LetMeR00t / TA-thehive-cortex

Technical add-on for Splunk related to TheHive/Cortex from TheHive project
GNU Lesser General Public License v3.0
47 stars 11 forks source link

Possible improvement in main exception catching #64

Closed vieau closed 1 year ago

vieau commented 1 year ago

Hello,

I think the exception catching in the main TheHive class should target the base Exception type, and not the TheHiveError one. https://github.com/LetMeR00t/TA-thehive-cortex/blob/1df97698fb0905d25915cdf3e754422a7b757794/TA-thehive-cortex/bin/thehive.py#L147

For example in case of a self-signed certificate missing in cacert.pem, the SSLCertVerificationError wont be catched in thehive.py, error message will be:

Unexpected error: HTTPSConnectionPool(host='server', port=443): Max retries exceeded with url: /api/v1/user/current (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1106)'))).

But with Exception catching in thehive.py it will be

[TH85] THE_HIVE_CERTIFICATE_FAILED - It seems that the certificate verification failed. Please check that the certificate authority is added to "/opt/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/certifi/cacert.pem". Complete error: HTTPSConnectionPool(host='server', port=443): Max retries exceeded with url: /api/v1/user/current (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1106)')))

Sorry I couldn't do a pull request. Thanks for you work.

LetMeR00t commented 1 year ago

Nice catch ! Thank you for submitting this. I'll keep it for a next update

LetMeR00t commented 1 year ago

Hello, A fix was provided in the next release published today on Splunkbase. Cloud vet need to be provided by Splunk but if you're having an on-premise instance, you can already install the latest version. I'll close this issue as I consider it should be fixed. If you have any other issue, please raise a new issue. Thank you