socfortress / CoPilot

SOCFortress CoPilot
https://www.socfortress.co
GNU Affero General Public License v3.0
155 stars 25 forks source link

Process Analysis Feature Not Working #255

Closed 0lIvIa09 closed 1 week ago

0lIvIa09 commented 1 week ago

Describe the bug The process analysis paid feature doesn't seem to work for me on any of my alerts. When I click on the value under 'process_name' I receive an error seen in the screenshot below. I am on the latest version of Copilot.

To Reproduce Steps to reproduce the behavior:

  1. Go to the 'SOC' tab
  2. Click on 'Alerts'
  3. Click an alert
  4. See 'process_name' field under 'Context' tab
  5. Click on the value

Expected behavior Evaluation of the process

Screenshots Alert: image

Error message: image

taylorwalton commented 1 week ago

fixed in https://github.com/socfortress/CoPilot/commit/1468a825c40b1aeee3f8e37913925e0fc736fcb3

0lIvIa09 commented 1 week ago

Sorry to be a pain, but I'm still having this issue after pulling the latest images. Here are the logs from the backend.

2024-06-28 11:31:33.733 | INFO | app.db.db_session:get_db_session:181 - DB session created 2024-06-28 11:31:33.734 | INFO | app.threat_intel.routes.socfortress:process_name_intel_socfortress:112 - Running SOCFortress Process Name Analysis. Grabbing License 2024-06-28 11:31:33.737 | INFO | app.threat_intel.services.socfortress:invoke_socfortress_process_name_api:171 - Invoking Socfortress Process Name Analysis with params: {'value': 'C:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD.EXE'} and headers: {'module-version': 'your_module_version', 'x-api-key': 'XXXXX-XXXXX-XXXXX-XXXXX'} and url: https://processname.socfortress.co/search 2024-06-28 11:31:34.333 | ERROR | app.db.db_session:get_db_session:185 - Error during DB session: Expecting value: line 1 column 1 (char 0) 2024-06-28 11:31:34.335 | INFO | app.db.db_session:get_db_session:189 - Closing DB session

The alert, which was newly created after updating. image