AMQP connection workflow failed

[ExpOrx]

NFO:root:2001 pulse(s) since 2021-12-11 00:00:00... INFO:root:Processing pulse Additional Formbook infostealer IOCs - November 2021 (618d43cef601ecc2bc8d105b)... INFO:alienvault.builder:Excluding pulse indicator '521339ae9fa89c3af1b50456781272a8' (FileHash-MD5) INFO:alienvault.builder:Excluding pulse indicator 'c5d51d7374c5d5bd0fd41b3a18b6f812' (FileHash-MD5) INFO:root:Update action expectations opencti-work--5ac8e03f-65d2-4aa8-8e98-f4f6db9330b2 - 53 ERROR:pika.adapters.utils.selector_ioloop_adapter:Address resolution failed: gaierror(11001, 'getaddrinfo failed') ERROR:pika.adapters.utils.connection_workflow:getaddrinfo failed: gaierror(11001, 'getaddrinfo failed'). ERROR:pika.adapters.utils.connection_workflow:AMQP connection workflow failed: AMQPConnectionWorkflowFailed: 1 exceptions in all; last exception - gaierror(11001, 'getaddrinfo failed'); first exception - None. ERROR:pika.adapters.utils.connection_workflow:AMQPConnectionWorkflow - reporting failure: AMQPConnectionWorkflowFailed: 1 exceptions in all; last exception - gaierror(11001, 'getaddrinfo failed'); first exception - None ERROR:pika.adapters.blocking_connection:Connection workflow failed: AMQPConnectionWorkflowFailed: 1 exceptions in all; last exception - gaierror(11001, 'getaddrinfo failed'); first exception - None ERROR:pika.adapters.blocking_connection:Error in _create_connection(). Traceback (most recent call last):

version: '3' services: connector-alienvault: image: opencti/connector-alienvault:5.1.2 environment:

• OPENCTI_URL=http://xxxxxxxxxxxxx:8080
• OPENCTI_TOKEN=xxxxxx-2e82-xxxxx-b2fc-073a06a20432
• CONNECTOR_ID=xxxxx-e9e3-xxxxx-9a063f4e7c61
• CONNECTOR_TYPE=EXTERNAL_IMPORT
• CONNECTOR_NAME=AlienVault
• CONNECTOR_SCOPE=alienvault
• CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_UPDATE_EXISTING_DATA=false
• CONNECTOR_LOG_LEVEL=info
• ALIENVAULT_BASE_URL=https://otx.alienvault.com
• ALIENVAULT_API_KEY=xxxxxxxxxxxxxxxxxxx0d7d143514842d1b4b4a3f062c
• ALIENVAULT_TLP=White
• ALIENVAULT_CREATE_OBSERVABLES=true
• ALIENVAULT_CREATE_INDICATORS=true
• ALIENVAULT_PULSE_START_TIMESTAMP=2021-11-01T00:00:00 # BEWARE! Could be a lot of pulses!
• ALIENVAULT_REPORT_TYPE=threat-report
• ALIENVAULT_REPORT_STATUS=New
• ALIENVAULT_GUESS_MALWARE=false # Use tags to guess malware.
• ALIENVAULT_GUESS_CVE=false # Use tags to guess CVE.
• ALIENVAULT_EXCLUDED_PULSE_INDICATOR_TYPES=FileHash-MD5,FileHash-SHA1 # Excluded Pulse indicator types.
• ALIENVAULT_ENABLE_RELATIONSHIPS=true # Enable/Disable relationship creation between SDOs.
• ALIENVAULT_ENABLE_ATTACK_PATTERNS_INDICATES=true # Enable/Disable "indicates" relationships between indicators and attack patterns
• ALIENVAULT_INTERVAL_SEC=1800 restart: always

[nor3th]

Hey @ExpOrx

It seems like the connector is unable connect to RabbitMQ. If the OpenCTI platform is running in a separate docker compose file, you have to add the default opencti network to the connector compose file. Make sure via docker network ls that the network name is correct.

  restart: always
  networks:
    - opencti-default

networks:
  opencti-default:
    external:
      name: opencti-default

Regards

[nor3th]

Closed due to inactivity