search

OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
6.12k stars 907 forks source link

Error in logs: GraphQLError: Expected Iterable, but did not find one for field \"StixObjectOrStixRelationshipRefEdge.types\ #4330

Closed AlexSanchezN closed 1 year ago

AlexSanchezN commented 1 year ago

Description

We see about a dozen of errors each day in the logs like the one below We think they may be related to report browsing because since updating to 5.10.x we are seeing many errors like the one shown in the image.

{ "category": "APP", "error": { "stacktrace": [ "GraphQLError: Expected Iterable, but did not find one for field \"StixObjectOrStixRelationshipRefEdge.types\".", "at completeListValue (/opt/opencti/build/node_modules/graphql/execution/execute.js:679:11)", "at completeValue (/opt/opencti/build/node_modules/graphql/execution/execute.js:618:12)", "at completeValue (/opt/opencti/build/node_modules/graphql/execution/execute.js:595:23)", "at executeField (/opt/opencti/build/node_modules/graphql/execution/execute.js:500:19)", "at executeFields (/opt/opencti/build/node_modules/graphql/execution/execute.js:414:22)", "at completeObjectValue (/opt/opencti/build/node_modules/graphql/execution/execute.js:925:10)", "at completeValue (/opt/opencti/build/node_modules/graphql/execution/execute.js:646:12)", "at /opt/opencti/build/node_modules/graphql/execution/execute.js:707:25", "at Function.from (<anonymous>)", "at completeListValue (/opt/opencti/build/node_modules/graphql/execution/execute.js:687:34)", "at completeValue (/opt/opencti/build/node_modules/graphql/execution/execute.js:618:12)", "at executeField (/opt/opencti/build/node_modules/graphql/execution/execute.js:500:19)", "at executeFields (/opt/opencti/build/node_modules/graphql/execution/execute.js:414:22)", "at completeObjectValue (/opt/opencti/build/node_modules/graphql/execution/execute.js:925:10)", "at completeValue (/opt/opencti/build/node_modules/graphql/execution/execute.js:646:12)", "at /opt/opencti/build/node_modules/graphql/execution/execute.js:497:9" ] }, "inner_relation_creation": 0, "level": "error", "message": "API Call", "operation": "ContainerHeaderObjectsQuery", "operation_query": "query ContainerHeaderObjectsQuery($id:String!){container(id:$id){__typename id x_opencti_graph_data confidence createdBy{__typename __isIdentity:__typename id name entity_type}objectMarking{edges{node{id definition_type definition x_opencti_order x_opencti_color}}}objects(all:true){edges{types node{__typename ...on BasicObject{__isBasicObject:__typename id entity_type parent_types}...on StixCoreObject{__isStixCoreObject:__typename created_at createdBy{__typename __isIdentity:__typename id name entity_type}objectMarking{edges{node{id definition_type definition x_opencti_order x_opencti_color}}}}...on StixDomainObject{__isStixDomainObject:__typename is_inferred created}...on AttackPattern{name x_mitre_id id}...on Campaign{name first_seen last_seen id}...on ObservedData{name id}...on CourseOfAction{name id}...on Note{attribute_abstract content id}...on Opinion{opinion id}...on Report{name published id}...on Grouping{name id}...on Individual{name id}...on Organization{name id}...on Sector{name id}...on System{name id}...on Indicator{name valid_from id}...on Infrastructure{name id}...on IntrusionSet{name first_seen last_seen id}...on Position{name id}...on City{name id}...on AdministrativeArea{name id}...on Country{name id}...on Region{name id}...on Malware{name first_seen last_seen id}...on ThreatActor{__isThreatActor:__typename name first_seen last_seen}...on Tool{name id}...on Vulnerability{name id}...on Incident{name first_seen last_seen id}...on Event{name description start_time stop_time id}...on Channel{name description id}...on Narrative{name description id}...on Language{name id}...on DataComponent{name id}...on DataSource{name id}...on Case{__isCase:__typename name}...on Task{name id}...on Feedback{name id}...on CaseIncident{name id}...on StixCyberObservable{__isStixCyberObservable:__typename observable_value}...on StixFile{observableName:name id}...on Label{value color id}...on MarkingDefinition{definition x_opencti_color id}...on KillChainPhase{kill_chain_name phase_name id}...on ExternalReference{url source_name id}...on BasicRelationship{__isBasicRelationship:__typename id entity_type parent_types}...on StixCoreRelationship{relationship_type start_time stop_time confidence created is_inferred from{__typename ...on BasicObject{__isBasicObject:__typename id entity_type parent_types}...on BasicRelationship{__isBasicRelationship:__typename id entity_type parent_types}...on StixCoreRelationship{relationship_type id}...on AdministrativeArea{id}...on Artifact{id}...on AttackPattern{id}...on AutonomousSystem{id}...on BankAccount{id}...on Campaign{id}...on CaseIncident{id}...on CaseRfi{id}...on CaseRft{id}...on CaseTemplate{id}...on Channel{id}...on City{id}...on Country{id}...on CourseOfAction{id}...on Creator{id}...on CryptocurrencyWallet{id}...on CryptographicKey{id}...on DataComponent{id}...on DataSource{id}...on Directory{id}...on DomainName{id}...on EmailAddr{id}...on EmailMessage{id}...on EmailMimePartType{id}...on EntitySetting{id}...on Event{id}...on ExternalReference{id}...on Feedback{id}...on Group{id}...on Grouping{id}...on Hostname{id}...on IPv4Addr{id}...on IPv6Addr{id}...on Incident{id}...on Indicator{id}...on Individual{id}...on Infrastructure{id}...on IntrusionSet{id}...on KillChainPhase{id}...on Label{id}...on Language{id}...on MacAddr{id}...on Malware{id}...on MalwareAnalysis{id}...on MarkingDefinition{id}...on MediaContent{id}...on Mutex{id}...on Narrative{id}...on NetworkTraffic{id}...on Note{id}...on ObservedData{id}...on Opinion{id}...on Organization{id}...on PaymentCard{id}...on PhoneNumber{id}...on Position{id}...on Process{id}...on Region{id}...on Report{id}...on Sector{id}...on Software{id}...on StixFile{id}...on StixRefRelationship{id}...on StixSightingRelationship{id}...on System{id}...on Task{id}...on Text{id}...on ThreatActorGroup{id}...on ThreatActorIndividual{id}...on Tool{id}...on Url{id}...on UserAccount{id}...on UserAgent{id}...on Vulnerability{id}...on WindowsRegistryKey{id}...on WindowsRegistryValueType{id}...on Workspace{id}...on X509Certificate{id}}to{__typename ...on BasicObject{__isBasicObject:__typename id entity_type parent_types}...on BasicRelationship{__isBasicRelationship:__typename id entity_type parent_types}...on StixCoreRelationship{relationship_type id}...on AdministrativeArea{id}...on Artifact{id}...on AttackPattern{id}...on AutonomousSystem{id}...on BankAccount{id}...on Campaign{id}...on CaseIncident{id}...on CaseRfi{id}...on CaseRft{id}...on CaseTemplate{id}...on Channel{id}...on City{id}...on Country{id}...on CourseOfAction{id}...on Creator{id}...on CryptocurrencyWallet{id}...on CryptographicKey{id}...on DataComponent{id}...on DataSource{id}...on Directory{id}...on DomainName{id}...on EmailAddr{id}...on EmailMessage{id}...on EmailMimePartType{id}...on EntitySetting{id}...on Event{id}...on ExternalReference{id}...on Feedback{id}...on Group{id}...on Grouping{id}...on Hostname{id}...on IPv4Addr{id}...on IPv6Addr{id}...on Incident{id}...on Indicator{id}...on Individual{id}...on Infrastructure{id}...on IntrusionSet{id}...on KillChainPhase{id}...on Label{id}...on Language{id}...on MacAddr{id}...on Malware{id}...on MalwareAnalysis{id}...on MarkingDefinition{id}...on MediaContent{id}...on Mutex{id}...on Narrative{id}...on NetworkTraffic{id}...on Note{id}...on ObservedData{id}...on Opinion{id}...on Organization{id}...on PaymentCard{id}...on PhoneNumber{id}...on Position{id}...on Process{id}...on Region{id}...on Report{id}...on Sector{id}...on Software{id}...on StixFile{id}...on StixRefRelationship{id}...on StixSightingRelationship{id}...on System{id}...on Task{id}...on Text{id}...on ThreatActorGroup{id}...on ThreatActorIndividual{id}...on Tool{id}...on Url{id}...on UserAccount{id}...on UserAgent{id}...on Vulnerability{id}...on WindowsRegistryKey{id}...on WindowsRegistryValueType{id}...on Workspace{id}...on X509Certificate{id}}created_at createdBy{__typename __isIdentity:__typename id name entity_type}objectMarking{edges{node{id definition_type definition x_opencti_order x_opencti_color}}}id}...on StixRefRelationship{relationship_type start_time stop_time confidence is_inferred from{__typename ...on BasicObject{__isBasicObject:__typename id entity_type parent_types}...on BasicRelationship{__isBasicRelationship:__typename id entity_type parent_types}...on StixCoreRelationship{relationship_type id}...on AdministrativeArea{id}...on Artifact{id}...on AttackPattern{id}...on AutonomousSystem{id}...on BankAccount{id}...on Campaign{id}...on CaseIncident{id}...on CaseRfi{id}...on CaseRft{id}...on CaseTemplate{id}...on Channel{id}...on City{id}...on Country{id}...on CourseOfAction{id}...on Creator{id}...on CryptocurrencyWallet{id}...on CryptographicKey{id}...on DataComponent{id}...on DataSource{id}...on Directory{id}...on DomainName{id}...on EmailAddr{id}...on EmailMessage{id}...on EmailMimePartType{id}...on EntitySetting{id}...on Event{id}...on ExternalReference{id}...on Feedback{id}...on Group{id}...on Grouping{id}...on Hostname{id}...on IPv4Addr{id}...on IPv6Addr{id}...on Incident{id}...on Indicator{id}...on Individual{id}...on Infrastructure{id}...on IntrusionSet{id}...on KillChainPhase{id}...on Label{id}...on Language{id}...on MacAddr{id}...on Malware{id}...on MalwareAnalysis{id}...on MarkingDefinition{id}...on MediaContent{id}...on Mutex{id}...on Narrative{id}...on NetworkTraffic{id}...on Note{id}...on ObservedData{id}...on Opinion{id}...on Organization{id}...on PaymentCard{id}...on PhoneNumber{id}...on Position{id}...on Process{id}...on Region{id}...on Report{id}...on Sector{id}...on Software{id}...on StixFile{id}...on StixRefRelationship{id}...on StixSightingRelationship{id}...on System{id}...on Task{id}...on Text{id}...on ThreatActorGroup{id}...on ThreatActorIndividual{id}...on Tool{id}...on Url{id}...on UserAccount{id}...on UserAgent{id}...on Vulnerability{id}...on WindowsRegistryKey{id}...on WindowsRegistryValueType{id}...on Workspace{id}...on X509Certificate{id}}to{__typename ...on BasicObject{__isBasicObject:__typename id entity_type parent_types}...on BasicRelationship{__isBasicRelationship:__typename id entity_type parent_types}...on StixCoreRelationship{relationship_type id}...on AdministrativeArea{id}...on Artifact{id}...on AttackPattern{id}...on AutonomousSystem{id}...on BankAccount{id}...on Campaign{id}...on CaseIncident{id}...on CaseRfi{id}...on CaseRft{id}...on CaseTemplate{id}...on Channel{id}...on City{id}...on Country{id}...on CourseOfAction{id}...on Creator{id}...on CryptocurrencyWallet{id}...on CryptographicKey{id}...on DataComponent{id}...on DataSource{id}...on Directory{id}...on DomainName{id}...on EmailAddr{id}...on EmailMessage{id}...on EmailMimePartType{id}...on EntitySetting{id}...on Event{id}...on ExternalReference{id}...on Feedback{id}...on Group{id}...on Grouping{id}...on Hostname{id}...on IPv4Addr{id}...on IPv6Addr{id}...on Incident{id}...on Indicator{id}...on Individual{id}...on Infrastructure{id}...on IntrusionSet{id}...on KillChainPhase{id}...on Label{id}...on Language{id}...on MacAddr{id}...on Malware{id}...on MalwareAnalysis{id}...on MarkingDefinition{id}...on MediaContent{id}...on Mutex{id}...on Narrative{id}...on NetworkTraffic{id}...on Note{id}...on ObservedData{id}...on Opinion{id}...on Organization{id}...on PaymentCard{id}...on PhoneNumber{id}...on Position{id}...on Process{id}...on Region{id}...on Report{id}...on Sector{id}...on Software{id}...on StixFile{id}...on StixRefRelationship{id}...on StixSightingRelationship{id}...on System{id}...on Task{id}...on Text{id}...on ThreatActorGroup{id}...on ThreatActorIndividual{id}...on Tool{id}...on Url{id}...on UserAccount{id}...on UserAgent{id}...on Vulnerability{id}...on WindowsRegistryKey{id}...on WindowsRegistryValueType{id}...on Workspace{id}...on X509Certificate{id}}created_at objectMarking{edges{node{id definition_type definition x_opencti_order x_opencti_color}}}id}...on StixSightingRelationship{relationship_type first_seen last_seen confidence created is_inferred from{__typename ...on BasicObject{__isBasicObject:__typename id entity_type parent_types}...on BasicRelationship{__isBasicRelationship:__typename id entity_type parent_types}...on StixCoreRelationship{relationship_type id}...on AdministrativeArea{id}...on Artifact{id}...on AttackPattern{id}...on AutonomousSystem{id}...on BankAccount{id}...on Campaign{id}...on CaseIncident{id}...on CaseRfi{id}...on CaseRft{id}...on CaseTemplate{id}...on Channel{id}...on City{id}...on Country{id}...on CourseOfAction{id}...on Creator{id}...on CryptocurrencyWallet{id}...on CryptographicKey{id}...on DataComponent{id}...on DataSource{id}...on Directory{id}...on DomainName{id}...on EmailAddr{id}...on EmailMessage{id}...on EmailMimePartType{id}...on EntitySetting{id}...on Event{id}...on ExternalReference{id}...on Feedback{id}...on Group{id}...on Grouping{id}...on Hostname{id}...on IPv4Addr{id}...on IPv6Addr{id}...on Incident{id}...on Indicator{id}...on Individual{id}...on Infrastructure{id}...on IntrusionSet{id}...on KillChainPhase{id}...on Label{id}...on Language{id}...on MacAddr{id}...on Malware{id}...on MalwareAnalysis{id}...on MarkingDefinition{id}...on MediaContent{id}...on Mutex{id}...on Narrative{id}...on NetworkTraffic{id}...on Note{id}...on ObservedData{id}...on Opinion{id}...on Organization{id}...on PaymentCard{id}...on PhoneNumber{id}...on Position{id}...on Process{id}...on Region{id}...on Report{id}...on Sector{id}...on Software{id}...on StixFile{id}...on StixRefRelationship{id}...on StixSightingRelationship{id}...on System{id}...on Task{id}...on Text{id}...on ThreatActorGroup{id}...on ThreatActorIndividual{id}...on Tool{id}...on Url{id}...on UserAccount{id}...on UserAgent{id}...on Vulnerability{id}...on WindowsRegistryKey{id}...on WindowsRegistryValueType{id}...on Workspace{id}...on X509Certificate{id}}to{__typename ...on BasicObject{__isBasicObject:__typename id entity_type parent_types}...on BasicRelationship{__isBasicRelationship:__typename id entity_type parent_types}...on StixCoreRelationship{relationship_type id}...on AdministrativeArea{id}...on Artifact{id}...on AttackPattern{id}...on AutonomousSystem{id}...on BankAccount{id}...on Campaign{id}...on CaseIncident{id}...on CaseRfi{id}...on CaseRft{id}...on CaseTemplate{id}...on Channel{id}...on City{id}...on Country{id}...on CourseOfAction{id}...on Creator{id}...on CryptocurrencyWallet{id}...on CryptographicKey{id}...on DataComponent{id}...on DataSource{id}...on Directory{id}...on DomainName{id}...on EmailAddr{id}...on EmailMessage{id}...on EmailMimePartType{id}...on EntitySetting{id}...on Event{id}...on ExternalReference{id}...on Feedback{id}...on Group{id}...on Grouping{id}...on Hostname{id}...on IPv4Addr{id}...on IPv6Addr{id}...on Incident{id}...on Indicator{id}...on Individual{id}...on Infrastructure{id}...on IntrusionSet{id}...on KillChainPhase{id}...on Label{id}...on Language{id}...on MacAddr{id}...on Malware{id}...on MalwareAnalysis{id}...on MarkingDefinition{id}...on MediaContent{id}...on Mutex{id}...on Narrative{id}...on NetworkTraffic{id}...on Note{id}...on ObservedData{id}...on Opinion{id}...on Organization{id}...on PaymentCard{id}...on PhoneNumber{id}...on Position{id}...on Process{id}...on Region{id}...on Report{id}...on Sector{id}...on Software{id}...on StixFile{id}...on StixRefRelationship{id}...on StixSightingRelationship{id}...on System{id}...on Task{id}...on Text{id}...on ThreatActorGroup{id}...on ThreatActorIndividual{id}...on Tool{id}...on Url{id}...on UserAccount{id}...on UserAgent{id}...on Vulnerability{id}...on WindowsRegistryKey{id}...on WindowsRegistryValueType{id}...on Workspace{id}...on X509Certificate{id}}created_at createdBy{__typename __isIdentity:__typename id name entity_type}objectMarking{edges{node{id definition_type definition x_opencti_order x_opencti_color}}}id}...on Artifact{id}...on AutonomousSystem{id}...on BankAccount{id}...on CaseRfi{id}...on CaseRft{id}...on CaseTemplate{id}...on CryptocurrencyWallet{id}...on CryptographicKey{id}...on Directory{id}...on DomainName{id}...on EmailAddr{id}...on EmailMessage{id}...on EmailMimePartType{id}...on EntitySetting{id}...on Hostname{id}...on IPv4Addr{id}...on IPv6Addr{id}...on MacAddr{id}...on MalwareAnalysis{id}...on MediaContent{id}...on Mutex{id}...on NetworkTraffic{id}...on PaymentCard{id}...on PhoneNumber{id}...on Process{id}...on Software{id}...on Text{id}...on ThreatActorGroup{id}...on ThreatActorIndividual{id}...on Url{id}...on UserAccount{id}...on UserAgent{id}...on WindowsRegistryKey{id}...on WindowsRegistryValueType{id}...on Workspace{id}...on X509Certificate{id}}}}}}", "size": 45, "time": 1648, "timestamp": "2023-09-14T00:06:51.243Z", "type": "READ_ERROR", "user": { "group_ids": [ "redacted", "redacted" ], "ip": "::ffff:10.200.222.112", "organization_ids": [], "referer": "https://cti.etic.security/dashboard/analyses/reports/a511123c-2052-489b-9413-583589111d43", "socket": "query", "user_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx" }, "variables": { "id": "xxxx-xxxx-xxxxxx-xxxx-xxxxxxxxx" }, "version": "5.10.2" }

image

Environment

Version 5.10.x Ubuntu baremetal installation

Reproducible Steps

Haven't been able to reproduce at will. It is a random behavior

Additional information

We have started adding network-traffic items to the reports, and those seem the more prone to log the error. This is a hunch, we don't really know if it is related

richard-julien commented 1 year ago

Closing as duplicate of https://github.com/OpenCTI-Platform/opencti/issues/4324 Will be part of the next release