TheHive-Project / Cortex-Analyzers

Cortex Analyzers Repository
https://TheHive-Project.github.io/Cortex-Analyzers/
GNU Affero General Public License v3.0
434 stars 374 forks source link

[Bug] Zscaler Analyzer v1.3 failing execution #1268

Open SgtMoose opened 3 months ago

SgtMoose commented 3 months ago

[Bug] Zscaler Analyzer v1.3 failing execution

Request Type

Bug

Work Environment

Production

Question Answer
OS version (server) Azure Container (Docker)
Cortex Analyzer Name Zscaler_1_3
Cortex Analyzer Version 1.3
Cortex Version 3.1.8-1

Description

After configuration, the analyzer fails with the following errors: Traceback (most recent call last): File "/usr/local/lib/python3.12/site-packages/requests/models.py", line 974, in json return complexjson.loads(self.text, **kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.12/json/init.py", line 346, in loads return _default_decoder.decode(s) ^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.12/json/decoder.py", line 337, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.12/json/decoder.py", line 355, in raw_decode raise JSONDecodeError("Expecting value", s, err.value) from None json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/worker/Zscaler/zscaler.py", line 111, in ZscalerAnalyzer().run() File "/worker/Zscaler/zscaler.py", line 102, in run response = s.json() ^^^^^^^^ File "/usr/local/lib/python3.12/site-packages/requests/models.py", line 978, in json raise RequestsJSONDecodeError(e.msg, e.doc, e.pos) requests.exceptions.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

Steps to Reproduce

(keep this section only if the issue relates to a bug)

  1. Configure analyzer with basic username, password, api key, and base url
  2. Attempt analyzer run with any of th e4 supported observable types

Complementary information

This looks to be the same issue reported in issue 1217 that has not been worked yet.

SgtMoose commented 3 months ago

This can be closed. Figured out that it was a terminology issue between what Zscaler means when it says Base URL versus what the Analyzer config actually needs for the Base URL.

Zscaler documentation states that part of the base URL is https://zsapi/(Zscaler Cloud Name)/api/v1. Since I saw in the script that /api/v1 is being appended, I shortened the base URL to https://zsapi.(Zscaler Cloud Name), in my case https://zsapi.zscalertwo.net and the Analyzer successfully worked.