[RST Cloud - Threat Feed] The connector seems active, raises no errors, but nothing is imported

OpenCTI-Platform / connectors

OpenCTI Connectors

https://www.opencti.io

Apache License 2.0

379 stars 412 forks source link

[RST Cloud - Threat Feed] The connector seems active, raises no errors, but nothing is imported #2817

Open Lhorus6 opened 2 weeks ago

Lhorus6 commented 2 weeks ago

Description

The connector seems active, raises no errors, but nothing is imported (no work is even created). It's as if it never does anything.

Environment

OCTI 6.3.6

Reproducible Steps

Steps to create the smallest reproducible scenario:

Enable the connector and wait -> Nothing ever happens

Lhorus6 commented 2 weeks ago

I'll switch the log level to “debug” to see if I can get more information.

I'll update this issue after

UPDATE: Nothing more...

k1r10n commented 1 week ago

Did you specify the API Key? this is the only parameter you need to change to test it. The errors will be in the docker output if no key provided

Lhorus6 commented 4 days ago

Hi @k1r10n,

The referenced API key is the same as the one in the connector for reports (which retrieves data), so I imagine that it is valid.
The connector is in log level debug and I have no logs.

This is the configuration that I'm currently using (with the correct API key, not "changeme" of course)

k1r10n commented 4 days ago

Please send the Docker logs output to support@rstcloud.net. The issue may be related to connectivity within your network. The API returns a temporary link to AWS S3 to get the feed.

docker logs containername

Usually, there are no issues with the connector. Just set the key.

Additionally, consider clearing the state for the connector from the UI. If you see the 'lastrun' with an epoch value in it, the connector will wait for 86400 sec till the next run, so that is why 'nothing happens'. Just in case, after the state is cleared, kill the container so it is rebuilt and see if it helps.