PaloAltoNetworks / SafeNetworking

Read only mirror. To contribute or submit issues, please go to the website link --->
https://gitlab.com/panw-gse/as/SafeNetworking/
Apache License 2.0
12 stars 10 forks source link

get-domains.py is broken #43

Open punisherVX opened 5 years ago

punisherVX commented 5 years ago

Expected behavior and actual behavior.

Run get-domains.py and get list of domains and number of events correlated. Running gives this error:

GET http://localhost:9200/sfn-dns-event/_search [status:404 request:0.003s]
Traceback (most recent call last):
  File "./get-domains.py", line 11, in <module>
    response = s.execute()
  File "/home/ubuntu/safe-networking/env/lib/python3.6/site-packages/elasticsearch_dsl/search.py", line 679, in execute
    **self._params
  File "/home/ubuntu/safe-networking/env/lib/python3.6/site-packages/elasticsearch/client/utils.py", line 76, in _wrapped
    return func(*args, params=params, **kwargs)
  File "/home/ubuntu/safe-networking/env/lib/python3.6/site-packages/elasticsearch/client/__init__.py", line 636, in search
    doc_type, '_search'), params=params, body=body)
  File "/home/ubuntu/safe-networking/env/lib/python3.6/site-packages/elasticsearch/transport.py", line 314, in perform_request
    status, headers, data = connection.perform_request(method, url, params, body, headers=headers, ignore=ignore, timeout=timeout)
  File "/home/ubuntu/safe-networking/env/lib/python3.6/site-packages/elasticsearch/connection/http_urllib3.py", line 161, in perform_request
    self._raise_error(response.status, raw_data)
  File "/home/ubuntu/safe-networking/env/lib/python3.6/site-packages/elasticsearch/connection/base.py", line 125, in _raise_error
    raise HTTP_EXCEPTIONS.get(status_code, TransportError)(status_code, error_message, additional_info)
elasticsearch.exceptions.NotFoundError: TransportError(404, 'index_not_found_exception', 'no such index')

Problem is that it was never updated for the new threat indexes.

zube[bot] commented 5 years ago

sdndude said: This can be moved to the sfn click app or sfntools - need further review

zube[bot] commented 5 years ago

sdndude said: This should be part of the SFN admin utility