Since updating to OpenCTI 6.3.4 from 6.2.18 the Infoblox connector no longer pulls in threat intelligence. Error logs are shown below in Actual Output. We jumped from 6.2.18 to 6.3.4 so this could have been introduced in between the two versions.
Environment
OS (where OpenCTI server runs): Docker
OpenCTI version: 6.3.4
OpenCTI client: N/A
Other environment details: N/A
Reproducible Steps
Enable the InfoBlox External Stream Connector with below config
connector-infoblox:
image: opencti/connector-infoblox:6.3.4
environment:
- OPENCTI_URL=http://opencti:8080
- OPENCTI_TOKEN=${INFOBLOX_OPENCTI_TOKEN}
- CONNECTOR_ID=${INFOBLOX_CONNECTOR_ID}
- CONNECTOR_TYPE=EXTERNAL_IMPORT
- CONNECTOR_NAME=InfoBlox
- CONNECTOR_LOG_LEVEL=error
- INFOBLOX_API_KEY=${INFOBLOX_API_KEY}
- INFOBLOX_INTERVAL=1 # In hours
- INFOBLOX_IOC_LIMIT=10000 # Limit of IOCs to import (for each IOC types)
- INFOBLOX_URL=https://csp.infoblox.com/tide/api/data/threats
- INFOBLOX_MARKING=TLP:AMBER
restart: always
Expected Output
Importing of Threat Intel from InfoBlox.
Actual Output
2024-10-03T18:18:10.313092201Z ERROR Error while getting intelligence from Infoblox: Expecting value: line 1 column 1 (char 0) | timestamp=2024-10-03T18:18:10.312810Z name=InfoBlox exc_info=Traceback (most recent call last):
File "/usr/local/lib/python3.11/site-packages/requests/models.py", line 974, in json
return complexjson.loads(self.text, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/site-packages/simplejson/__init__.py", line 514, in loads
return _default_decoder.decode(s)
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/site-packages/simplejson/decoder.py", line 386, in decode
obj, end = self.raw_decode(s)
^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/site-packages/simplejson/decoder.py", line 416, in raw_decode
return self.scan_once(s, idx=_w(s, idx).end())
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
simplejson.errors.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/opt/opencti-connector-infoblox/infoblox.py", line 97, in infoblox_api_get
r_json = response.json()
^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/site-packages/requests/models.py", line 978, in json
raise RequestsJSONDecodeError(e.msg, e.doc, e.pos)
requests.exceptions.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
2024-10-03T18:18:10.313674680Z ERROR 'NoneType' object is not subscriptable | timestamp=2024-10-03T18:18:10.313530Z name=InfoBlox exc_info=Traceback (most recent call last):
File "/opt/opencti-connector-infoblox/infoblox.py", line 248, in opencti_bundle
var_ip = json.loads(info[0])
~~~~^^^
TypeError: 'NoneType' object is not subscriptable
Description
Since updating to OpenCTI 6.3.4 from 6.2.18 the Infoblox connector no longer pulls in threat intelligence. Error logs are shown below in Actual Output. We jumped from 6.2.18 to 6.3.4 so this could have been introduced in between the two versions.
Environment
Reproducible Steps
Expected Output
Importing of Threat Intel from InfoBlox.
Actual Output
Additional information
Screenshots (optional)
Jobs show no data being pulled into the platform.