mcholste / elsa

Enterprise Log Search and Archive
GNU General Public License v2.0
207 stars 51 forks source link

Upgrade Sandbox Connector from 1.0 to 1.5 #42

Open SkiTheSlicer opened 8 years ago

SkiTheSlicer commented 8 years ago

When using Result Options -> Send to connector -> Send to malware analysis sandbox, I get no pop-ups, but the following in '/nsm/elsa/data/elsa/log/web.log' (I'm hand-typing the messages because the server is currently air-gapped):

* DEBUG [2016/07/28 18:29:12] /opt/elsa/web/lib/Controller.pm (2201) Controller::_send_to 55264 [undef]
loading plugin Connector::Sandbox
* ERROR [2016/07/28 18:29:12] /opt/elsa/web/lib/Controller.pm (2263) Controller::_send_to 55264 [undef]
Error creating plugin Connector::Sandbox with data $VAR1 = bless( {
<snip>
: Can't locate object method "api" via package "Connector::Sandbox" at /opt/elsa/web/lib/Connector/Sandbox.pm line 19.

When using Info -> Plugin -> Send to Sandbox, I receive a pop-up with a title of 'Error' and message of 'Send failed' and get the following in '/nsm/elsa/data/elsa/log/web.log':

* DEBUG [2016/07/28 18:47:35] /opt/elsa/web/lib/View.pm (380) View::_send_to 58803 [undef]
Decoded HASH(0x56413aeb1148) as : $VAR1 = {
<SNIP>
* DEBUG [2016/07/28 18:47:35] /opt/elsa/web/lib/QueryParser.pm (447) QueryParser::_parse_qury 58803 [undef]
<SNIP>
* DEBUG [2016/07/28 18:47:35] /opt/elsa/web/lib/QueryParser.pm (233) QueryParser::parse 58803 [undef]
<SNIP>
* DEBUG [2016/07/28 18:47:35] /opt/elsa/web/lib/Query.pm (174) BUILD 58803 [undef]
Received query with qid 40 at 1469731655
* ERROR [2016/07/28 18:47:35] /opt/elsa/web/lib/View.pm (161) View::catch {...} 58803 [undef]
Not an ARRAY reference at /opt/elsa/web/lib/Results.pm line 89.

I made the following configuration update to /etc/elsa_web.conf and restarted apache2:

{
<snip>
  "connectors": {
    "sandbox": {
      "site": "192.168.10.24",
      "url": "http://192.168.10.24:8090/tasks/create/file"
    }
  },
<snip>
}

FYI: I'm currently running off the Security Onion ISO 14.04.4.1, ELSA Rev 1205.