connectors icon indicating copy to clipboard operation
connectors copied to clipboard

Qradar-Connector Deprecated API

Open Alib333 opened this issue 1 year ago • 3 comments

The URL used in the qradar connector script is pointing to a deprecated qradar API.

Environment

  1. OS (where OpenCTI server runs): Ubuntu 20.04.6
  2. OpenCTI version: OpenCTI 6.1.0
  3. OpenCTI client: 6.1.0
  4. Other environment details: qradar-connector:6.1.0

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Configure docker-compose.yml
  2. configure and export env variables
  3. run: docker stack deploy ...
  4. create a live stream in data sharing
  5. Configure and run the qradar-connector

Expected Output

Reference Set should be created on qradar.

Actual Output

Container keeps restarting and giving this error:

{"timestamp": "2024-05-14T11:31:37.874929Z", "level": "ERROR", "name": "OpenCTI QRADAR Connector", "message": "an error occurred while consuming messages", "exc_info": "Traceback (most recent call last):\n File "/opt/opencti-connector-qradar/qradar.py", line 175, in consume\n self._consume()\n File "/opt/opencti-connector-qradar/qradar.py", line 196, in consume\n self.qradar_reference.create(id, payload)\n File "/opt/opencti-connector-qradar/qradar.py", line 62, in create\n f"{self.collection_url}{self.get_type(payload)}",\n ^^^^^^^^^^^^^^^^^^^^^^\n File "/opt/opencti-connector-qradar/qradar.py", line 49, in get_type\n ).group(1)\n ^^^^^\nAttributeError: 'NoneType' object has no attribute 'group'"} {"timestamp": "2024-05-14T11:31:37.875405Z", "level": "ERROR", "name": "OpenCTI QRADAR Connector", "message": "an error occurred while consuming messages", "exc_info": "Traceback (most recent call last):\n File "/opt/opencti-connector-qradar/qradar.py", line 175, in consume\n self._consume()\n File "/opt/opencti-connector-qradar/qradar.py", line 196, in consume\n self.qradar_reference.create(id, payload)\n File "/opt/opencti-connector-qradar/qradar.py", line 62, in create\n f"{self.collection_url}{self.get_type(payload)}",\n ^^^^^^^^^^^^^^^^^^^^^^\n File "/opt/opencti-connector-qradar/qradar.py", line 49, in get_type\n ).group(1)\n ^^^^^\nAttributeError: 'NoneType' object has no attribute 'group'"} {"timestamp": "2024-05-14T11:31:37.875628Z", "level": "ERROR", "name": "OpenCTI QRADAR Connector", "message": "'NoneType' object has no attribute 'group'", "exc_info": "Traceback (most recent call last):\n File "/opt/opencti-connector-qradar/qradar.py", line 175, in consume\n self._consume()\n File "/opt/opencti-connector-qradar/qradar.py", line 196, in consume\n self.qradar_reference.create(id, payload)\n File "/opt/opencti-connector-qradar/qradar.py", line 62, in create\n f"{self.collection_url}{self.get_type(payload)}",\n ^^^^^^^^^^^^^^^^^^^^^^\n File "/opt/opencti-connector-qradar/qradar.py", line 49, in get_type\n ).group(1)\n ^^^^^\nAttributeError: 'NoneType' object has no attribute 'group'"}

Additional information

I have observed that the api url used in the python script is pointing to a deprecated version: Actual URL in the script: /reference_data/sets (Deprecated) The new value: /reference_data_collections/sets

I don't know if this have anything to do with the issue I am getting, but I think it might be the problem.

Screenshots (optional)

deprecate

Alib333 avatar May 14 '24 11:05 Alib333

Yes the API url is outdated. I had to modify it to the current version to get it running.

timebotdon avatar May 15 '24 10:05 timebotdon

@timebotdon does it mean you can provide a fix for this?

nino-filigran avatar May 16 '24 07:05 nino-filigran

Hello @Alib333 and @timebotdon In fact, the API request is deprecated, I will update it with the new value. ;)

Megafredo avatar May 16 '24 09:05 Megafredo