OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
6.13k stars 908 forks source link

Integrating Opencti with n8n #8322

Open CyberneticsPlus opened 6 days ago

CyberneticsPlus commented 6 days ago

I am trying to integrate the opencti with n8n.io. But i am getting the Error code :500

Open cti is deployed in the docker .

image: opencti/platform:6.2.18
environment:
  - NODE_OPTIONS=--max-old-space-size=8096
  - APP__PORT=8080
  - APP__BASE_URL=${OPENCTI_BASE_URL}
  - APP__ADMIN__EMAIL=${OPENCTI_ADMIN_EMAIL}
  - APP__ADMIN__PASSWORD=${OPENCTI_ADMIN_PASSWORD}
  - APP__ADMIN__TOKEN=${OPENCTI_ADMIN_TOKEN}
  - APP__APP_LOGS__LOGS_LEVEL=error
  - REDIS__HOSTNAME=redis
  - REDIS__PORT=6379
  - ELASTICSEARCH__URL=http://elasticsearch:9200
  - MINIO__ENDPOINT=minio
  - MINIO__PORT=9000
  - MINIO__USE_SSL=false
  - MINIO__ACCESS_KEY=${MINIO_ROOT_USER}
  - MINIO__SECRET_KEY=${MINIO_ROOT_PASSWORD}
  - RABBITMQ__HOSTNAME=rabbitmq
  - RABBITMQ__PORT=5672
  - RABBITMQ__PORT_MANAGEMENT=15672
  - RABBITMQ__MANAGEMENT_SSL=false
  - RABBITMQ__USERNAME=${RABBITMQ_DEFAULT_USER}
  - RABBITMQ__PASSWORD=${RABBITMQ_DEFAULT_PASS}
  - SMTP__HOSTNAME=${SMTP_HOSTNAME}
  - SMTP__PORT=25
  - PROVIDERS__LOCAL__STRATEGY=LocalStrategy
  - APP__GRAPHQL__PLAYGROUND__FORCE_DISABLED_INTROSPECTION=true.   ( I have added this line ) 

Play ground page is loading but shows error: "Server cannot be reached"

Screenshot 2024-09-12 at 9 40 11 AM

Both Document and Schema keeps loading like that

Screenshot 2024-09-12 at 9 41 52 AM

N8N error

Screenshot 2024-09-12 at 9 43 34 AM
romain-filigran commented 5 days ago

Hello. To have OpenCTI PLAYGROUND working, can you tried to change: "APPGRAPHQLPLAYGROUNDFORCE_DISABLED_INTROSPECTION=true." by "APPGRAPHQLPLAYGROUNDFORCE_DISABLED_INTROSPECTION=false"

CyberneticsPlus commented 4 days ago

Thank you @romain-filigran , But still the my n8n is getting 500 error, but on the web the error is not coming.

gritty-Kitty commented 17 hours ago

Confirmed GraphQL Introspection, DOCS, and SCHEMA is available if you enable with settings below (at least after you login to OpenCTI).


We needed Graphql Introspection through the Playground interface to perform StackHawk DAST scan, and discovered last Thursday while combing through the forum threads, that this feature was disabled due to a security concern/request. We followed the instructions on our OpenCTI 6.1.12 Ubuntu 22.04LTS Docker installation, and confirmed that it DOES work, and DOCS and SCHEMA are NOW visible again (at least after logging in and selecting PLAYGROUND from the Global Admin's Profile page).

**Big thanks to the Filigran support staff for their continued efforts and development of the platform. Thank you.

We are working on running StackHawk DAST, but also experience Server Error 500, and are trying to determine if credentials are required.

image


Added these to the docker-compose.yml environment settings under OpenCTI.

  - APP__GRAPHQL__PLAYGROUND__ENABLED=true
  - APP__GRAPHQL__PLAYGROUND__FORCE_DISABLED_INTROSPECTION=false

image

image

References https://github.com/OpenCTI-Platform/opencti/issues/6465 https://github.com/OpenCTI-Platform/opencti/issues/6992 https://github.com/OpenCTI-Platform/opencti/issues/7077 https://demo.opencti.io/graphql

We are using Ubuntu 22.04LTS in Docker with Portainer Community Edition 2.20.3. Needed this version of Portainer a few months ago because Portainer Console was broke due to a Docker Update that they were working on. May have been fixed by now... need to round robin back to this.

Unable to retrieve image details or access container console after update of Docker to v26 #11436 https://github.com/portainer/portainer/issues/11436

gritty-Kitty commented 15 hours ago

It looks like we need to be authenticated in order to use GraphQL Introspection.

Using a web browser (Chrome/Edge)... if you hit the /graphql site, you will be presented with Server 500, but... if you login to OpenCTI (at least as Global Admin, and select Playground in PROFILE), then /graphql appears to load normally.

image

After logging in...

image


Can GraphQL Introspection be enabled without having to be authenticated? https://docs.opencti.io/5.8.X/deployment/configuration/ See app:graphql:playground:force_disabled_introspection.

What does, "Introspection is allowed to auth users but can be disabled in needed" mean?

Appears to imply that authentication can be disabled for GraphQL Introspection.