IBM SOAR application with MISP error

[nameh99]

Hi,

Appreciate your help to check the below misp error after it was working fine,

Traceback (most recent call last): File "/opt/app-root/lib64/python3.9/site-packages/urllib3/connectionpool.py", line 700, in urlopen self._prepare_proxy(conn) File "/opt/app-root/lib64/python3.9/site-packages/urllib3/connectionpool.py", line 996, in _prepare_proxy conn.connect() File "/opt/app-root/lib64/python3.9/site-packages/urllib3/connection.py", line 414, in connect self.sock = ssl_wrapsocket( File "/opt/app-root/lib64/python3.9/site-packages/urllib3/util/ssl.py", line 453, in ssl_wrap_socket ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_intls) File "/opt/app-root/lib64/python3.9/site-packages/urllib3/util/ssl.py", line 495, in _ssl_wrap_socket_impl return ssl_context.wrap_socket(sock) File "/usr/lib64/python3.9/ssl.py", line 501, in wrap_socket return self.sslsocket_class._create( File "/usr/lib64/python3.9/ssl.py", line 1041, in _create self.do_handshake() File "/usr/lib64/python3.9/ssl.py", line 1310, in do_handshake self._sslobj.do_handshake() ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:1129) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/opt/app-root/lib64/python3.9/site-packages/requests/adapters.py", line 489, in send resp = conn.urlopen( File "/opt/app-root/lib64/python3.9/site-packages/urllib3/connectionpool.py", line 787, in urlopen retries = retries.increment( File "/opt/app-root/lib64/python3.9/site-packages/urllib3/util/retry.py", line 592, in increment raise MaxRetryError(_pool, url, error or ResponseError(cause)) urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='MISPURL', port=443): Max retries exceeded with url: /servers/getPyMISPVersion.json (Caused by SSLError(SSLEOFError(8, 'EOF occurred in violation of protocol (_ssl.c:1129)'))) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/opt/app-root/lib64/python3.9/site-packages/pymisp/api.py", line 160, in init response = self.recommended_pymisp_version File "/opt/app-root/lib64/python3.9/site-packages/pymisp/api.py", line 216, in recommended_pymisp_version response = self._prepare_request('GET', 'servers/getPyMISPVersion.json') File "/opt/app-root/lib64/python3.9/site-packages/pymisp/api.py", line 3427, in _prepare_request return self.session.send(prepped, timeout=self.timeout, settings) File "/opt/app-root/lib64/python3.9/site-packages/requests/sessions.py", line 701, in send r = adapter.send(request, kwargs) File "/opt/app-root/lib64/python3.9/site-packages/requests/adapters.py", line 563, in send raise SSLError(e, request=request) requests.exceptions.SSLError: HTTPSConnectionPool(host='MISPURL', port=443): Max retries exceeded with url: /servers/getPyMISPVersion.json (Caused by SSLError(SSLEOFError(8, 'EOF occurred in violation of protocol (_ssl.c:1129)'))) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/opt/app-root/lib64/python3.9/site-packages/fn_misp/components/misp_create_event.py", line 55, in _misp_create_event_function misp_client = misp_helper.get_misp_client(URL, API_KEY, VERIFY_CERT, proxies=proxies) File "/opt/app-root/lib64/python3.9/site-packages/fn_misp/lib/misp_3_helper.py", line 11, in get_misp_client misp_client = ExpandedPyMISP(URL, API_KEY, ssl=VERIFY_CERT, proxies=proxies) File "/opt/app-root/lib64/python3.9/site-packages/pymisp/api.py", line 181, in init__ raise PyMISPError(f'Unable to connect to MISP ({self.root_url}). Please make sure the API key and the URL are correct (http/https is required): {e}') pymisp.exceptions.PyMISPError: Unable to connect to MISP (https://MISPURL:443). Please make sure the API key and the URL are correct (http/https is required): HTTPSConnectionPool(host='MISPURL', port=443): Max retries exceeded with url: /servers/getPyMISPVersion.json (Caused by SSLError(SSLEOFError(8, 'EOF occurred in violation of protocol (_ssl.c:1129)')))Setting up connection to MISP

[nameh99]

MISP version: v2.4.184 PyMISP version: 2.4.173 Python version: 3.10.12

[Rafiot]

Would be easier if you pasted the stacktrace with a more readable formatting, but this line is pretty clear: PyMISPError: Unable to connect to MISP (https://MISPURL:443).

The URL is incorrect.

[nameh99]

@Rafiot nope the url was actually misp ip, in addition it was working normally before but once we did a restart to the app host we start seeing this error

[Rafiot]

I very much doubt MISPURL is the URL of the instance. What do you put in your browser to reach MISP?