CrowdStrike / MISP-tools

Import CrowdStrike Threat Intelligence into your instance of MISP
MIT License
42 stars 10 forks source link

MISP Tools Manual Import issues with MISP 2.5.2 #188

Open adpaccent opened 2 days ago

adpaccent commented 2 days ago

Hi,

it looks MISP Tools Manual import does not support the latest version of MISP 2.5.2.

[2024-11-25 15:50:51,606] INFO misp_tools [2024-11-25 15:50:51,606] INFO misp_tools '##::::'##:'####::'######::'########:::::'########::'#######:::'#######::'##::::::::'######:: [2024-11-25 15:50:51,606] INFO misp_tools ###::'###:. ##::'##... ##: ##.... ##::::... ##..::'##.... ##:'##.... ##: ##:::::::'##... ##: [2024-11-25 15:50:51,606] INFO misp_tools ####'####:: ##:: ##:::..:: ##:::: ##::::::: ##:::: ##:::: ##: ##:::: ##: ##::::::: ##:::..:: [2024-11-25 15:50:51,606] INFO misp_tools ## ### ##:: ##::. ######:: ########:::::::: ##:::: ##:::: ##: ##:::: ##: ##:::::::. ######:: [2024-11-25 15:50:51,606] INFO misp_tools ##. #: ##:: ##:::..... ##: ##.....::::::::: ##:::: ##:::: ##: ##:::: ##: ##::::::::..... ##: [2024-11-25 15:50:51,606] INFO misp_tools ##:.:: ##:: ##::'##::: ##: ##:::::::::::::: ##:::: ##:::: ##: ##:::: ##: ##:::::::'##::: ##: [2024-11-25 15:50:51,606] INFO misp_tools ##:::: ##:'####:. ######:: ##:::::::::::::: ##::::. #######::. #######:: ########:. ######:: [2024-11-25 15:50:51,607] INFO misp_tools ..:::::..::....:::......:::..:::::::::::::::..::::::.......::::.......:::........:::......::: [2024-11-25 15:50:51,607] INFO misptools ____ [2024-11-25 15:50:51,607] INFO misp_tools / ' [2024-11-25 15:50:51,607] INFO misp_tools ,-/-, [2024-11-25 15:50:51,607] INFO misptools (/ ()/ ( [2024-11-25 15:50:51,607] INFO misp_tools _ _ [2024-11-25 15:50:51,607] INFO misptools | .----.-----.--.--.--.--| | | |.----|| |--.-----. [2024-11-25 15:50:51,607] INFO misp_tools |. 1| | | | | | | 1| | _| | <| -| [2024-11-25 15:50:51,607] INFO misptools |. ||_| ||____|| ||| ||||| [2024-11-25 15:50:51,607] INFO misp_tools |: 1 | |: 1 | [2024-11-25 15:50:51,607] INFO misp_tools |::.. . | |::.. . | Threat Intelligence v0.8.0 [2024-11-25 15:50:51,607] INFO misp_tools -------'-------' [2024-11-25 15:50:51,607] INFO misp_tools /misp/.local/lib/python3.11/site-packages/pymisp/init.py:67: FutureWarning: This class is deprecated, use PyMISP instead warnings.warn('This class is deprecated, use PyMISP instead', FutureWarning) [2024-11-25 15:50:52,633] INFO processor/main Retrieving all galaxy cluster values for the Android cluster. Traceback (most recent call last): File "", line 198, in _run_module_as_main File "", line 88, in _run_code File "/misp/misp_import.py", line 505, in main() File "/misp/misp_import.py", line 495, in main import_handler = ImportHandler(config, intel_api_client, ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/misp/misp_import.py", line 312, in init self.importer = CrowdstrikeToMISPImporter( ^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/misp/cs_misp_import/importer.py", line 76, in init self.all_galaxies = self.get_galaxies() ^^^^^^^^^^^^^^^^^^^ File "/misp/cs_misp_import/importer.py", line 270, in get_galaxies all_galaxies.append(self.misp_client.search_galaxy_clusters(gal["id"], searchall="")) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/misp/.local/lib/python3.11/site-packages/pymisp/api.py", line 1781, in search_galaxy_clusters clusters_j = self._check_json_response(r) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/misp/.local/lib/python3.11/site-packages/pymisp/api.py", line 3970, in _check_json_response r = self._check_response(response, expect_json=True) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/misp/cs_misp_import/misp_safe_check_response.py", line 55, in safe_check_response raise MISPServerError(fail_msg) pymisp.exceptions.MISPServerError: Error code 500: An Internal Error Has Occurred. [2024-11-25 15:50:51,607] INFO config [2024-11-25 15:50:51,607] INFO config _ ____ _ __ [2024-11-25 15:50:51,607] INFO config | || |__ | |/ | | | | \ | |__ | | ____ [2024-11-25 15:50:51,607] INFO config | | | |__ | | _ |____ |_| | _| | | |_| [2024-11-25 15:50:51,607] INFO config [2024-11-25 15:50:52,015] INFO config No configuration errors found [2024-11-25 15:50:52,015] INFO config [2024-11-25 15:50:52,015] INFO config __ ___ _ [2024-11-25 15:50:52,015] INFO config | |_| | | |/ [ |] || [ [ | | \ [2024-11-25 15:50:52,015] INFO config | | | | | | \ __] | | | ] ] | |__/ [2024-11-25 15:50:52,015] INFO config

Instead no any issues with MISP 2.5.1. Could you please help me?

Please let me know.

Thanks