File Upload Failing

[libertasfox]

Ubuntu 16.04.1 nightHawk 1.0.4

I am trying to upload a .mans file and when I do I get a "QUERY_BUILDER" message that never goes away until I refresh the browser. I've changed the max file upload size in the nginx config. When I go over to view Kibana, it informs me of the following:

Warning - No default index pattern. You must select or create one to continue. "Unable to fetch mapping. Do you have indices matching the pattern?"

I've run the install file multiple times as instructed in the install section of the README, however, it doesn't appear to create the index pattern within Kibana. Any ideas?

Thanks in advance for the help.

[biggiesmallsAG]

Hey liertasfox,

Can you try to do a manual upload from cli? the 'nighthawk' binary has option flags that let you manually upload without the UI. Try this first. As for the index pattern not being in kibana, it sounds like something in the install script has failed. Can you zip up logs for us and drop them here so we can see?

Did you go through these steps exactly?

Version 1.0.4 would work on any Ubuntu x64 OS (we have tested in Ubuntu 16.04LTS) Update Ubuntu to latesth patch Download release/nhr-1.0.4.tar.gz Unarchive nhr-1.0.4.tar.gz Change directory to nhr-1.0.4 Change nhr-setup.sh to executable (chmod +x nhr-setup.sh) Install dependencies and nightHawk Response packages (sudo ./nhr-setup.sh install) Note: Internet access is required during installation. Initial installation may fail to create Elasticsearch index. If that happens please re-run (sudo ./nhr-setup.sh install) Verify all the components are running ---- sudo systemctl status elasticsearch ---- sudo systemctl status kibana ---- sudo systemctl status rabbitmq-server ---- sudo systemctl status nginx ---- sudo systemctl status nighthawk-api ---- sudo systemctl status nighthawk-worker You can access it by browsing to https://ipaddress Default username and password is both admin/admin

[libertasfox]

Thanks, biggiesmallsAG. Turns out the Redline files we had were corrupt in some way and once I pulled another Redline, I was able to get it uploaded successfully. Once I got it uploaded though, I did experience a another issue with the Stacking module. I'm getting the Query_Builder message and nothing populates. Also, I'm still wondering if Kibana is broken (issue in first post)? Thanks for the quick response.

[biggiesmallsAG]

Can you open the developer console and see if your getting any errors? Kibana isnt where the stacking happens, its only a wrapper for Elasticsearch. Now that you have the file uploaded, can you try to give the page a full refresh, access the stacking view and try again.

[Mufassa4n6]

Can you try to do a manual upload from cli? the 'nighthawk' binary has option flags that let you manually upload without the UI.

Hi BiggiesmallsAG I am having a similar issue not being able to upload mans files using the API. I could not find the 'nighthawk' binary in the bin folder and I searched around elsewhere for it as well.

Do you know where it would be located at?

Thanks!

[roshanmaskey]

Hi Mufassa4n6,

The binaries are located at /opt/nighthawk/bin.

Before running the command below please verify Elasticsearch is running by using command systemctl status elasticsearch.

Verify Elasticsearch is configured to listen on localhost. netstat -an | grep :9200

Syntax for running audit parser is /opt/nighthawk/bin/nh-worker -casename <casename> -computername <computername> -file <triage-file>.

Ping me if you still encounter issue.

[Mufassa4n6]

Thanks 0xredskull the issue ended up being the default 200mb size limit in nginx which I thought I changed but I guess I didn't save it or something.

The commands worked great as well!

On Wed, Dec 19, 2018, 3:10 PM 0xredskull <notifications@github.com wrote:

Hi Mufassa4n6,

The binaries are located at /opt/nighthawk/bin.

Before running the command below please verify Elasticsearch is running by using command systemctl status elasticsearch.

Verify Elasticsearch is configured to listen on localhost. netstat -an | grep :9200

Syntax for running audit parser is /opt/nighthawk/bin/nh-worker -casename -computername

-file . Ping me if you still encounter issue. — You are receiving this because you commented. Reply to this email directly, view it on GitHub , or mute the thread .