MISP Docker support

[kanekennedy]

Hi, I have tried to get this running in the "official" MISP Docker image and can not get the python script to run.

I have tried creating the env variables in the grafana and misp_web containers but have hit the end of my knowledge and google-fu.

My Grafana is connecting to InfluxDB with 3 buckets _monitoring _tasks and misp, I have also tried tcp://misp_web:50000 with the same error message.

root@b77ea19b6cc3:/var/www/MISP# python3 push_zmq_to_influxdb.py -id=external --url=tcp://localhost:50000 [INFO] [2023-08-31 09:49:14,372] - Subscribed to ZMQ Traceback (most recent call last): File "push_zmq_to_influxdb.py", line 187, in main() File "push_zmq_to_influxdb.py", line 166, in main client = InfluxDBClient( File "/usr/local/lib/python3.8/dist-packages/influxdb_client/client/influxdb_client.py", line 63, in init super().init(url=url, token=token, debug=debug, timeout=timeout, enable_gzip=enable_gzip, org=org, File "/usr/local/lib/python3.8/dist-packages/influxdb_client/client/_base.py", line 56, in init if self.url.endswith("/"): AttributeError: 'NoneType' object has no attribute 'endswith' Exception ignored in: <function InfluxDBClient.del at 0x7f40123a8670> Traceback (most recent call last): File "/usr/local/lib/python3.8/dist-packages/influxdb_client/client/influxdb_client.py", line 319, in del if self.api_client: AttributeError: 'InfluxDBClient' object has no attribute 'api_client'

[righel]

Hello @kanekennedy , 1) Which MISP docker repo do you mean by "official"? 2) Have you run pip install -r requirements.txt ? Can you run this and share the output?

    $ python3 -c "import influxdb_client; print(influxdb_client.__version__)"
    1.37.0

3) If your MISP instance is running inside docker, you may need to set Plugin.ZeroMQ_host to 0.0.0.0 or * and add a port forward in the docker-compose.yml file, example:

      ...
      misp:
        ports:
          - "80:80"
          - "443:443"
          - "50000:50000"

4) The script push_zmq_to_influxdb.py should be able to access InfluxDB container, so if you run it from inside the MISP docker container instead of your host machine, you will have to create a network so the MISP container can reach the InfluxDB.

Let me know if that helps.

[kanekennedy]

Thanks,

That has sent me down a slightly different direction. Upgraded the instance from Amazon Linux2 to AL2023 and running the python script outside of docker with the ports all opened.

I have the same influxdb client.

[root@ip-10-0-1-146 /]# python3 -c "import influxdb_client; print(influxdb_client.__version__)"
1.37.0

Upgrading from AL2 to AL2023 introduces some different errors with the requirements around liburl3 so i need to work out the requirements it needs to run on the native os Python (3.9.16)