mushorg / conpot

ICS/SCADA honeypot
GNU General Public License v2.0
1.22k stars 413 forks source link

Conpot STIX logging error #485

Open sehrixhshafeeq opened 4 years ago

sehrixhshafeeq commented 4 years ago

I want to create stix of conpot logs. To do so, I have enabled taxi in the testing.cfg. But enabling taxi generated following errors in the conpot.

/usr/local/lib/python3.6/dist-packages/stix/utils/deprecated.py:48: UserWarning: The use of this field has been deprecated. Received 'str' object.
  warnings.warn(msg)
/usr/local/lib/python3.6/dist-packages/stix/utils/deprecated.py:48: UserWarning: The use of this field has been deprecated. Received 'StructuredTextList' object.
  warnings.warn(msg)

Traceback (most recent call last):
  File "src/gevent/greenlet.py", line 766, in gevent._greenlet.Greenlet.run
  File "/usr/local/lib/python3.6/dist-packages/conpot-0.6.0-py3.6.egg/conpot/core/loggers/log_worker.py", line 141, in start
    self.taxii_logger.log(event)
  File "/usr/local/lib/python3.6/dist-packages/conpot-0.6.0-py3.6.egg/conpot/core/loggers/taxii_log.py", line 43, in log
    stix_package = self.stix_transformer.transform(event)
  File "/usr/local/lib/python3.6/dist-packages/conpot-0.6.0-py3.6.egg/conpot/core/loggers/stix_transform.py", line 83, in transform
    incident = Incident(id_="%s:%s-%s" % (CONPOT_NAMESPACE, 'incident', event['session_id']))
KeyError: 'session_id'
2020-04-30T11:31:49Z <Greenlet at 0x7fa2dae04148: <bound method LogWorker.start of <conpot.core.loggers.log_worker.LogWorker object at 0x7fa2e2eb92b0>>> failed with KeyError

ERROR:root:Stopping because <Greenlet at 0x7fa2dae04148: <bound method LogWorker.start of <conpot.core.loggers.log_worker.LogWorker object at 0x7fa2e2eb92b0>>> died: 'session_id'
NoneType: None
2020-04-30 11:31:49,146 Stopping because <Greenlet at 0x7fa2dae04148: <bound method LogWorker.start of <conpot.core.loggers.log_worker.LogWorker object at 0x7fa2e2eb92b0>>> died: 'session_id'
NoneType: None
2020-04-30 11:31:49,146 Shutting down File System. Cleaning directories at /usr/local/lib/python3.6/dist-packages/conpot-0.6.0-py3.6.egg/conpot/ConpotTempFS/__conpot__aoufsmx2`