MISP feed and connector not connecting to opencti

campbellmcgregor commented 3 months ago

Description

Trying to connect the MISP feed to opencti. The docker compose is separate but is on the same docker network as the opencti docker compose. After launching the docker container the following errors appear:

ERROR Error pinging the API | timestamp=2024-08-08T14:14:11.986325Z name=MISP Feed CIRL Osint exc_info=Traceback (most recent call last): File "/usr/local/lib/python3.11/site-packages/pycti/connector/opencti_connector_helper.py", line 454, in ping result = self.api.connector.ping( ^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.11/site-packages/pycti/api/opencti_api_connector.py", line 112, in ping result = self.api.query( ^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.11/site-packages/pycti/api/opencti_api_client.py", line 363, in query raise ValueError(value_error) ValueError: {'name': 'Unknown type "ConnectorInfoInput". Did you mean "ConnectorConfig", "ConnectorType", "CountryAddInput", "DirectoryAddInput", or "SectorAddInput"?', 'error_message': 'Unknown type "ConnectorInfoInput". Did you mean "ConnectorConfig", "ConnectorType", "CountryAddInput", "DirectoryAddInput", or "SectorAddInput"?'} attributes={"reason":"{'name': 'Unknown type \"ConnectorInfoInput\". Did you mean \"ConnectorConfig\", \"ConnectorType\", \"CountryAddInput\", \"DirectoryAddInput\", or \"SectorAddInput\"?', 'error_message': 'Unknown type \"ConnectorInfoInput\". Did you mean \"ConnectorConfig\", \"ConnectorType\", \"CountryAddInput\", \"DirectoryAddInput\", or \"SectorAddInput\"?'}"}

I can see the access logs for the connector account but there is nothing being imported.

Environment

OS (where OpenCTI server runs): Ubuntu 22.04 Docker
OpenCTI version: 6.2.5
OpenCTI client: frontend
Other environment details: docker compose for opencti and it's stack connectors are in a separate docker compose

Reproducible Steps

Steps to create the smallest reproducible scenario: Using the following docker compose

`version: '3' services: connector-misp-feed: image: opencti/connector-misp-feed:6.2.12 environment:

OPENCTI_URL=http://192.168.100.113:8080
OPENCTI_TOKEN=cc93cb1c-8f24-4225-ab62-e6ccd1e124bf
CONNECTOR_ID=88AACEC7-12D7-4F08-B150-269EF2748859
"CONNECTOR_NAME=MISP Feed CIRL Osint"
CONNECTOR_SCOPE=misp-feed
CONNECTOR_RUN_AND_TERMINATE=false
CONNECTOR_LOG_LEVEL=error
MISP_FEED_URL=https://www.circl.lu/doc/misp/feed-osint
MISP_FEED_SSL_VERIFY=true # Required
MISP_FEED_IMPORT_FROM_DATE=2000-01-01 # Required, import all event from this date
MISP_FEED_CREATE_REPORTS=true # Required, create report for MISP event
MISP_FEED_REPORT_TYPE=misp-event
MISP_FEED_CREATE_INDICATORS=true # Required, create indicators from attributes
MISP_FEED_CREATE_OBSERVABLES=true # Required, create observables from attributes
MISP_FEED_CREATE_OBJECT_OBSERVABLES=true # Required, create text observables for MISP objects
MISP_FEED_CREATE_TAGS_AS_LABELS=true # Optional, create tags as labels (sanitize MISP tag to OpenCTI labels)
MISP_FEED_GUESS_THREAT_FROM_TAGS=false # Optional, try to guess threats (threat actor, intrusion set, malware, etc.) from MISP tags when they are present in OpenCTI
MISP_FEED_AUTHOR_FROM_TAGS=false # Optional, map creator:XX=YY (author of event will be YY instead of the author of the event)
MISP_FEED_IMPORT_TO_IDS_NO_SCORE=40 # Optional, use as a score for the indicator/observable if the attribute to_ids is no
MISP_FEED_IMPORT_UNSUPPORTED_OBSERVABLES_AS_TEXT=false # Optional, import unsupported observable as x_opencti_text
MISP_FEED_IMPORT_UNSUPPORTED_OBSERVABLES_AS_TEXT_TRANSPARENT=true # Optional, import unsupported observable as x_opencti_text just with the value
MISP_FEED_IMPORT_WITH_ATTACHMENTS=false # Optional, try to import a PDF file from the attachment attribute
MISP_FEED_INTERVAL=5 # Required, in minutes
MISP_FEED_SOURCE_TYPE=url # Optionnal, url or s3 restart: always

networks: docker_default: external: true`

Expected Output

The MISP connector to pull in from the feed to OpenCTI

Actual Output

Error message as above

Additional information

Screenshots (optional)

campbellmcgregor commented 3 months ago

I have just checked a few other connectors and they are all saying it:

File "/usr/local/lib/python3.11/site-packages/pycti/api/opencti_api_client.py", line 363, in query raise ValueError(value_error) ValueError: {'name': 'Unknown type "ConnectorInfoInput". Did you mean "ConnectorConfig", "ConnectorType", "CountryAddInput", "DirectoryAddInput", or "SectorAddInput"?',

Megafredo commented 3 months ago

Hi @campbellmcgregor, this error is due to a change on the OpenCTI side, but also on client-python side, so it affects all connectors. Can you update and rebuild your client-python ? This should fix your problem. https://github.com/OpenCTI-Platform/client-python

campbellmcgregor commented 3 months ago

Ok cool let me do that and come back to you thanks

Megafredo commented 2 months ago

Hello @campbellmcgregor, can you tell me if this solved your problem ? if so I will close this issue.

OpenCTI-Platform / connectors