Google Safe Browsing (Update API) NOK

[00yan01]

Hello,

I've an error when i use module threat intelligence Google in FAME :

error: error in threat intelligence module 'Google Safe Browsing (Update API)': HTTPConnectionPool(host='127.0.0.1', port=5000): Max retries exceeded with url: /gglsbl/v4/lookup/ (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7fd3611c32d0>: Failed to establish a new connection: [Errno 111] Connection refused'))

My local gglsbl-rest instance is up but the URL is not found on server. Google API key is ok.

I need some help :) for this topic.

Best regard, Yan

[Augustin-FL]

Hello

[Errno 111] Connection refused

This indicate that FAME was not able to reach the gglsbl-rest instance. This error is different from the 404 you are getting through your web browser (the 404 is actually normal and expected)

Are you running both FAME and gglsbl-rest in docker? if yes you should:

• define an hostname for the container running gglsbl-rest
• make the container run in the FAME network (by default, this network is called backend.fame)

  
  gglsbl-rest:
  image: mlsecproject/gglsbl-rest:v1.5.23
  container_name: fame_gglsbl
  hostname: fame_gglsbl
  volumes:
   - gglsbl:/home/gglsbl/db:Z
  ports:
   - 127.0.0.1:5000:5000
  environment:
   - GSB_API_KEY=<KEY>
  networks:
    - backend.fame

FAME should now be able to access http://fame_gglsbl:5000/gglsbl/v1/lookup/

Also: it's not related, but for information, according to gglsbl documentation the URI to query is `/gglsbl/v1/lookup/`, not `/gglsbl/v4/lookup/`.

[Augustin-FL]

Can I close this issue?

[00yan01]

Hi Augustin,

thanks for you rmessage. You can close this.