Patrowl VM won't send alerts

Patrowl / PatrowlManager

PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform

https://www.patrowl.io

GNU Affero General Public License v3.0

625 stars 112 forks source link

Patrowl VM won't send alerts #134

Closed webhead404 closed 4 years ago

webhead404 commented 4 years ago

The integration for Patrowl to The Hive doesn't work. Here is an example log:

[Rule][send_thehive_message()] Unable to send alert to TheHive with (error=Expecting value: line 1 column 1 (char 0), message ='[Asset=x.x.x.x] tcp/3128: Apache 2.4.x < 2.4.39 Multiple Vulnerabilities (4758a9)')

MaKyOtOx commented 4 years ago

Hello, Could you please confirm you correctly add these settings ?

alerts.endpoint.thehive.apikey
alerts.endpoint.thehive.url
alerts.endpoint.thehive.user

More information here: https://medium.com/@nicolas.mattiocco/anticipate-cyber-threats-with-patrowl-manage-them-with-thehive-e640394c23bc

webhead404 commented 4 years ago

It looks like there was a / at the end of the URL. I changed it and now it is working.

MaKyOtOx commented 4 years ago

Great :)