search

emalderson / ThePhish

ThePhish: an automated phishing email analysis tool
GNU Affero General Public License v3.0
1.13k stars 174 forks source link

[Question] #8

Closed janjaom closed 2 years ago

janjaom commented 2 years ago

Work environment

Question Answer
Python version 3.8
ThePhish version Latest
TheHive version 4.1.9-1
Cortex version 3.1.1-1

Question

Hello, I had other issue after phase notification mail sent, appear a error about [run_analysis] with something Cortex Job Id

[INFO]_[runanalysis]: Notification mail sent [ERROR][run_analysis]: Error during the analysis task: Traceback (most recent call last): File "/opt/ThePhish/app/run_analysis.py", line 576, in main observables_info, reports_observables = analyze_observables(case, task_ids['Analysis'], wsl) File "/opt/ThePhish/app/run_analysis.py", line 240, in analyze_observables job['job_id'] = analyzer_job.json()['cortexJobId'] KeyError: 'cortexJobId'

Have some idea about this?

emalderson commented 2 years ago

Hello, this problem has already been encountered and solved in a previous issue #2, so please make sure that you read the previous issues before opening a new one. Anyway, the problem seems to be related with an incorrect configuration of the interaction between TheHive and Cortex. Again, make sure you have thoroughly understood the steps highlighted in the configuration and installation guide before proceeding. Possible mistakes may be in the configuration of the ID or the API KEY of Cortex in the configuration file used by ThePhish. The former can be found in the file "application.conf" of TheHive, while the second must be created on the Cortex web interface.

janjaom commented 2 years ago

All right now! I identified this problem, the id from cortex was wrong, I seeked this Cortex id and I found this information on screen "about" in The Hive.