Invalid initial heap size: -Xms

[ArifeVural]

Description

I deployed OpenCTI on AWS platform by using dockers and having problems to get Elasticsearch running.

Environment

1. OS (Ubuntu 22.04.1, 8GB memory, 30GB disk space)
2. OpenCTI version: 5.5.0
3. OpenCTI client: { e.g. frontend or python }
4. Other environment details:

Reproducible Steps

Steps to create the smallest reproducible scenario:

I followed these steps to install all the packages and portainer. 1 sudo apt-get update 2 sudo apt-get install apt-transport-https 3 sudo apt-get install ca-certificates 4 sudo apt-get install curl 5 sudo apt-get install gnupg-agent 6 sudo apt-get install software-properties-common 7 sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add - 8 sudo cp /etc/apt/trusted.gpg /etc/apt/trusted.gpg.d/. 9 sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" 10 sudo apt-get update 11 sudo apt-get install docker-ce docker-ce-cli containerd.io docker-compose 12 sudo usermod -aG docker $USER 13 docker swarm init --advertise-addr 13.40.49.106 14 sudo mkdir -p /opt/portainer && cd /opt/portainer 15 sudo curl -L https://downloads.portainer.io/portainer-agent-stack.yml -o portainer-agent-stack.yml 16 vi portainer-agent-stack.yml 18 sudo vi portainer-agent-stack.yml 19 sudo docker stack deploy --compose-file=portainer-agent-stack.yml portainer

Then used this yaml file for opencti:

version: '3' services: redis: image: redis:7.0.6 restart: always volumes:

• redisdata:/data elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:8.5.3 volumes:
• esdata:/usr/share/elasticsearch/data environment:

  Comment out the line below for single-node

• discovery.type=single-node

  Uncomment line below below for a cluster of multiple nodes

  - cluster.name=docker-cluster

• xpack.ml.enabled=false
• xpack.security.enabled=false
• "ES_JAVA_OPTS=-Xms${ELASTIC_MEMORY_SIZE} -Xmx${ELASTIC_MEMORY_SIZE}" restart: always ulimits: memlock: soft: -1 hard: -1 nofile: soft: 65536 hard: 65536 minio: image: minio/minio:RELEASE.2022-09-25T15-44-53Z volumes:
• s3data:/data ports:
• "9000:9000" environment: MINIO_ROOT_USER: ${MINIO_ROOT_USER} MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
  command: server /data healthcheck: test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"] interval: 30s timeout: 20s retries: 3 restart: always rabbitmq: image: rabbitmq:3.10-management environment:
• RABBITMQ_DEFAULT_USER=${RABBITMQ_DEFAULT_USER}
• RABBITMQ_DEFAULT_PASS=${RABBITMQ_DEFAULT_PASS} volumes:
• amqpdata:/var/lib/rabbitmq restart: always opencti: image: opencti/platform:5.5.0 environment:
• NODE_OPTIONS=--max-old-space-size=8096
• APP__PORT=8080
• APP__BASE_URL=${OPENCTI_BASE_URL}
• APPADMINEMAIL=${OPENCTI_ADMIN_EMAIL}
• APPADMINPASSWORD=${OPENCTI_ADMIN_PASSWORD}
• APPADMINTOKEN=${OPENCTI_ADMIN_TOKEN}
• APP__APP_LOGS__LOGS_LEVEL=error
• REDIS__HOSTNAME=redis
• REDIS__PORT=6379
• ELASTICSEARCH__URL=http://elasticsearch:9200
• MINIO__ENDPOINT=minio
• MINIO__PORT=9000
• MINIO__USE_SSL=false
• MINIO__ACCESS_KEY=${MINIO_ROOT_USER}
• MINIO__SECRET_KEY=${MINIO_ROOT_PASSWORD}
• RABBITMQ__HOSTNAME=rabbitmq
• RABBITMQ__PORT=5672
• RABBITMQ__PORT_MANAGEMENT=15672
• RABBITMQ__MANAGEMENT_SSL=false
• RABBITMQ__USERNAME=${RABBITMQ_DEFAULT_USER}
• RABBITMQ__PASSWORD=${RABBITMQ_DEFAULT_PASS}
• SMTP__HOSTNAME=${SMTP_HOSTNAME}
• SMTP__PORT=25
• PROVIDERSLOCALSTRATEGY=LocalStrategy ports:
• "8080:8080" depends_on:
• redis
• elasticsearch
• minio
• rabbitmq restart: always worker: image: opencti/worker:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• WORKER_LOG_LEVEL=info depends_on:
• opencti deploy: mode: replicated replicas: 3 restart: always connector-export-file-stix: image: opencti/connector-export-file-stix:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=${CONNECTOR_EXPORT_FILE_STIX_ID} # Valid UUIDv4
• CONNECTOR_TYPE=INTERNAL_EXPORT_FILE
• CONNECTOR_NAME=ExportFileStix2
• CONNECTOR_SCOPE=application/json
• CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_LOG_LEVEL=info restart: always depends_on:
• opencti connector-export-file-csv: image: opencti/connector-export-file-csv:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=${CONNECTOR_EXPORT_FILE_CSV_ID} # Valid UUIDv4
• CONNECTOR_TYPE=INTERNAL_EXPORT_FILE
• CONNECTOR_NAME=ExportFileCsv
• CONNECTOR_SCOPE=text/csv
• CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_LOG_LEVEL=info restart: always depends_on:
• opencti connector-export-file-txt: image: opencti/connector-export-file-txt:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=${CONNECTOR_EXPORT_FILE_TXT_ID} # Valid UUIDv4
• CONNECTOR_TYPE=INTERNAL_EXPORT_FILE
• CONNECTOR_NAME=ExportFileTxt
• CONNECTOR_SCOPE=text/plain
• CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_LOG_LEVEL=info restart: always depends_on:
• opencti connector-import-file-stix: image: opencti/connector-import-file-stix:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=${CONNECTOR_IMPORT_FILE_STIX_ID} # Valid UUIDv4
• CONNECTOR_TYPE=INTERNAL_IMPORT_FILE
• CONNECTOR_NAME=ImportFileStix
• CONNECTOR_VALIDATE_BEFORE_IMPORT=true # Validate any bundle before import
• CONNECTOR_SCOPE=application/json,text/xml
• CONNECTOR_AUTO=true # Enable/disable auto-import of file
• CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_LOG_LEVEL=info restart: always depends_on:
• opencti connector-import-document: image: opencti/connector-import-document:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=${CONNECTOR_IMPORT_DOCUMENT_ID} # Valid UUIDv4
• CONNECTOR_TYPE=INTERNAL_IMPORT_FILE
• CONNECTOR_NAME=ImportDocument
• CONNECTOR_VALIDATE_BEFORE_IMPORT=true # Validate any bundle before import
• CONNECTOR_SCOPE=application/pdf,text/plain,text/html
• CONNECTOR_AUTO=true # Enable/disable auto-import of file
• CONNECTOR_ONLY_CONTEXTUAL=false # Only extract data related to an entity (a report, a threat actor, etc.)
• CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_LOG_LEVEL=info
• IMPORT_DOCUMENT_CREATE_INDICATOR=true restart: always depends_on:
• opencti connector-alienvault: image: opencti/connector-alienvault:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=4d3c1dbf-b521-44b5-8d4d-c011554993b7
• CONNECTOR_TYPE=EXTERNAL_IMPORT
• CONNECTOR_NAME=AlienVault
• CONNECTOR_SCOPE=alienvault
• CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_UPDATE_EXISTING_DATA=false
• CONNECTOR_LOG_LEVEL=info
• ALIENVAULT_BASE_URL=https://otx.alienvault.com
• ALIENVAULT_API_KEY=ENTERYOURAPIKEYHERE
• ALIENVAULT_TLP=White
• ALIENVAULT_CREATE_OBSERVABLES=true
• ALIENVAULT_CREATE_INDICATORS=true
• ALIENVAULT_PULSE_START_TIMESTAMP=2020-05-01T00:00:00 # BEWARE! Could be a lot of pulses!
• ALIENVAULT_REPORT_TYPE=threat-report
• ALIENVAULT_REPORT_STATUS=New
• ALIENVAULT_GUESS_MALWARE=false # Use tags to guess malware.
• ALIENVAULT_GUESS_CVE=false # Use tags to guess CVE.
• ALIENVAULT_EXCLUDED_PULSE_INDICATOR_TYPES=FileHash-MD5,FileHash-SHA1 # Excluded Pulse indicator types.
• ALIENVAULT_ENABLE_RELATIONSHIPS=true # Enable/Disable relationship creation between SDOs.
• ALIENVAULT_ENABLE_ATTACK_PATTERNS_INDICATES=true # Enable/Disable "indicates" relationships between indicators and attack patterns
• ALIENVAULT_INTERVAL_SEC=1800 restart: always depends_on:
• opencti connector-cybercrimetracker: image: opencti/connector-cybercrime-tracker:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=f48e3dbb-142b-4497-805f-be2feb364fa8
• CONNECTOR_TYPE=EXTERNAL_IMPORT
• CONNECTOR_NAME=Cybercrime-Tracker
• CONNECTOR_SCOPE=cybercrime-tracker
• CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_UPDATE_EXISTING_DATA=false
• CONNECTOR_LOG_LEVEL=info
• CYBERCRIME_TRACKER_FEED_URL=http://cybercrime-tracker.net/rss.xml
• CYBERCRIME_TRACKER_TLP=WHITE
• CYBERCRIME_TRACKER_INTERVAL=86400
• CYBERCRIME_TRACKER_CREATE_INDICATORS=true
• CYBERCRIME_TRACKER_CREATE_OBSERVABLES=true restart: always depends_on:
• opencti abuseipdb-ipblacklist: image: opencti/connector-abuseipdb-ipblacklist:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=ef2efb3c-1200-47e7-a40e-952b20b2ac5b # Valid UUIDv4
• CONNECTOR_TYPE=EXTERNAL_IMPORT
• "CONNECTOR_NAME=AbuseIPDB IP Blacklist"
• CONNECTOR_SCOPE=abuseipdb
• CONNECTOR_CONFIDENCE_LEVEL=100 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_LOG_LEVEL=info
• ABUSEIPDB_URL=https://api.abuseipdb.com/api/v2/blacklist
• ABUSEIPDB_API_KEY=ENTERYOURAPIKEYHERE
• ABUSEIPDB_SCORE=100
• ABUSEIPDB_LIMIT=10000
• ABUSEIPDB_INTERVAL=2 #Day restart: always depends_on:
• opencti connector-mitre: image: opencti/connector-mitre:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=d1e314b6-7e09-42db-bd5d-19b9ca461f82
• CONNECTOR_TYPE=EXTERNAL_IMPORT
• "CONNECTOR_NAME=MITRE Datasets"
• CONNECTOR_SCOPE=marking-definition,identity,attack-pattern,course-of-action,intrusion-set,campaign,malware,tool,report,external-reference-as-report
• CONNECTOR_CONFIDENCE_LEVEL=75 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_UPDATE_EXISTING_DATA=false
• CONNECTOR_RUN_AND_TERMINATE=false
• CONNECTOR_LOG_LEVEL=info
• MITRE_ENTERPRISE_FILE_URL=https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json
• MITRE_MOBILE_ATTACK_FILE_URL=https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/mobile-attack/mobile-attack.json
• MITRE_ICS_ATTACK_FILE_URL=https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/ics-attack/ics-attack.json
• MITRE_CAPEC_FILE_URL=https://raw.githubusercontent.com/mitre/cti/master/capec/2.1/stix-capec.json
• MITRE_INTERVAL=3 # In days, must be strictly greater than 1 restart: always depends_on:
• opencti connector-urlhaus: image: opencti/connector-urlhaus:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=7ff6b8fd-7a4c-4cdc-9f1d-c5a8ff65a724
• CONNECTOR_TYPE=EXTERNAL_IMPORT
• "CONNECTOR_NAME=Abuse.ch URLhaus"
• CONNECTOR_SCOPE=urlhaus
• CONNECTOR_CONFIDENCE_LEVEL=40 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_UPDATE_EXISTING_DATA=false
• CONNECTOR_LOG_LEVEL=info
• URLHAUS_CSV_URL=https://urlhaus.abuse.ch/downloads/csv_recent/
• URLHAUS_IMPORT_OFFLINE=true
• URLHAUS_CREATE_INDICATORS=true
• URLHAUS_INTERVAL=2 # In days, must be strictly greater than 1 restart: always depends_on:
• opencti connector-urlscan: image: opencti/connector-urlscan:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=a21c6a2f-4862-451a-9fd5-65d483339675
• CONNECTOR_TYPE=EXTERNAL_IMPORT
• CONNECTOR_NAME=Urlscan
• CONNECTOR_SCOPE=urlscan
• CONNECTOR_LOG_LEVEL=info
• CONNECTOR_CONFIDENCE_LEVEL=40 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_UPDATE_EXISTING_DATA=false
• CONNECTOR_CREATE_INDICATORS=true
• CONNECTOR_TLP=white
• CONNECTOR_LABELS=Phishing,Phishfeed
• CONNECTOR_INTERVAL=86400 # seconds, 1d
• URLSCAN_URL=https://urlscan.io/api/v1/pro/phishfeed?format=json&q=date:>now-1d
• URLSCAN_API_KEY=ENTERYOURAPIKEYHERE restart: always depends_on:

• opencti

  connector-vxvault: image: opencti/connector-vxvault:5.5.0 environment:

• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=7abd828e-738d-4c88-ab16-9799e1432a98
• CONNECTOR_TYPE=EXTERNAL_IMPORT
• "CONNECTOR_NAME=VX Vault URL list"
• CONNECTOR_SCOPE=vxvault
• CONNECTOR_CONFIDENCE_LEVEL=40 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_UPDATE_EXISTING_DATA=false
• CONNECTOR_LOG_LEVEL=info
• VXVAULT_URL=http://vxvault.net/URL_List.php
• VXVAULT_CREATE_INDICATORS=true
• VXVAULT_INTERVAL=3 # In days, must be strictly greater than 1 restart: always depends_on:
• opencti connector-shodan: image: opencti/connector-shodan:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=d7915b7f-8896-4e4b-a59b-c17a31ce5b34
• CONNECTOR_TYPE=INTERNAL_ENRICHMENT
• CONNECTOR_NAME=Shodan
• CONNECTOR_SCOPE=IPv4-Addr
• CONNECTOR_AUTO=true
• CONNECTOR_CONFIDENCE_LEVEL=75 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_LOG_LEVEL=info
• SHODAN_TOKEN=ENTERYOURAPIKEYHERE
• SHODAN_MAX_TLP=TLP:AMBER
• SHODAN_CREATE_INDICATORS=true restart: always depends_on:
• opencti connector-intezer-sandbox: image: opencti/connector-intezer-sandbox:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=e617fe85-63c8-4f82-ae0b-da93032add1a
• CONNECTOR_TYPE=INTERNAL_ENRICHMENT
• "CONNECTOR_NAME=IntezerSandbox"
• CONNECTOR_SCOPE=Artifact
• CONNECTOR_AUTO=true # Enable/disable auto-enrichment of observables
• CONNECTOR_CONFIDENCE_LEVEL=50 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_LOG_LEVEL=info
• INTEZER_SANDBOX_API_KEY=ENTERYOURAPIKEYHERE
• INTEZER_SANDBOX_FAMILY_COLOR=#0059f7 # Label color for family
• INTEZER_SANDBOX_MALICIOUS_COLOR=#d90e18 # Label color for malicious verdict
• INTEZER_SANDBOX_TRUSTED_COLOR=#d90e18 # And so on...
• INTEZER_SANDBOX_UNKNOWN_COLOR=#ffff00
• INTEZER_SANDBOX_SUSPICIOUS_COLOR=#f79e00
• INTEZER_SANDBOX_MAX_TLP=TLP:AMBER restart: always depends_on:
• opencti connector-ipinfo: image: opencti/connector-ipinfo:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=56593e28-2886-455d-94f3-c84deddb2ad3
• CONNECTOR_TYPE=INTERNAL_ENRICHMENT
• CONNECTOR_NAME=IpInfo
• CONNECTOR_SCOPE=IPv4-Addr
• CONNECTOR_AUTO=true
• CONNECTOR_CONFIDENCE_LEVEL=75 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_LOG_LEVEL=info
• IPINFO_TOKEN=ENTERYOURAPIKEYHERE
• IPINFO_MAX_TLP=TLP:AMBER restart: always depends_on:
• opencti connector-opencti: image: opencti/connector-opencti:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=21f7d068-3c55-4b52-96ca-64543e3f452e
• CONNECTOR_TYPE=EXTERNAL_IMPORT
• CONNECTOR_NAME=OpenCTI
• CONNECTOR_SCOPE=marking-definition,identity,location
• CONNECTOR_CONFIDENCE_LEVEL=90 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_UPDATE_EXISTING_DATA=true
• CONNECTOR_RUN_AND_TERMINATE=false
• CONNECTOR_LOG_LEVEL=info
• CONFIG_SECTORS_FILE_URL=https://raw.githubusercontent.com/OpenCTI-Platform/datasets/master/data/sectors.json
• CONFIG_GEOGRAPHY_FILE_URL=https://raw.githubusercontent.com/OpenCTI-Platform/datasets/master/data/geography.json
• CONFIG_INTERVAL=2 # In days, must be strictly greater than 1 restart: always depends_on:
• opencti connector-aptcampaign: image: opencti/connector-cyber-campaign-collection:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=94fe0177-3037-4d64-94b5-d4f81c977d8c
• CONNECTOR_TYPE=EXTERNAL_IMPORT
• "CONNECTOR_NAME=APT & Cybercriminals Campaign Collection"
• CONNECTOR_SCOPE=report
• CONNECTOR_CONFIDENCE_LEVEL=0 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_UPDATE_EXISTING_DATA=false
• CONNECTOR_RUN_AND_TERMINATE=false
• CONNECTOR_LOG_LEVEL=info
• CYBER_MONITOR_GITHUB_TOKEN=ENTERGITHUBTOKENHERE # If not provided, rate limit will be very low
• CYBER_MONITOR_FROM_YEAR=2018
• CYBER_MONITOR_INTERVAL=2 # In days, must be strictly greater than 1 restart: always depends_on:
• opencti connector-malware-bazaar-recent-additions: image: opencti/connector-malwarebazaar-recent-additions:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=ffcc016c-5f7b-41a7-9712-e5d75ef40153
• CONNECTOR_TYPE=EXTERNAL_IMPORT
• "CONNECTOR_NAME=MalwareBazaar Recent Additions"
• CONNECTOR_CONFIDENCE_LEVEL=50 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_UPDATE_EXISTING_DATA=false
• CONNECTOR_LOG_LEVEL=info
• MALWAREBAZAAR_RECENT_ADDITIONS_API_URL=https://mb-api.abuse.ch/api/v1/
• MALWAREBAZAAR_RECENT_ADDITIONS_COOLDOWN_SECONDS=300 # Time to wait in seconds between subsequent requests
• MALWAREBAZAAR_RECENT_ADDITIONS_INCLUDE_TAGS=exe,dll,docm,docx,doc,xls,xlsx,xlsm,js # (Optional) Only download files if any tag matches. (Comma separated)
• MALWAREBAZAAR_RECENT_ADDITIONS_INCLUDE_REPORTERS= # (Optional) Only download files uploaded by these reporters. (Comma separated)
• MALWAREBAZAAR_RECENT_ADDITIONS_LABELS=malware-bazar # (Optional) Labels to apply to uploaded Artifacts. (Comma separated)
• MALWAREBAZAAR_RECENT_ADDITIONS_LABELS_COLOR=#54483b # Color to use for labels restart: always depends_on:
• opencti connector-ivre: image: opencti/connector-ivre:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=54acb41b-31aa-49b2-9d50-a8bf4c43b385
• CONNECTOR_TYPE=INTERNAL_ENRICHMENT
• CONNECTOR_NAME=ivre
• CONNECTOR_SCOPE=autonomous-system,domain-name,ipv4-addr,ipv6-addr,mac-addr,x509-certificate
• CONNECTOR_AUTO=true
• CONNECTOR_CONFIDENCE_LEVEL=100 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_LOG_LEVEL=info
• IVRE_MAX_TLP=TLP:AMBER restart: always depends_on:
• opencti connector-misp-feed: image: opencti/connector-misp-feed:5.5.0 environment:
• OPENCTI_URL=http://opencti:8080
• OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
• CONNECTOR_ID=88d97360-4112-4f44-b607-f2fb0702a0e4
• CONNECTOR_TYPE=EXTERNAL_IMPORT
• "CONNECTOR_NAME=MISP Feed (CIRCL)"
• CONNECTOR_SCOPE=misp-feed-circl
• CONNECTOR_CONFIDENCE_LEVEL=20 # From 0 (Unknown) to 100 (Fully trusted)
• CONNECTOR_UPDATE_EXISTING_DATA=false
• CONNECTOR_RUN_AND_TERMINATE=false
• CONNECTOR_LOG_LEVEL=info
• MISP_FEED_URL=https://www.circl.lu/doc/misp/feed-osint
• MISP_FEED_SSL_VERIFY=true # Required
• MISP_FEED_IMPORT_FROM_DATE=2021-01-01 # Required, import all event from this date
• MISP_FEED_CREATE_REPORTS=true # Required, create report for MISP event
• MISP_FEED_REPORT_TYPE=misp-event
• MISP_FEED_CREATE_INDICATORS=true # Required, create indicators from attributes
• MISP_FEED_CREATE_OBSERVABLES=true # Required, create observables from attributes
• MISP_FEED_CREATE_OBJECT_OBSERVABLES=true # Required, create text observables for MISP objects
• MISP_FEED_IMPORT_TO_IDS_NO_SCORE=40 # Optional, use as a score for the indicator/observable if the attribute to_ids is no
• MISP_FEED_IMPORT_UNSUPPORTED_OBSERVABLES_AS_TEXT=false # Optional, import unsupported observable as x_opencti_text
• MISP_FEED_IMPORT_WITH_ATTACHMENTS=true # Optional, try to import a PDF file from the attachment attribute
• MISP_FEED_INTERVAL=5 # Required, in minutes restart: always depends_on:
• opencti

volumes: esdata: s3data: redisdata: amqpdata:

--

With env variables set again using Portainer.

Expected Output

Get OpenCTI login page when I try to access, http://X.X.X.X:8080/. Instead I get connection refused.

Actual Output

This is the error output from opencti_elasticsearch process:

Exception in thread "main" java.lang.RuntimeException: starting java failed with [1] output:

error: Invalid initial heap size: -Xms5GB Error: Could not create the Java Virtual Machine. Error: A fatal exception has occurred. Program will exit. at org.elasticsearch.server.cli.JvmOption.flagsFinal(JvmOption.java:113) at org.elasticsearch.server.cli.JvmOption.findFinalOptions(JvmOption.java:80) at org.elasticsearch.server.cli.MachineDependentHeap.determineHeapSettings(MachineDependentHeap.java:59) at org.elasticsearch.server.cli.JvmOptionsParser.jvmOptions(JvmOptionsParser.java:140) at org.elasticsearch.server.cli.JvmOptionsParser.determineJvmOptions(JvmOptionsParser.java:92) at org.elasticsearch.server.cli.ServerProcess.createProcess(ServerProcess.java:214) at org.elasticsearch.server.cli.ServerProcess.start(ServerProcess.java:108) at org.elasticsearch.server.cli.ServerProcess.start(ServerProcess.java:91) at org.elasticsearch.server.cli.ServerCli.startServer(ServerCli.java:234) at org.elasticsearch.server.cli.ServerCli.execute(ServerCli.java:91) at org.elasticsearch.common.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:54) at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:85) at org.elasticsearch.cli.Command.main(Command.java:50) at org.elasticsearch.launcher.CliToolLauncher.main(CliToolLauncher.java:64)

This is the output from opencti_opencti process:

{"category":"APP","error":{"context":{"category":"technical","error":"getaddrinfo ENOTFOUND elasticsearch","http_status":500,"reason":"ElasticSearch seems down"},"message":"A configuration error has occurred","name":"ConfigurationError","stack":"ConfigurationError: A configuration error has occurred\n at error (/opt/opencti/build/src/config/errors.js:8:10)\n at ConfigurationError (/opt/opencti/build/src/config/errors.js:54:53)\n at /opt/opencti/build/src/database/engine.js:171:15\n at processTicksAndRejections (node:internal/process/task_queues:95:5)\n at searchEngineInit (/opt/opencti/build/src/database/engine.js:161:3)\n at checkSystemDependencies (/opt/opencti/build/src/initialization.js:129:3)\n at boot (/opt/opencti/build/src/boot.js:10:5)"},"level":"error","message":"[OPENCTI] Platform start fail","timestamp":"2022-12-23T16:45:35.093Z","version":"5.5.0"}

Additional information

Screenshots (optional)

[richard-julien]

Hi, this error is only related to the option provided to elasticsearch container.

Invalid initial heap size: -Xms5GB

I assume you put 5GB in the ELASTIC_MEMORY_SIZE option that is not compatible.

You can try to put 5G instead.

[Fhwang0926]

first time, i got same but it was my miss

https://docs.opencti.io/latest/deployment/installation/#using-docker

(cat << EOF
OPENCTI_ADMIN_EMAIL=admin@opencti.io
OPENCTI_ADMIN_PASSWORD=ChangeMePlease
OPENCTI_ADMIN_TOKEN=$(cat /proc/sys/kernel/random/uuid)
OPENCTI_BASE_URL=http://localhost:8080
MINIO_ROOT_USER=$(cat /proc/sys/kernel/random/uuid)
MINIO_ROOT_PASSWORD=$(cat /proc/sys/kernel/random/uuid)
RABBITMQ_DEFAULT_USER=guest
RABBITMQ_DEFAULT_PASS=guest
ELASTIC_MEMORY_SIZE=4G
CONNECTOR_HISTORY_ID=$(cat /proc/sys/kernel/random/uuid)
CONNECTOR_EXPORT_FILE_STIX_ID=$(cat /proc/sys/kernel/random/uuid)
CONNECTOR_EXPORT_FILE_CSV_ID=$(cat /proc/sys/kernel/random/uuid)
CONNECTOR_IMPORT_FILE_STIX_ID=$(cat /proc/sys/kernel/random/uuid)
CONNECTOR_EXPORT_FILE_TXT_ID=$(cat /proc/sys/kernel/random/uuid)
CONNECTOR_IMPORT_DOCUMENT_ID=$(cat /proc/sys/kernel/random/uuid)
SMTP_HOSTNAME=localhost
EOF
) > .env

if don't work, set env force with "export ELASTIC_MEMORY_SIZE=4G"