search

TheHive-Project / TheHive

TheHive: a Scalable, Open Source and Free Security Incident Response Platform
https://thehive-project.org
GNU Affero General Public License v3.0
3.45k stars 625 forks source link

Error connecting with MISP #551

Open gitQuestions opened 6 years ago

gitQuestions commented 6 years ago

Request Type

Bug

Work Environment

Question Answer
OS version (server) Ubuntu
OS version (client) Ubuntu
TheHive version 3.0.9
Package Type Binary
MISP version 2.4.79

Problem Description

I am trying to connect MISP with TheHive.

When starting TheHive I get some errors about the connection with MISP and the MIPS URL.

Attached a snapshot of the error and application.conf file

Steps to Reproduce

  1. I´ve just followed the installation documentation.

image

image

Thank you!!

jeromeleonard commented 6 years ago

Hello,

please use a url like "http://misp.xxxxx.com/" and note "misp.xxxx.com" in the configuration and restart thehive server. This should work.

Regards

On Fri, Apr 20, 2018 at 2:16 PM, gitQuestions notifications@github.com wrote:

EDIT THIS TITLE BEFORE POSTING. Use this template for bug reports. If you'd like to request a feature, please be as descriptive as possible and delete the template except the first section (Request Type) Request Type

Bug Work Environment Question Answer OS version (server) Ubuntu OS version (client) Ubuntu TheHive version 3.0.9 Package Type Binary MISP version 2.4.79 Problem Description

I am trying to connect MISP with TheHive.

When starting TheHive I get some errors about the connection with MISP and the MIPS URL.

Attached a snapshot of the error and application.conf file Steps to Reproduce

  1. I´ve just followed the installation documentation.

[image: image] https://user-images.githubusercontent.com/37657672/39050291-281129e2-44a5-11e8-9e0d-31ca9a7d33e6.png

[image: image] https://user-images.githubusercontent.com/37657672/39050387-753e2968-44a5-11e8-8bb7-b34a1fd6539f.png

Thank you!!

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/TheHive-Project/TheHive/issues/551, or mute the thread https://github.com/notifications/unsubscribe-auth/AKC4D-tN_8z8tQLdoaruoKcuVNwRpgP6ks5tqdGygaJpZM4TdXWX .

-- Jérôme Leonard. TheHive Project -- https://thehive-project.org/ PGP Key: 5BFDB50F Fingerprint: 8346 D9BC 5D9B 2A17 31D4 C96D 047D CDCA 5BFD B50F

gitQuestions commented 6 years ago

Hi,

I´ve just try with the url "http://misp.XXXX.ex/" (".ex" because it is a local server) and I get a new error:

image

image

Note that near the red line, it prints the MISP URL like "misp.XXXX.exevents" intead of "misp.XXXX.ex/events/index"

Thanks you for the help! :)

gitQuestions commented 6 years ago

I have not solved the problem yet, any suggestion?

Thanks.

jeromeleonard commented 6 years ago

maybe try "http://URL" without tailing '/'

gitQuestions commented 6 years ago

I got the same error.

I´ve noticed that TheHive is able to connect to MISP server but doent find the resource "events/index"HTTP 301" (HTTP 301 Moved Permanently). "tcpdump" from MISP Server:

image

When I look for the URL "https://misp.XXXX.ex/events/index" in my browser and press ENTER, it automatically change the URL to "https://misp.ciberbastion.exevents/index" (without the /) and doesnt find the page.

Nevertheless, using thaht URL with HTTPS it works (but I dont have the MISP certificate installed)...

image

I dont understand what is the problem...

gitQuestions commented 6 years ago

Maybe I should use HTTPS.

Do you know what modifications I should do to employ HTTPS?