{"action":"created","issue":{"url":"https://api.github.com/repos/TheHive-Project/Cortex-Analyzers/issues/331","repository_url":"https://api.github.com/repos/TheHive-Project/Cortex-Analyzers","labels_url":"https://api.github.com/repos/TheHive-Project/Cortex-Analyzers/issues/331/labels{/name}","comments_url":"https://api.github.com/repos/TheHive-Project/Cortex-Analyzers/issues/331/comments","events_url":"https://api.github.com/repos/TheHive-Project/Cortex-Analyzers/issues/331/events","html_url":"https://github.com/TheHive-Project/Cortex-Analyzers/issues/331","id":348372309,"node_id":"MDU6SXNzdWUzNDgzNzIzMDk=","number":331,"title":"Cortex Responder - Invalid Output","user":{"login":"jordisk","id":6075650,"node_id":"MDQ6VXNlcjYwNzU2NTA=","avatar_url":"https://avatars0.githubusercontent.com/u/6075650?v=4","gravatar_id":"","url":"https://api.github.com/users/jordisk","html_url":"https://github.com/jordisk","followers_url":"https://api.github.com/users/jordisk/followers","following_url":"https://api.github.com/users/jordisk/following{/other_user}","gists_url":"https://api.github.com/users/jordisk/gists{/gist_id}","starred_url":"https://api.github.com/users/jordisk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jordisk/subscriptions","organizations_url":"https://api.github.com/users/jordisk/orgs","repos_url":"https://api.github.com/users/jordisk/repos","events_url":"https://api.github.com/users/jordisk/events{/privacy}","received_events_url":"https://api.github.com/users/jordisk/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-08-07T15:26:47Z","updated_at":"2018-08-16T21:10:05Z","closed_at":null,"author_association":"NONE","body":"# Cortex Responder - Invalid Output\r\n\r\nI'm trying to write a simple responder using the latest version of cortex (2.1.0-RC1\r\nBased on Mailer responder, I wrote the following code:\r\n\r\n```\r\nfrom cortexutils.responder import Responder\r\nclass Sigmaexport(Responder):\r\n    def __init__(self):\r\n        Responder.__init__(self)\r\n        #My code\r\n        self.thehive_apiurl = self.get_param(\r\n            'config.thehive_apiurl', None, 'Missing api URL')\r\n        self.thehive_apikey = self.get_param(\r\n            'config.thehive_apikey', None, 'Missing api key')\r\n\r\n    def run(self):\r\n        #Responder.run(self)\r\n        title = self.get_param('data.title', None, 'title is missing')\r\n        description = self.get_param('data.description', None, 'description is missing')\r\n        if self.data_type == 'thehive:case':\r\n            self.report({'message': 'messageOK'})\r\n        else:\r\n            self.error('Invalid dataType')\r\n\r\n    def operations(self, raw):\r\n        return [self.build_operation('AddTagToCase', tag='responderOK')]\r\nif __name__ == '__main__':\r\n    Sigmaexport().run()\r\n```\r\n\r\n\r\nAnd Json file has the following code:\r\n```\r\n{\r\n  \"name\": \"SigmaExport\",\r\n  \"version\": \"0.1\",\r\n  \"author\": \"jordisk\",\r\n  \"url\": \"https://github.com/Jordisk\",\r\n  \"license\": \"AGPL-V3\",\r\n  \"description\": \"Export Observables in SIGMA Rule format\",\r\n  \"dataTypeList\": [\"thehive:case\", \"thehive:alert\"],\r\n  \"command\": \"SigmaExport/sigmaexport.py\",\r\n  \"baseConfig\": \"SigmaExport\",\r\n  \"configurationItems\": [\r\n    {\r\n      \"name\": \"thehive_apiurl\",\r\n      \"description\": \"URL of your The Hive instance (including port)\",\r\n      \"type\": \"string\",\r\n      \"multi\": false,\r\n      \"required\": true,\r\n      \"defaultValue\": \"http://localhost:9000/api\"\r\n    },\r\n    {\r\n      \"name\": \"thehive_apikey\",\r\n      \"description\": \"API Key to get obserbables from a case\",\r\n      \"type\": \"string\",\r\n      \"multi\": false,\r\n      \"required\": true\r\n    }\r\n  ]\r\n}\r\n```\r\n\r\nNew responder is detected by cortex and I've setup the url and api key, but when running the responder in case on The Hive, it fails.\r\n\r\nHere the info From the cortex Job:\r\n\r\n## Input\r\n```\r\n{\r\n  \"customFields\": {},\r\n  \"pap\": 2,\r\n  \"metrics\": {},\r\n  \"createdBy\": \"jvazquez\",\r\n  \"flag\": false,\r\n  \"caseId\": 4,\r\n  \"status\": \"Open\",\r\n  \"createdAt\": 1533630826133,\r\n  \"owner\": \"jvazquez\",\r\n  \"severity\": 2,\r\n  \"title\": \"ips\",\r\n  \"tlp\": 2,\r\n  \"startDate\": 1533630780000,\r\n  \"description\": \"case for testing\",\r\n  \"updatedBy\": \"jvazquez\",\r\n  \"updatedAt\": 1533655233899,\r\n  \"_type\": \"case\",\r\n  \"_routing\": \"AWUThUdGDIAO2ONGHUtQ\",\r\n  \"_parent\": null,\r\n  \"_id\": \"AWUThUdGDIAO2ONGHUtQ\",\r\n  \"_version\": 3,\r\n  \"id\": \"AWUThUdGDIAO2ONGHUtQ\"\r\n}\r\n```\r\n\r\n## Report\r\n```\r\n{\r\n  \"errorMessage\": \"Invalid output\\n\",\r\n  \"input\": null,\r\n  \"success\": false\r\n}\r\n```\r\n\r\n\r\nAny idea regarding where might be the problem?\r\n\r\nI've tried with cortexutils 1.2.4 and 1.3.0 without any success\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/TheHive-Project/Cortex-Analyzers/issues/comments/413685799","html_url":"https://github.com/TheHive-Project/Cortex-Analyzers/issues/331#issuecomment-413685799","issue_url":"https://api.github.com/repos/TheHive-Project/Cortex-Analyzers/issues/331","id":413685799,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMzY4NTc5OQ==","user":{"login":"jordisk","id":6075650,"node_id":"MDQ6VXNlcjYwNzU2NTA=","avatar_url":"https://avatars0.githubusercontent.com/u/6075650?v=4","gravatar_id":"","url":"https://api.github.com/users/jordisk","html_url":"https://github.com/jordisk","followers_url":"https://api.github.com/users/jordisk/followers","following_url":"https://api.github.com/users/jordisk/following{/other_user}","gists_url":"https://api.github.com/users/jordisk/gists{/gist_id}","starred_url":"https://api.github.com/users/jordisk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jordisk/subscriptions","organizations_url":"https://api.github.com/users/jordisk/orgs","repos_url":"https://api.github.com/users/jordisk/repos","events_url":"https://api.github.com/users/jordisk/events{/privacy}","received_events_url":"https://api.github.com/users/jordisk/received_events","type":"User","site_admin":false},"created_at":"2018-08-16T21:10:05Z","updated_at":"2018-08-16T21:10:05Z","author_association":"NONE","body":"Yes, the script has a executable flag set. Updated the initial post with full code (just added the first two lines)\r\n```\r\n#!/usr/bin/env python3\r\n# encoding: utf-8\r\n```\r\n\r\nAlso, I've tested with python3 and python (2) and I got the same error."}}
{"actor":{"display_login":"jordisk"}}