nino-filigran
commented
6 months ago @Pez721 let me try to undertand the different issues here.
- First, sometime when we attempt to upload reports with pdf attachments in Analyses, the wheel spins indefinitely and the Report is never created: Are you trying to import the PDF in an Analysis? If so, no report should be created, but only your file should be uploaded. I've tried to reproduce your issue but could not achieve it.
- ometimes I can take a pdf that doesnt upload, open it in word and resave as a pdf again, then it will load: this does not happen for me as explained above.
- Other times I can't find any way of uploading: could you be more specific? Do you struggle to find the CTA to upload? What are your rights in the platform?
- Finally, when the upload of a file and its import were successful, I go to the analyst workbench and click "Validate Workbench". Sometimes this hangs with no error logged and the workbench never validates: cou:d you try to reproduce this behavior? Indeed, we need to have this reproducible steps to understand whether or not there's an issue on our side.
- Secondly, sometimes when a file is uploaded and I click "Launch an import of this file" using the import document connector, I receive an error "Invalid value for Relationship 'target_ref': not a valid STIX identifier": same, having a reproducible case would help understand the proble. I'll try to find some help around what means this log.
Could you pelase ensure that you're running on the most up to date version and tell we what roles (and rights associated to your role) you have?
Pez721
Description
We are having several issues uploading documents to OpenCTI in the GUI. First, sometime when we attempt to upload reports with pdf attachments in Analyses, the wheel spins indefinitely and the Report is never created. This is related to the files, a single file will always either upload immediately or spin indefinitely. Sometimes I can take a pdf that doesnt upload, open it in word and resave as a pdf again, then it will load. Other times I can't find any way of uploading. When it fails to upload nothing is logged in opencti. I have attached an example of a file that does not upload - this one came from a website extract, but there are reports from proper vendors that fail too. Dark Web Profile NoName057(16) - SOCRadar® Cyber Intelligence Inc.pdf
Secondly, sometimes when a file is uploaded and I click "Launch an import of this file" using the import document connector, I receive an error "Invalid value for Relationship 'target_ref': not a valid STIX identifier". Example: [Feb 6, 2024, 3:47:59 PM] Invalid value for Relationship 'target_ref': not a valid STIX identifier, must match--: {'id': '078827d7-9f29-43dc-bd4b-ab5acdb3c191', 'standard_id': 'threat-actor--5d9de760-e18c-5daa-8a8c-a6e0bbbf4d15', 'entity_type': 'Threat-Actor-Group', 'parent_types': ['Basic-Object', 'Stix-Object', 'Stix-Core-Object', 'Stix-Domain-Object', 'Threat-Actor'], 'spec_version': '2.1', 'created_at': '2024-02-06T08:53:28.857Z', 'updated_at': '2024-02-06T15:47:39.499Z', 'createdBy': {'id': '5c108cdb-4c88-46da-b066-352fb6ce2518', 'standard_id': 'identity--631ca45b-2610-58cf-92c3-0697d2b3634f', 'entity_type': 'Individual', 'parent_types': ['Basic-Object', 'Stix-Object', 'Stix-Core-Object', 'Stix-Domain-Object', 'Identity'], 'spec_version': '2.1', 'identity_class': 'individual', 'name': 'xxxxx', 'description': '', 'roles': None, 'contact_information': None, 'x_opencti_aliases': None, 'created': '2024-02-06T08:50:27.302Z', 'modified': '2024-02-06T08:50:27.302Z', 'objectLabel': [], 'x_opencti_firstname': None, 'x_opencti_lastname': None, 'objectLabelIds': []}, 'objectMarking': [{'id': 'fe053437-7bb2-4ee8-aa7d-d7973651f53d', 'standard_id': 'marking-definition--f88d31f6-486f-44da-b317-01333bde0b82', 'entity_type': 'Marking-Definition', 'definition_type': 'TLP', 'definition': 'TLP:AMBER', 'created': '2023-09-29T08:51:53.552Z', 'modified': '2024-01-26T14:27:33.437Z', 'x_opencti_order': 3, 'x_opencti_color': '#d84315', 'createdById': None}], 'objectLabel': [{'id': '3bae34cc-a9a1-4e19-8085-44f92f5b5a58', 'value': 'turkey', 'color': '#ae5698', 'createdById': None}, {'id': 'dcfce0ad-5580-4de5-9669-e99b3dd96f9e', 'value': 'telecommunications', 'color': '#87bd48', 'createdById': None}, {'id': '333852ad-ded1-431d-989f-5e84e1c36388', 'value': 'crowdstrike', 'color': '#9f0242', 'createdById': None}], 'externalReferences': [{'id': '6590f0a2-a9fc-435b-bb86-fcdb77c1cafb', 'standard_id': 'external-reference--4b56e9ad-6684-58bf-8f60-6fc29cda6deb', 'entity_type': 'External-Reference', 'source_name': 'Recent PwnKit (CVE-2021-4034) Exploitation Represents an Enduring Threat; Targeting of Telecommunications Entities Continues', 'description': 'PwnKit is a LPE vulnerability (CVE-2021-4034) impacting the Polkit component of many Linux/Unix distributions.\nSpecifically, this out-of-bounds write vulnerability allows an adversary to bypass restrictions and insert an\nenvironment variable, which executes a specifically crafted payload with root permissions via pkexec.', 'url': 'https://falcon.us-2.crowdstrike.com/api2/intel/reports/entities/report-files/v1?ids=189243', 'hash': None, 'external_id': 'csa-221042-recent-pwnkit-cve-2021-4034-exploitation-represen...', 'created': '2024-02-06T15:47:39.084Z', 'modified': '2024-02-06T15:47:39.084Z', 'createdById': None}], 'revoked': False, 'confidence': 84, 'created': '2024-02-06T08:53:28.857Z', 'modified': '2024-02-06T15:47:39.499Z', 'name': 'Sea Turtle', 'description': 'Sea Turtle, known for its alignment with Turkish interests, operates within multiple aliases, including Teal Kurma, Marbled Dust, SILICON, Cosmic Wolf and UNC1326. This is an espionage-driven Advanced Persistent Threat (APT) actor, and it is derived towards the public and private sectors, with the highest level of interest expressed in relation to telecommunication entities, ISPs, IT service providers, and media organizations.', 'aliases': ['Teal Kurma', 'Marbled Dust', 'SILICON', 'Cosmic Wolf', 'UNC1326'], 'threat_actor_types': ['nation-state'], 'first_seen': '2017-01-06T00:00:00.000Z', 'last_seen': '2024-01-06T00:00:00.000Z', 'roles': ['malware-author', 'director'], 'goals': [], 'sophistication': 'expert', 'resource_level': 'government', 'primary_motivation': 'organizational-gain', 'secondary_motivations': ['ideology'], 'personal_motivations': ['dominance'], 'createdById': '5c108cdb-4c88-46da-b066-352fb6ce2518', 'objectMarkingIds': ['fe053437-7bb2-4ee8-aa7d-d7973651f53d'], 'objectLabelIds': ['3bae34cc-a9a1-4e19-8085-44f92f5b5a58', 'dcfce0ad-5580-4de5-9669-e99b3dd96f9e', '333852ad-ded1-431d-989f-5e84e1c36388'], 'externalReferencesIds': ['6590f0a2-a9fc-435b-bb86-fcdb77c1cafb']}
Finally, when the upload of a file and its import were successful, I go to the analyst workbench and click "Validate Workbench". Sometimes this hangs with no error logged and the workbench never validates.
Any help you can give on these issues would be much appreciated.
Environment