I want to create stix of conpot logs. To do so, I have enabled taxi in the testing.cfg. But enabling taxi generated following errors in the conpot.
/usr/local/lib/python3.6/dist-packages/stix/utils/deprecated.py:48: UserWarning: The use of this field has been deprecated. Received 'str' object.
warnings.warn(msg)
/usr/local/lib/python3.6/dist-packages/stix/utils/deprecated.py:48: UserWarning: The use of this field has been deprecated. Received 'StructuredTextList' object.
warnings.warn(msg)
Traceback (most recent call last):
File "src/gevent/greenlet.py", line 766, in gevent._greenlet.Greenlet.run
File "/usr/local/lib/python3.6/dist-packages/conpot-0.6.0-py3.6.egg/conpot/core/loggers/log_worker.py", line 141, in start
self.taxii_logger.log(event)
File "/usr/local/lib/python3.6/dist-packages/conpot-0.6.0-py3.6.egg/conpot/core/loggers/taxii_log.py", line 43, in log
stix_package = self.stix_transformer.transform(event)
File "/usr/local/lib/python3.6/dist-packages/conpot-0.6.0-py3.6.egg/conpot/core/loggers/stix_transform.py", line 83, in transform
incident = Incident(id_="%s:%s-%s" % (CONPOT_NAMESPACE, 'incident', event['session_id']))
KeyError: 'session_id'
2020-04-30T11:31:49Z <Greenlet at 0x7fa2dae04148: <bound method LogWorker.start of <conpot.core.loggers.log_worker.LogWorker object at 0x7fa2e2eb92b0>>> failed with KeyError
ERROR:root:Stopping because <Greenlet at 0x7fa2dae04148: <bound method LogWorker.start of <conpot.core.loggers.log_worker.LogWorker object at 0x7fa2e2eb92b0>>> died: 'session_id'
NoneType: None
2020-04-30 11:31:49,146 Stopping because <Greenlet at 0x7fa2dae04148: <bound method LogWorker.start of <conpot.core.loggers.log_worker.LogWorker object at 0x7fa2e2eb92b0>>> died: 'session_id'
NoneType: None
2020-04-30 11:31:49,146 Shutting down File System. Cleaning directories at /usr/local/lib/python3.6/dist-packages/conpot-0.6.0-py3.6.egg/conpot/ConpotTempFS/__conpot__aoufsmx2`
I want to create stix of conpot logs. To do so, I have enabled
taxi
in thetesting.cfg
. But enabling taxi generated following errors in the conpot.