CrowdStrike / MISP-tools

Import CrowdStrike Threat Intelligence into your instance of MISP
MIT License
37 stars 10 forks source link

Error when importing reports #134

Closed samitainio closed 7 months ago

samitainio commented 1 year ago

Based on: d19f41db5653e546b8173c22988bdcdcfce086fb

Command run: python3 misp_import.py --reports

Error log:

Traceback (most recent call last):
  File "misp_import.py", line 407, in <module>
    main()
  File "misp_import.py", line 388, in main
    int(settings["CrowdStrike"]["init_actors_days_before"])
  File "/opt/MISP-tools/cs_misp_import/importer.py", line 319, in import_from_crowdstrike
    self.reports_importer.process_reports(reports_days_before, self.event_ids)
  File "/opt/MISP-tools/cs_misp_import/reports.py", line 324, in process_reports
    reported.update(fut.result())
  File "/usr/lib/python3.6/concurrent/futures/_base.py", line 425, in result
    return self.__get_result()
  File "/usr/lib/python3.6/concurrent/futures/_base.py", line 384, in __get_result
    raise self._exception
  File "/usr/lib/python3.6/concurrent/futures/thread.py", line 56, in run
    result = self.fn(*self.args, **self.kwargs)
  File "/opt/MISP-tools/cs_misp_import/reports.py", line 159, in batch_import_reports
    event: MISPEvent = self.create_event_from_report(report, rpt_detail, ind_list)
  File "/opt/MISP-tools/cs_misp_import/reports.py", line 601, in create_event_from_report
    event = self.add_indicator_detail(event, report_id, indicator_list)
  File "/opt/MISP-tools/cs_misp_import/reports.py", line 415, in add_indicator_detail
    galaxies.append(cluster[0]["GalaxyCluster"]["tag_name"])
KeyError: 0