search

outflanknl / RedELK

Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
BSD 3-Clause "New" or "Revised" License
2.35k stars 371 forks source link

Cobalt Strike enrichment stacktrace errors #291

Open MarcOverIP opened 1 year ago

MarcOverIP commented 1 year ago

In a special setup I encountered error like the one below. This might have happened due to multiple daemon.py running at the same time. Im not sure. I've also never seen it before. Nor have I a way to troubleshoot this and come to root cause

Just leaving this info here for future reference. If this does not occur in the coming time at other installations, than I'll just drop this issue.

2022-12-09 15:25:20,955 - ERROR - alarm - daemon.py - run_enrichments -- Error running enrichment enrich_csbeacon: 'process' | StackTrace: Traceback (most recent call last):
  File "/usr/share/redelk/bin/daemon.py", line 82, in run_enrichments
    enrich_dict[enrich_module]["result"] = copy.deepcopy(module_class.run())
  File "/usr/share/redelk/bin/modules/enrich_csbeacon/module.py", line 38, in run
    hits = self.enrich_beacon_data()
  File "/usr/share/redelk/bin/modules/enrich_csbeacon/module.py", line 72, in enrich_beacon_data
    initial_beacon_doc, doc, ["host", "implant", "user", "process"]
  File "/usr/share/redelk/bin/modules/enrich_csbeacon/module.py", line 99, in copy_data_fields
    dst["_source"][field] = src["_source"][field]
KeyError: 'process'

2022-12-09 15:25:20,955 - ERROR - alarm - daemon.py - run_enrichments -- 'process'
Traceback (most recent call last):
  File "/usr/share/redelk/bin/daemon.py", line 82, in run_enrichments
    enrich_dict[enrich_module]["result"] = copy.deepcopy(module_class.run())
  File "/usr/share/redelk/bin/modules/enrich_csbeacon/module.py", line 38, in run
    hits = self.enrich_beacon_data()
  File "/usr/share/redelk/bin/modules/enrich_csbeacon/module.py", line 72, in enrich_beacon_data
    initial_beacon_doc, doc, ["host", "implant", "user", "process"]
  File "/usr/share/redelk/bin/modules/enrich_csbeacon/module.py", line 99, in copy_data_fields
    dst["_source"][field] = src["_source"][field]
KeyError: 'process'