search

CrowdStrike / MISP-tools

Import CrowdStrike Threat Intelligence into your instance of MISP
MIT License
42 stars 10 forks source link

Data issue causes crash on related adversary during reports import (Missing null check) #98

Closed jshcodes closed 1 year ago

jshcodes commented 1 year ago 
Traceback (most recent call last):
  File "/usr/local/lib/python3.10/runpy.py", line 196, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "/usr/local/lib/python3.10/runpy.py", line 86, in _run_code
    exec(code, run_globals)
  File "/misp/misp_import.py", line 377, in <module>
    main()
  File "/misp/misp_import.py", line 356, in main
    importer.import_from_crowdstrike(int(settings["CrowdStrike"]["init_reports_days_before"]),
  File "/misp/cs_misp_import/importer.py", line 308, in import_from_crowdstrike
    self.reports_importer.process_reports(reports_days_before, self.event_ids)
  File "/misp/cs_misp_import/reports.py", line 311, in process_reports
    reported.update(fut.result())
  File "/usr/local/lib/python3.10/concurrent/futures/_base.py", line 439, in result
    return self.__get_result()
  File "/usr/local/lib/python3.10/concurrent/futures/_base.py", line 391, in __get_result
    raise self._exception
  File "/usr/local/lib/python3.10/concurrent/futures/thread.py", line 58, in run
    result = self.fn(*self.args, **self.kwargs)
  File "/misp/cs_misp_import/reports.py", line 146, in batch_import_reports
    event: MISPEvent = self.create_event_from_report(report, rpt_detail, ind_list)
  File "/misp/cs_misp_import/reports.py", line 538, in create_event_from_report
    event = self.add_actor_detail(report, event)
  File "/misp/cs_misp_import/reports.py", line 334, in add_actor_detail
    actor_detail = actor_detail["body"]["resources"][0]
TypeError: 'NoneType' object is not subscriptable