19:23:55,750] DEBUG    processor/thread_2   Created adversary event for SPECTRAL KITTEN
[2023-03-31 19:23:55,755] DEBUG    processor/thread_6   Created adversary event for COMPASS SPIDER
[2023-03-31 19:23:55,759] DEBUG    processor/thread_13  Created adversary event for SHINING SPIDER
[2023-03-31 19:23:55,763] DEBUG    processor/thread_0   Created adversary event for OCTANE PANDA
[2023-03-31 19:23:55,766] DEBUG    processor/thread_12  Created adversary event for SAMBA SPIDER
[2023-03-31 19:23:55,767] DEBUG    processor/thread_11  Created adversary event for HOLIDAY SPIDER
[2023-03-31 19:23:55,770] DEBUG    processor/thread_15  Created adversary event for HAYWIRE KITTEN
[2023-03-31 19:23:55,774] DEBUG    processor/thread_7   Created adversary event for OUTBREAK SPIDER
[2023-03-31 19:23:55,778] DEBUG    processor/thread_10  Created adversary event for SCATTERED SPIDER
[2023-03-31 19:23:55,786] DEBUG    processor/thread_9   Created adversary event for SLIPPY SPIDER
[2023-03-31 19:24:05,780] DEBUG    processor/thread_8   Created adversary event for COSMIC WOLF
[2023-03-31 19:24:07,406] DEBUG    processor/thread_10  Created adversary event for PARTISAN JACKAL
[2023-03-31 19:24:08,225] DEBUG    processor/thread_11  Created adversary event for LILY SPIDER
[2023-03-31 19:24:10,716] DEBUG    processor/thread_5   Created adversary event for VAPOR PANDA
[2023-03-31 19:24:10,726] DEBUG    processor/thread_12  Created adversary event for EMBER BEAR
[2023-03-31 19:24:10,827] DEBUG    processor/thread_9   Created adversary event for CHARIOT SPIDER
[2023-03-31 19:24:11,191] DEBUG    processor/thread_1   Created adversary event for HERMIT SPIDER
[2023-03-31 19:24:12,685] DEBUG    processor/thread_7   Created adversary event for WANDERING SPIDER
[2023-03-31 19:24:13,421] DEBUG    processor/thread_3   Created adversary event for VICE SPIDER
[2023-03-31 19:24:14,792] DEBUG    processor/thread_11  Created adversary event for ALPHA SPIDER
[2023-03-31 19:24:14,959] DEBUG    processor/thread_13  Created adversary event for RECESS SPIDER
[2023-03-31 19:24:16,752] DEBUG    processor/thread_15  Created adversary event for HIVE SPIDER
[2023-03-31 19:24:17,838] DEBUG    processor/thread_9   Created adversary event for DEADEYE HAWK
[2023-03-31 19:24:18,191] DEBUG    processor/thread_1   Created adversary event for GALACTIC OCELOT
[2023-03-31 19:24:20,358] DEBUG    processor/thread_6   Created adversary event for VERTIGO PANDA
[2023-03-31 19:24:21,323] DEBUG    processor/thread_0   Created adversary event for BLIND SPIDER
[2023-03-31 19:24:25,341] DEBUG    processor/thread_14  Created adversary event for JACKPOT PANDA
[2023-03-31 19:24:26,614] WARNING  pymisp/thread_10     The value of the attribute you're trying to add is an empty string, skipping it. Object relation: alias
[2023-03-31 19:24:26,617] DEBUG    processor/thread_10  Created adversary event for CHAOTIC SPIDER
[2023-03-31 19:24:27,480] DEBUG    processor/thread_2   Created adversary event for AQUATIC PANDA
[2023-03-31 19:24:27,694] DEBUG    processor/thread_3   Created adversary event for BRAIN SPIDER
[2023-03-31 19:24:27,751] DEBUG    processor/thread_7   Created adversary event for AVIATOR SPIDER
[2023-03-31 19:24:27,761] DEBUG    processor/thread_0   Created adversary event for FRINGE LEOPARD
[2023-03-31 19:24:27,781] DEBUG    processor/thread_4   Created adversary event for HAZY TIGER
[2023-03-31 19:24:27,828] DEBUG    processor/thread_13  Created adversary event for MIRAGE TIGER
[2023-03-31 19:24:27,851] DEBUG    processor/thread_15  Created adversary event for VETO SPIDER
[2023-03-31 19:24:27,879] WARNING  processor/thread_11  Adversary DEMON SPIDER missing field first_activity_date.
[2023-03-31 19:24:27,880] WARNING  processor/thread_11  Adversary DEMON SPIDER missing field last_activity_date.
[2023-03-31 19:24:27,880] DEBUG    processor/thread_11  Created adversary event for DEMON SPIDER
[2023-03-31 19:24:28,016] DEBUG    processor/thread_10  Created adversary event for BANISHED KITTEN
[2023-03-31 19:24:28,212] WARNING  processor/thread_11  Could not add or tag event ADV-203346 DEMON SPIDER (eCrime). Will retry in 0.3 seconds.
day is out of range for month: 0
[2023-03-31 19:24:28,331] DEBUG    processor/thread_7   Created adversary event for ROYAL SPIDER
[2023-03-31 19:24:28,384] DEBUG    processor/thread_5   Created adversary event for BITWISE SPIDER
[2023-03-31 19:24:28,633] DEBUG    processor/thread_3   Created adversary event for GOSSAMER BEAR
[2023-03-31 19:24:28,642] DEBUG    processor/thread_11  Created adversary event for REGAL JACKAL
[2023-03-31 19:24:28,698] WARNING  processor/thread_6   Adversary INTREPID JACKAL missing field first_activity_date.
[2023-03-31 19:24:28,698] WARNING  processor/thread_6   Adversary INTREPID JACKAL missing field last_activity_date.
[2023-03-31 19:24:28,699] DEBUG    processor/thread_6   Created adversary event for INTREPID JACKAL
[2023-03-31 19:24:28,820] DEBUG    processor/thread_12  Created adversary event for OUTRIDER TIGER
[2023-03-31 19:24:28,853] WARNING  processor/thread_9   Adversary VAMPIRE SPIDER missing field last_activity_date.
[2023-03-31 19:24:28,854] WARNING  pymisp/thread_9      The value of the attribute you're trying to add is an empty string, skipping it. Object relation: alias
[2023-03-31 19:24:28,863] DEBUG    processor/thread_9   Created adversary event for NEMESIS KITTEN
[2023-03-31 19:24:28,910] DEBUG    processor/thread_15  Created adversary event for SUNRISE PANDA
[2023-03-31 19:24:29,023] DEBUG    processor/thread_14  Created adversary event for ETHEREAL PANDA
[2023-03-31 19:24:30,586] WARNING  processor/thread_6   Could not add or tag event ADV-137920 INTREPID JACKAL (Hacktivist). Will retry in 0.3 seconds.
day is out of range for month: 0
Traceback (most recent call last):
  File "misp_import.py", line 377, in <module>
    main()
  File "misp_import.py", line 356, in main
    importer.import_from_crowdstrike(int(settings["CrowdStrike"]["init_reports_days_before"]),
  File "/home/rx118r/src/crowdstrike/MISP-tools-main/cs_misp_import/importer.py", line 303, in import_from_crowdstrike
    self.actors_importer.process_actors(actors_days_before, self.event_ids)
  File "/home/rx118r/src/crowdstrike/MISP-tools-main/cs_misp_import/actors.py", line 153, in process_actors
    if fut.result():
  File "/opt/rh/rh-python38/root/usr/lib64/python3.8/concurrent/futures/_base.py", line 437, in result
    return self.__get_result()
  File "/opt/rh/rh-python38/root/usr/lib64/python3.8/concurrent/futures/_base.py", line 389, in __get_result
    raise self._exception
  File "/opt/rh/rh-python38/root/usr/lib64/python3.8/concurrent/futures/thread.py", line 57, in run
    result = self.fn(*self.args, **self.kwargs)
  File "/home/rx118r/src/crowdstrike/MISP-tools-main/cs_misp_import/actors.py", line 66, in batch_import_actors
    event: MISPEvent = self.create_event_from_actor(act, act_det)
  File "/home/rx118r/src/crowdstrike/MISP-tools-main/cs_misp_import/actors.py", line 372, in create_event_from_actor
    kao.add_tag(f"CrowdStrike:adversary:branch: {actor_branch}")
AttributeError: 'NoneType' object has no attribute 'add_tag'
jshcodes commented 1 year ago

Duplicates #111. Closing.