[Sekoia] "403 Client Error: Forbidden for url"

[Ken-Abruzzi]

Description

The Connector-Sekoia does not download data. I check the docker log file, it shows the error information "403 Client Error: Forbidden for url". figure 1

I visit the url mentioned in the log file, and it returns

Environment

1. OS (where OpenCTI server runs): Ubuntu server 20.04.2 LTS
2. OpenCTI version: OpenCTI 4.3.5
3. OpenCTI client: frontend

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Register in the url https://sekoia.io for 7 day free trial.

2. Generate an API key of 1005-character-length figure 2

The API key has such role as below: figure 3

3. Generate the connector id by clicking the red circle shown in figure 2

4. Modify the docker-compose.yml file to add the service of connector-sekoia

5. Add the environment varibles used above in the .env file.

6. "docker-compose up -d" to start the service.

   Expected Output

The download work should start.

Actual Output

Additional information

I ever doubt whether it is caused by an invalid API key. I modify the API key in the .env file to a wrong value. I then start the service and check the docker log file. And it shows "500 Server Error: Internal Server Error for url". So it is not the wrong API key that causes "403 Client Error".

[SamuelHassine]

@Darkheir Any idea?

[Darkheir]

The error you get when visiting the url makes sense, \u0026 should be replaced by & in the url (i.e. ?limit=20&cursor=...). In this case the API should return an HTTP 400 and not a 403.

As for the error in the connector seeing that this is a 403 ~I guess the API Key provided is not a valid one~. From the screenshot you provided the permission INTHREAT_READ_OBJECTS is missing from the API KEY rights. You should give a role having this permission to the API KEY you generate.

[Ken-Abruzzi]

@Darkheir @SamuelHassine Thank you very much. I need to ask the Sekoia for the permission with "INTHREAT_READ_OBJECTS".