Submit any IoC (in this instance it's a known indicator ending in .xyz which has been redacted from the log) for analysis using OpenCTI_SearchObservables_2_0 or OpenCTI_SearchExactObservable_2_0 in Cortex
Expected Output
Query the OpenCTI db and retrieve known results
Actual Output
Cortex Error
ERROR:root:Unknown type "X509V3ExtensionsType".
Traceback (most recent call last):
File "/worker/OpenCTI/opencti.py", line 111, in <module>
OpenCTIAnalyzer().run()
File "/worker/OpenCTI/opencti.py", line 65, in run
observables = opencti["api_client"].stix_cyber_observable.list(search=data)
File "/usr/local/lib/python3.10/site-packages/pycti/entities/opencti_stix_cyber_observable.py", line 370, in list
result = self.opencti.query(
File "/usr/local/lib/python3.10/site-packages/pycti/api/opencti_api_client.py", line 314, in query
raise ValueError(
ValueError: {'name': 'Unknown type "X509V3ExtensionsType".', 'message': 'Unknown type "X509V3ExtensionsType".'}
Description
I have a docker instance running TheHive's Cortex and OpenCTI all within the same docker-compose stack (so connected).
When attempting to run an analyzer against OpenCTI, I get the error below.
This seems to be related to an outdated version of OpenCTI Python library - is there a way to update it?
Environment
Docker container setup using Portainer stack (docker-compose) Cortex v3.1.4-1 OpenCTI v5.3.5
Reproducible Steps
Submit any IoC (in this instance it's a known indicator ending in .xyz which has been redacted from the log) for analysis using OpenCTI_SearchObservables_2_0 or OpenCTI_SearchExactObservable_2_0 in Cortex
Expected Output
Query the OpenCTI db and retrieve known results
Actual Output
Cortex Error
OpenCTI log: