MISP feed and connector not connecting to opencti

[campbellmcgregor]

Description

Trying to connect the MISP feed to opencti. The docker compose is separate but is on the same docker network as the opencti docker compose. After launching the docker container the following errors appear:

ERROR Error pinging the API | timestamp=2024-08-08T14:14:11.986325Z name=MISP Feed CIRL Osint exc_info=Traceback (most recent call last): File "/usr/local/lib/python3.11/site-packages/pycti/connector/opencti_connector_helper.py", line 454, in ping result = self.api.connector.ping( ^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.11/site-packages/pycti/api/opencti_api_connector.py", line 112, in ping result = self.api.query( ^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.11/site-packages/pycti/api/opencti_api_client.py", line 363, in query raise ValueError(value_error) ValueError: {'name': 'Unknown type "ConnectorInfoInput". Did you mean "ConnectorConfig", "ConnectorType", "CountryAddInput", "DirectoryAddInput", or "SectorAddInput"?', 'error_message': 'Unknown type "ConnectorInfoInput". Did you mean "ConnectorConfig", "ConnectorType", "CountryAddInput", "DirectoryAddInput", or "SectorAddInput"?'} attributes={"reason":"{'name': 'Unknown type \"ConnectorInfoInput\". Did you mean \"ConnectorConfig\", \"ConnectorType\", \"CountryAddInput\", \"DirectoryAddInput\", or \"SectorAddInput\"?', 'error_message': 'Unknown type \"ConnectorInfoInput\". Did you mean \"ConnectorConfig\", \"ConnectorType\", \"CountryAddInput\", \"DirectoryAddInput\", or \"SectorAddInput\"?'}"}

I can see the access logs for the connector account but there is nothing being imported.

Environment

1. OS (where OpenCTI server runs): Ubuntu 22.04 Docker
2. OpenCTI version: 6.2.5
3. OpenCTI client: frontend
4. Other environment details: docker compose for opencti and it's stack connectors are in a separate docker compose

Reproducible Steps

Steps to create the smallest reproducible scenario: Using the following docker compose

`version: '3' services: connector-misp-feed: image: opencti/connector-misp-feed:6.2.12 environment:

• OPENCTI_URL=http://192.168.100.113:8080
• OPENCTI_TOKEN=cc93cb1c-8f24-4225-ab62-e6ccd1e124bf
• CONNECTOR_ID=88AACEC7-12D7-4F08-B150-269EF2748859
• "CONNECTOR_NAME=MISP Feed CIRL Osint"
• CONNECTOR_SCOPE=misp-feed
• CONNECTOR_RUN_AND_TERMINATE=false
• CONNECTOR_LOG_LEVEL=error
• MISP_FEED_URL=https://www.circl.lu/doc/misp/feed-osint
• MISP_FEED_SSL_VERIFY=true # Required
• MISP_FEED_IMPORT_FROM_DATE=2000-01-01 # Required, import all event from this date
• MISP_FEED_CREATE_REPORTS=true # Required, create report for MISP event
• MISP_FEED_REPORT_TYPE=misp-event
• MISP_FEED_CREATE_INDICATORS=true # Required, create indicators from attributes
• MISP_FEED_CREATE_OBSERVABLES=true # Required, create observables from attributes
• MISP_FEED_CREATE_OBJECT_OBSERVABLES=true # Required, create text observables for MISP objects
• MISP_FEED_CREATE_TAGS_AS_LABELS=true # Optional, create tags as labels (sanitize MISP tag to OpenCTI labels)
• MISP_FEED_GUESS_THREAT_FROM_TAGS=false # Optional, try to guess threats (threat actor, intrusion set, malware, etc.) from MISP tags when they are present in OpenCTI
• MISP_FEED_AUTHOR_FROM_TAGS=false # Optional, map creator:XX=YY (author of event will be YY instead of the author of the event)
• MISP_FEED_IMPORT_TO_IDS_NO_SCORE=40 # Optional, use as a score for the indicator/observable if the attribute to_ids is no
• MISP_FEED_IMPORT_UNSUPPORTED_OBSERVABLES_AS_TEXT=false # Optional, import unsupported observable as x_opencti_text
• MISP_FEED_IMPORT_UNSUPPORTED_OBSERVABLES_AS_TEXT_TRANSPARENT=true # Optional, import unsupported observable as x_opencti_text just with the value
• MISP_FEED_IMPORT_WITH_ATTACHMENTS=false # Optional, try to import a PDF file from the attachment attribute
• MISP_FEED_INTERVAL=5 # Required, in minutes
• MISP_FEED_SOURCE_TYPE=url # Optionnal, url or s3 restart: always

networks: docker_default: external: true`

Expected Output

The MISP connector to pull in from the feed to OpenCTI

Actual Output

Error message as above

Additional information

Screenshots (optional)

[campbellmcgregor]

I have just checked a few other connectors and they are all saying it:

File "/usr/local/lib/python3.11/site-packages/pycti/api/opencti_api_client.py", line 363, in query raise ValueError(value_error) ValueError: {'name': 'Unknown type "ConnectorInfoInput". Did you mean "ConnectorConfig", "ConnectorType", "CountryAddInput", "DirectoryAddInput", or "SectorAddInput"?',

[Megafredo]

Hi @campbellmcgregor, this error is due to a change on the OpenCTI side, but also on client-python side, so it affects all connectors. Can you update and rebuild your client-python ? This should fix your problem. https://github.com/OpenCTI-Platform/client-python

[campbellmcgregor]

Ok cool let me do that and come back to you thanks

[Megafredo]

Hello @campbellmcgregor, can you tell me if this solved your problem ? if so I will close this issue.