TheHiveDocs TheHive4 mailer responder issue

Hi guys,

I had issues getting the mailer responder work as intended. The phish feedback v1.0 also do not work as designed. Anyone have had similar issues and get it fixed and mind share the solutions ? Much appreciated with the help! Thanks

Oct 21 '20 09:10 viszsec

Hello,

the issue for us on a modified version of the mailer responder was due to the way TheHive4 automatically transform case tags. from mail:[email protected] to mail="[email protected]".

Because of that the responder was not able to find the mail address

https://github.com/TheHive-Project/Cortex-Analyzers/blob/master/responders/Mailer/mailer.py

Line 43 : mail_tags = [t[5:] for t in tags if t.startswith("mail:")]

Has to be replaced by:

mail_tags = [t[5:].strip('"') for t in tags if t.startswith('mail:') or t.startswith('mail=')]

regards,

Emilien

Oct 22 '20 08:10 kwouffe

Hi Emilien,

With this replacement, mail_tags = [t[5:].strip('"') for t in tags if t.startswith('mail:') or t.startswith('mail=')]

You got it work on your end?

Oct 28 '20 08:10 viszsec

Yes, it worked for us. but as I said it is a modified version of the responder. Can you put here the full error msg from Cortex ?

Oct 28 '20 08:10 kwouffe

I modified as what you advised and got this error:.. in my case i use gmail account to send an email to the recipient which is already been set.

Traceback (most recent call last): File "/opt/Cortex-Analyzers/responders/Mailer/mailer.py", line 82, in Mailer().run() File "/opt/Cortex-Analyzers/responders/Mailer/mailer.py", line 61, in run s = smtplib.SMTP(self.smtp_host, self.smtp_port) File "/usr/lib/python3.8/smtplib.py", line 253, in init (code, msg) = self.connect(host, port) File "/usr/lib/python3.8/smtplib.py", line 341, in connect (code, msg) = self.getreply() File "/usr/lib/python3.8/smtplib.py", line 398, in getreply raise SMTPServerDisconnected("Connection unexpectedly closed")smtplib.SMTPServerDisconnected: Connection unexpectedly closed

Oct 30 '20 05:10 viszsec

Yes, it worked for us. but as I said it is a modified version of the responder. Can you put here the full error msg from Cortex ?

Another one , this one is pretty odd.. i setup everything in the config as it supposed to be and got this error:

Missing auth pass

Nov 09 '20 07:11 viszsec