TheHive-Project / Cortex

Cortex: a Powerful Observable Analysis and Active Response Engine
https://thehive-project.org
GNU Affero General Public License v3.0
1.28k stars 217 forks source link

Cortex Censys Analyzer failed to authenticate #443

Open chickenit07 opened 1 year ago

chickenit07 commented 1 year ago

Cortex Censys Analyzer failed to authenticate

Work Environment

Question Answer
OS version (server) Ubuntu 20.04.4 LTS (Focal Fossa)
OS version (client) Windows 11 ...
Cortex version / git hash 3.1.7-1
Package Type From source

Problem Description

I try to authenticate with Censys analyzer but it shows that I don't provide a proper credentials. I did provide a proper credential which is both uid and secret_key collected from Censys-My Account but when I run analyzer within Thehive, it shows:

{ "errorMessage": "Censys raised NotAuthorizedException. Please check your credentials.", "success": false }

I did change the version of Censys to 2.x.x and the credential is working well but it shows another error:

"Traceback (most recent call last): File "/opt/Cortex-Analyzers/analyzers/Censys/censys_analyzer.py", line 5, in from censys.ipv4 import CensysIPv4ModuleNotFoundError: No module named 'censys.ipv4''"

I think the problem is that censys.ipv4 is deprecate so we need to make some changes on the analyzer code. What I do to

Steps to Reproduce

  1. Enable Cencys analyzer on Cortex with uid-key corresponding to Censys Account
  2. Go to Thehive and create an Observable
  3. Fill out the requirement field with Type is IP and choose Create observable.
  4. Choose the Observable and run analyzer Censys.