[Bug] Requirements don't get installed for new responder

[Kusko25]

I am trying to write a new Responder following the instructions here (http://docs.thehive-project.org/cortex/api/how-to-create-a-responder/) but if I try to run it I get Traceback (most recent call last): File "/opt/Custom-Analyzers/responders/Nailer/nailer.py", line 6, in <module> from cortexutils.responder import ResponderModuleNotFoundError: No module named 'cortexutils'

To Reproduce Cortex is running in a Docker container with the Responder directory mounted to a Windows filesystem. This is what my filetree looks like:

└── NOKI_Cortex_Responder
    ├── noki_responder.json
    ├── requirements.txt
    ├── responder.py

And the contents of noki_responder.json:

    "name" : "NOKI Reporter",
    "version" : "1.0",
    "author" : "Fraunhofer",
    "url": "TODO",
    "license": "TODO",
    "description": "Prepares a NOKI report and shares it via MISP",
    "dataTypeList": ["thehive:case"],
    "command": "NOKI_Cortex_Responder/responder.py",
    "baseConfig": "noki_responder",
    "config": {
      "misp-url": "http://localhost:8082",
      "misp-key": "LEbYEjTaco9247MpziThmiVc7yJATnOgDdRaneDF"
    },
    "configurationItems": [
      {
        "name": "misp-url",
        "description": "The URL of the MISP instance",
        "type": "string",
        "multi": false,
        "required": true
      },
      {
        "name": "misp-key",
        "description": "MISP API key",
        "type": "string",
        "multi": false,
        "required": true
      },
      {
        "name": "timeformat",
        "description": "The format of the time in the report (timestamp, iso or as taken by the python strftime function)",
        "type": "string",
        "multi": false,
        "required": true
      }
    ]
  }

I'd expect Cortex to install the requirements from the file and run the Responder (probably still with errors but at least get past the import statements)

Work environment

• Client OS: Windows 11
  • Cortex version: 3.1.7-1

[nadouani]

Hi @Kusko25:

• Does you responder's requirements.txt include cortexutils?
• How are you running your responders? Process or building custom docker images?

Cortex doesn't install the dependencies, you need to install them.

[Kusko25]

Thanks for the reply I was trying to run the responder as a process and kind of assumed cortex would install the requirements at some point when you add the new responder, but did then discover that, as you pointed out, it does not. That of course means in a docker version of cortex running as a script is almost impossible because it doesn't even ship with pip.

But I have since build the responder as an image and that works fine so I'll close this issue.

Again thanks for the reply, had honestly forgotten about it