Thehive: Cortex Connection failing, showing red with unknown version.

Created on 9 May 2018  Â·  24Comments  Â·  Source: TheHive-Project/TheHive

Hive failing to connect to Cortex

Running in Docker with Docker compose

Request Type

Assistance/Help

Work Environment

| Question | Answer
|---------------------------|--------------------
| OS version (server) | Rhel 7,4
| OS version (client) | win 10
| TheHive version / git hash | 3.09
| Package Type | Docker

Problem Description

The hive is not successfully connecting to cortex in a docker-compose configuration. I have added the compose.yml file below, the sections for hive's application.conf and some logs pulled from the docker image.
On a side note, i also cannot get the hive docker container to talk to or see a dedicated MISP instance (non docker). Cortex (docker) can talk to the same misp instance.

capture

Complementary information

__docker-compose.yml__

version: "2"
services:
    elasticsearch:
        image: docker.elastic.co/elasticsearch/elasticsearch:5.5.2
        restart: always
        environment:
            - cluster.name=hive
            - bootstrap.memory_lock=true
            - xpack.security.enabled=false
            - thread_pool.index.queue_size=100000
            - thread_pool.search.queue_size=100000
            - thread_pool.bulk.queue_size=100000
            - script.inline=true
            - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
        ulimits:
            nofile:
                soft: 65536
                hard: 65536
            memlock:
                soft: -1
                hard: -1
        volumes:
            - esdata:/usr/share/elasticearch/data
        networks:
            - hivestack

    cortex:
        image: certbdf/cortex:latest
        restart: always
        ports:
            - "9001:9001"
        depends_on:
            - elasticsearch
        networks:
            - hivestack
        volumes:
            - ./cortex/application.conf:/etc/cortex/application.conf

    thehive:
        image: certbdf/thehive:latest
        restart: always
        ports:
            - "9000:9000"
        depends_on:
            - elasticsearch
            - cortex
        networks:
            - hivestack
        volumes:
            - ./thehive/application.conf:/etc/thehive/application.conf
networks:
    hivestack:
        driver: bridge
volumes:
    esdata:

theHive application.conf sections for Cortex and MISP:

## Enable the Cortex module
play.modules.enabled += connectors.cortex.CortexConnector
cortex {
  "Cortex1" {
    # URL of the Cortex server
    url = "cortex:9001"
    key="*********************"
   }
}
## Enable the MISP module
play.modules.enabled += connectors.misp.MispConnector
misp {
  "<MispServerName>" {
    # URL of the MISP server
    url = "http://<mispurl>"
    # authentication key
    key = "*********************"
    # tags that must be automatically added to the case corresponding to the imported event
    tags = ["MISP"]
    # truststore configuration using "cert" key is deprecated
    #cert = /path/to/truststore.jsk
    caseTemplate = "MISP"
    # HTTP client configuration, more details in section 8
    # ws {
    #   proxy {}
    #   ssl {}
    # }
  }
  # Interval between two MISP event import in hours (h) or minutes (m)
  interval = 1h
}

Logs from application.conf. This is only a subset of logs, can pull more if helpful.

2018-05-09 13:00:30,134 [INFO] from org.elastic4play.ErrorHandler in application-akka.actor.default-dispatcher-135 - GET /api/user/current returned 401
org.elastic4play.AuthenticationError: Authentication failure
        at org.elastic4play.controllers.Authenticated.$anonfun$getContext$4(Authenticated.scala:220)
        at scala.concurrent.Future.$anonfun$flatMap$1(Future.scala:304)
        at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:37)
        at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:60)
        at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55)
        at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:91)
        at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:12)
        at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:81)
        at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:91)
        at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:40)
        at akka.dispatch.ForkJoinExecutorConfigurator$AkkaForkJoinTask.exec(ForkJoinExecutorConfigurator.scala:43)
        at akka.dispatch.forkjoin.ForkJoinTask.doExec(ForkJoinTask.java:260)
        at akka.dispatch.forkjoin.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1339)
        at akka.dispatch.forkjoin.ForkJoinPool.runWorker(ForkJoinPool.java:1979)
        at akka.dispatch.forkjoin.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:107)
2018-05-09 13:05:34,967 [ERROR] from connectors.cortex.services.CortexSrv in application-akka.actor.default-dispatcher-190 - Request to Cortex fails
java.net.ConnectException: Connection refused: /172.19.0.3:9000
        at play.shaded.ahc.org.asynchttpclient.netty.channel.NettyConnectListener.onFailure(NettyConnectListener.java:168)
        at play.shaded.ahc.org.asynchttpclient.netty.request.NettyChannelConnector$1.onFailure(NettyChannelConnector.java:103)
        at play.shaded.ahc.org.asynchttpclient.netty.SimpleChannelFutureListener.operationComplete(SimpleChannelFutureListener.java:28)
        at play.shaded.ahc.org.asynchttpclient.netty.SimpleChannelFutureListener.operationComplete(SimpleChannelFutureListener.java:20)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultPromise.notifyListener0(DefaultPromise.java:507)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultPromise.notifyListeners0(DefaultPromise.java:500)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultPromise.notifyListenersNow(DefaultPromise.java:479)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultPromise.notifyListeners(DefaultPromise.java:420)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultPromise.tryFailure(DefaultPromise.java:122)
        at play.shaded.ahc.io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe.fulfillConnectPromise(AbstractNioChannel.java:278)
        at play.shaded.ahc.io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe.finishConnect(AbstractNioChannel.java:294)
        at play.shaded.ahc.io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:634)
        at play.shaded.ahc.io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:581)
        at play.shaded.ahc.io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498)
        at play.shaded.ahc.io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:460)
        at play.shaded.ahc.io.netty.util.concurrent.SingleThreadEventExecutor$2.run(SingleThreadEventExecutor.java:131)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultThreadFactory$DefaultRunnableDecorator.run(DefaultThreadFactory.java:138)
        at java.lang.Thread.run(Thread.java:748)
Caused by: play.shaded.ahc.io.netty.channel.AbstractChannel$AnnotatedConnectException: Connection refused: /172.19.0.3:9000
        at sun.nio.ch.SocketChannelImpl.checkConnect(Native Method)
        at sun.nio.ch.SocketChannelImpl.finishConnect(SocketChannelImpl.java:717)
        at play.shaded.ahc.io.netty.channel.socket.nio.NioSocketChannel.doFinishConnect(NioSocketChannel.java:259)
        at play.shaded.ahc.io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe.finishConnect(AbstractNioChannel.java:291)
        ... 7 common frames omitted
Caused by: java.net.ConnectException: Connection refused
        ... 11 common frames omitted
2018-05-09 13:13:38,696 [ERROR] from org.elastic4play.controllers.Authenticated in application-akka.actor.default-dispatcher-195 - Authentication failure:
        session: AuthenticationError User session not found
        pki: AuthenticationError Certificate authentication is not configured
        key: AuthenticationError Authentication header not found
        basic: AuthenticationError Authentication header not found
        init: AuthenticationError Use of initial user is forbidden because users exist in database
2018-05-09 13:13:38,696 [INFO] from org.elastic4play.ErrorHandler in application-akka.actor.default-dispatcher-195 - GET /api/user/current returned 401
org.elastic4play.AuthenticationError: Authentication failure
        at org.elastic4play.controllers.Authenticated.$anonfun$getContext$4(Authenticated.scala:220)
        at scala.concurrent.Future.$anonfun$flatMap$1(Future.scala:304)
        at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:37)
        at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:60)
        at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55)
        at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:91)
        at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:12)
        at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:81)
        at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:91)
        at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:40)
        at akka.dispatch.ForkJoinExecutorConfigurator$AkkaForkJoinTask.exec(ForkJoinExecutorConfigurator.scala:43)
        at akka.dispatch.forkjoin.ForkJoinTask.doExec(ForkJoinTask.java:260)
        at akka.dispatch.forkjoin.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1339)
        at akka.dispatch.forkjoin.ForkJoinPool.runWorker(ForkJoinPool.java:1979)
        at akka.dispatch.forkjoin.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:107)
2018-05-09 13:14:58,021 [ERROR] from connectors.cortex.services.CortexSrv in application-akka.actor.default-dispatcher-236 - Request to Cortex fails
java.net.ConnectException: Connection refused: /172.19.0.3:9000
        at play.shaded.ahc.org.asynchttpclient.netty.channel.NettyConnectListener.onFailure(NettyConnectListener.java:168)
        at play.shaded.ahc.org.asynchttpclient.netty.request.NettyChannelConnector$1.onFailure(NettyChannelConnector.java:103)
        at play.shaded.ahc.org.asynchttpclient.netty.SimpleChannelFutureListener.operationComplete(SimpleChannelFutureListener.java:28)
        at play.shaded.ahc.org.asynchttpclient.netty.SimpleChannelFutureListener.operationComplete(SimpleChannelFutureListener.java:20)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultPromise.notifyListener0(DefaultPromise.java:507)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultPromise.notifyListeners0(DefaultPromise.java:500)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultPromise.notifyListenersNow(DefaultPromise.java:479)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultPromise.notifyListeners(DefaultPromise.java:420)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultPromise.tryFailure(DefaultPromise.java:122)
        at play.shaded.ahc.io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe.fulfillConnectPromise(AbstractNioChannel.java:278)
        at play.shaded.ahc.io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe.finishConnect(AbstractNioChannel.java:294)
        at play.shaded.ahc.io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:634)
        at play.shaded.ahc.io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:581)
        at play.shaded.ahc.io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498)
        at play.shaded.ahc.io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:460)
        at play.shaded.ahc.io.netty.util.concurrent.SingleThreadEventExecutor$2.run(SingleThreadEventExecutor.java:131)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultThreadFactory$DefaultRunnableDecorator.run(DefaultThreadFactory.java:138)
        at java.lang.Thread.run(Thread.java:748)
Caused by: play.shaded.ahc.io.netty.channel.AbstractChannel$AnnotatedConnectException: Connection refused: /172.19.0.3:9000
        at sun.nio.ch.SocketChannelImpl.checkConnect(Native Method)
        at sun.nio.ch.SocketChannelImpl.finishConnect(SocketChannelImpl.java:717)
        at play.shaded.ahc.io.netty.channel.socket.nio.NioSocketChannel.doFinishConnect(NioSocketChannel.java:259)
        at play.shaded.ahc.io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe.finishConnect(AbstractNioChannel.java:291)
        ... 7 common frames omitted
Caused by: java.net.ConnectException: Connection refused
        ... 11 common frames omitted
docker
Source
picture lostInSpaceSomewhere

Most helpful comment

FIXED: Changed my config map

FROM:

play.modules.enabled += connectors.cortex.CortexConnector

cortex {
"CORTEX-SERVER-ID" {
url = "http://URL:9001"
key = "KEY"

TO:

play.modules.enabled += connectors.cortex.CortexConnector

cortex {
"cortex1" {
url = "http://URL:9001"
key = "KEY"
}

picture romans8 on 28 Mar 2019
👍2

All 24 comments

Shouldn't this be http://cortex:9001?

nadouani picture nadouani on 9 May 2018

ive tried that in the past and did so now. Ran a docker-compose stop thehive, then docker-compose start thehive. Still same issues.
also ran docker-compose stop and docker-compose start to stop/start all the services. No luck.

[error] c.c.s.CortexSrv - Request to Cortex fails
java.net.ConnectException: Connection refused: /172.19.0.3:9000
        at play.shaded.ahc.org.asynchttpclient.netty.channel.NettyConnectListener.onFailure(NettyConnectListener.java:168)
        at play.shaded.ahc.org.asynchttpclient.netty.request.NettyChannelConnector$1.onFailure(NettyChannelConnector.java:103)
        at play.shaded.ahc.org.asynchttpclient.netty.SimpleChannelFutureListener.operationComplete(SimpleChannelFutureListener.java:28)
        at play.shaded.ahc.org.asynchttpclient.netty.SimpleChannelFutureListener.operationComplete(SimpleChannelFutureListener.java:20)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultPromise.notifyListener0(DefaultPromise.java:507)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultPromise.notifyListeners0(DefaultPromise.java:500)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultPromise.notifyListenersNow(DefaultPromise.java:479)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultPromise.notifyListeners(DefaultPromise.java:420)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultPromise.tryFailure(DefaultPromise.java:122)
        at play.shaded.ahc.io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe.fulfillConnectPromise(AbstractNioChannel.java:278)
Caused by: play.shaded.ahc.io.netty.channel.AbstractChannel$AnnotatedConnectException: Connection refused: /172.19.0.3:9000
        at sun.nio.ch.SocketChannelImpl.checkConnect(Native Method)
        at sun.nio.ch.SocketChannelImpl.finishConnect(SocketChannelImpl.java:717)
        at play.shaded.ahc.io.netty.channel.socket.nio.NioSocketChannel.doFinishConnect(NioSocketChannel.java:259)
        at play.shaded.ahc.io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe.finishConnect(AbstractNioChannel.java:291)
        at play.shaded.ahc.io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:634)
        at play.shaded.ahc.io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:581)
        at play.shaded.ahc.io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498)
        at play.shaded.ahc.io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:460)
        at play.shaded.ahc.io.netty.util.concurrent.SingleThreadEventExecutor$2.run(SingleThreadEventExecutor.java:131)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultThreadFactory$DefaultRunnableDecorator.run(DefaultThreadFactory.java:138)
Caused by: java.net.ConnectException: Connection refused
        at sun.nio.ch.SocketChannelImpl.checkConnect(Native Method)
        at sun.nio.ch.SocketChannelImpl.finishConnect(SocketChannelImpl.java:717)
        at play.shaded.ahc.io.netty.channel.socket.nio.NioSocketChannel.doFinishConnect(NioSocketChannel.java:259)
        at play.shaded.ahc.io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe.finishConnect(AbstractNioChannel.java:291)
        at play.shaded.ahc.io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:634)
        at play.shaded.ahc.io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:581)
        at play.shaded.ahc.io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498)
        at play.shaded.ahc.io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:460)
        at play.shaded.ahc.io.netty.util.concurrent.SingleThreadEventExecutor$2.run(SingleThreadEventExecutor.java:131)
        at play.shaded.ahc.io.netty.util.concurrent.DefaultThreadFactory$DefaultRunnableDecorator.run(DefaultThreadFactory.java:138)

I dont see anything in the logs stating its trying to connect to misp

lostInSpaceSomewhere picture lostInSpaceSomewhere on 9 May 2018

I feel like its not picking up the application.conf for some reason. i made changes to the cortex url using the fqdn of the host and not the docker container name, and no change including in the logging.
I also changed the auth to ad and no changes occurred including with the authentication.

lostInSpaceSomewhere picture lostInSpaceSomewhere on 10 May 2018

Hi @lostInSpaceSomewhere
Have you solved the problem ? I'm facing exactly the same issue :
screenshot from 2018-06-12 11-46-49

Though it should name my cortex instance "local" instead of "cortex1" like in thehive application.conf.

docker-compose.yml:

version: "2"
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:5.6.0
    environment:
      - http.host=0.0.0.0
      - transport.host=0.0.0.0
      - xpack.security.enabled=false
      - cluster.name=hive
      - script.inline=true
      - thread_pool.index.queue_size=100000
      - thread_pool.search.queue_size=100000
      - thread_pool.bulk.queue_size=100000
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
  cortex:
    image: certbdf/cortex:latest
    depends_on:
      - elasticsearch
    volumes:
      - /home/boulou/thehive/config/cortex/application.conf:/etc/cortex/application.conf:ro
      - /home/boulou/thehive/Cortex-Analyzers/analyzers:/opt/Cortex-Analyzers/analyzers:ro

    ports:
      - "0.0.0.0:9001:9001"
  thehive:
    image: certbdf/thehive:latest
    depends_on:
      - elasticsearch
      - cortex
    volumes:
      - /home/boulou/thehive/config/thehive/application.conf:/etc/thehive/application.conf
    ports:
      - "0.0.0.0:9000:9000"

thehive application.conf : 

## Enable the Cortex module
play.modules.enabled += connectors.cortex.CortexConnector

cortex {
  "local" {
    # URL of the Cortex server.
    url = "http://localhost:9001"
    key = "JzYVok/n2+W0D3xYowfHf0+cs/xQR65W"
  }
}

misp {
  #"MISP-SERVER-ID" {
    # URL of the MISP instance.
    #url = ""

    # Authentication key.
    #key = ""

    # Name of the case template in TheHive that shall be used to import
    # MISP events as cases by default.
    # caseTemplate = "<Template_Name_goes_here>"

    # Tags to add to each observable imported from an event available on
    # this instance.
    #tags = ["misp-server-id"]

    # Truststore to use to validate the X.509 certificate  of  the  MISP
    # instance if the default truststore is not sufficient.

    #ws.ssl.trustManager.stores =  [
    #{
    #  type: "JKS"
    #  path: "/path/to/truststore.jks"
    #}
    #]
  #}

  # Interval between consecutive MISP event  imports  in  hours  (h)  or
  # minutes (m).
  interval = 1h
}

Logs:

thehive_1        | [error] o.e.c.Authenticated - Authentication failure:
thehive_1        |  session: AuthenticationError User session not found
thehive_1        |  pki: AuthenticationError Certificate authentication is not configured
thehive_1        |  key: AuthenticationError Authentication header not found
thehive_1        |  basic: AuthenticationError Authentication header not found
thehive_1        |  init: AuthenticationError Use of initial user is forbidden because users exist in database
thehive_1        | [info] o.e.ErrorHandler - GET /api/user/current returned 401
thehive_1        | org.elastic4play.AuthenticationError: Authentication failure
thehive_1        |  at org.elastic4play.controllers.Authenticated.$anonfun$getContext$4(Authenticated.scala:220)
thehive_1        |  at scala.concurrent.Future.$anonfun$flatMap$1(Future.scala:304)
thehive_1        |  at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:37)
thehive_1        |  at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:60)
thehive_1        |  at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55)
thehive_1        |  at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:91)
thehive_1        |  at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:12)
thehive_1        |  at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:81)
thehive_1        |  at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:91)
thehive_1        |  at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:40)
francoisihry picture francoisihry on 12 Jun 2018

The default port of Cortex has been changed (from 9000 to 9001). I think that this is the cause of the problem.
Remove cortex entry in TheHive application.conf (as it is automatically added by docker entrypoint) and update your docker-compose.yml to add command: --cortex-port 9001 in thehive section:

thehive:
    image: certbdf/thehive:latest
    depends_on:
      - elasticsearch
      - cortex
  command: --cortex-port 9001
 [...]

If you confirm the workaround, I'll fix the docker compose file.

To-om picture To-om on 12 Jun 2018

I have not solved. It feels like the docker container is not reading the config file. I made a few changes that should have been noticeable. There is nothing in the logs that I can see that is helpful.

I gave up for now. Had to move on to a few other things. I’m going to revisit in a week or two.

If u figure it out let me know.

Thank You

On Jun 12, 2018, at 6:01 AM, François Ihry notifications@github.com wrote:

Hi @lostInSpaceSomewhere
Have you solved the problem ? I'm facing exactly the same issue :

Though it should name my cortex instance "local" instead of "cortex1" like in thehive application.conf.

docker-compose.yml:

version: "2"
services:
elasticsearch:
image: docker.elastic.co/elasticsearch/elasticsearch:5.6.0
environment:
- http.host=0.0.0.0
- transport.host=0.0.0.0
- xpack.security.enabled=false
- cluster.name=hive
- script.inline=true
- thread_pool.index.queue_size=100000
- thread_pool.search.queue_size=100000
- thread_pool.bulk.queue_size=100000
ulimits:
nofile:
soft: 65536
hard: 65536
cortex:
image: certbdf/cortex:latest
depends_on:
- elasticsearch
volumes:
- /home/boulou/thehive/config/cortex/application.conf:/etc/cortex/application.conf:ro
- /home/boulou/thehive/Cortex-Analyzers/analyzers:/opt/Cortex-Analyzers/analyzers:ro

ports:
  - "0.0.0.0:9001:9001"

thehive:
image: certbdf/thehive:latest
depends_on:
- elasticsearch
- cortex
volumes:
- /home/boulou/thehive/config/thehive/:/etc/thehive/application.conf
ports:
- "0.0.0.0:9000:9000"
thehive application.conf :

Enable the Cortex module

play.modules.enabled += connectors.cortex.CortexConnector

cortex {
"local" {
# URL of the Cortex server.
url = "http://localhost:9001"
key = "JzYVok/n2+W0D3xYowfHf0+cs/xQR65W"
}
}

misp {
#"MISP-SERVER-ID" {
# URL of the MISP instance.
#url = ""

# Authentication key.
#key = ""

# Name of the case template in TheHive that shall be used to import
# MISP events as cases by default.
# caseTemplate = "<Template_Name_goes_here>"

# Tags to add to each observable imported from an event available on
# this instance.
#tags = ["misp-server-id"]

# Truststore to use to validate the X.509 certificate  of  the  MISP
# instance if the default truststore is not sufficient.

#ws.ssl.trustManager.stores =  [
#{
#  type: "JKS"
#  path: "/path/to/truststore.jks"
#}
#]

#}

# Interval between consecutive MISP event imports in hours (h) or
# minutes (m).
interval = 1h
}
Logs:

thehive_1 | [error] o.e.c.Authenticated - Authentication failure:
thehive_1 | session: AuthenticationError User session not found
thehive_1 | pki: AuthenticationError Certificate authentication is not configured
thehive_1 | key: AuthenticationError Authentication header not found
thehive_1 | basic: AuthenticationError Authentication header not found
thehive_1 | init: AuthenticationError Use of initial user is forbidden because users exist in database
thehive_1 | [info] o.e.ErrorHandler - GET /api/user/current returned 401
thehive_1 | org.elastic4play.AuthenticationError: Authentication failure
thehive_1 | at org.elastic4play.controllers.Authenticated.$anonfun$getContext$4(Authenticated.scala:220)
thehive_1 | at scala.concurrent.Future.$anonfun$flatMap$1(Future.scala:304)
thehive_1 | at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:37)
thehive_1 | at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:60)
thehive_1 | at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55)
thehive_1 | at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:91)
thehive_1 | at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:12)
thehive_1 | at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:81)
thehive_1 | at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:91)
thehive_1 | at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:40)

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or mute the thread.

lostInSpaceSomewhere picture lostInSpaceSomewhere on 12 Jun 2018

Thanks for your help @To-om If I remove the cortex entry from TheHive application.conf, where do I specify the cortex key ?

francoisihry picture francoisihry on 12 Jun 2018

I will give it a during off hours tonight

Thank You

On Jun 12, 2018, at 9:30 AM, To-om notifications@github.com wrote:

The default port of Cortex has been changed (from 9000 to 9001). I think that this is the cause of the problem.
Remove cortex entry in TheHive application.conf (as it is automatically added by docker entrypoint) and update your docker-compose.yml to add command: --cortex-port 9001 in thehive section:

thehive:
image: certbdf/thehive:latest
depends_on:
- elasticsearch
- cortex
command: --cortex-port 9001
[...]
If you confirm the workaround, I'll fix the docker compose file.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or mute the thread.

lostInSpaceSomewhere picture lostInSpaceSomewhere on 12 Jun 2018

Ok I followed @To-om tip and I now get :
screenshot from 2018-06-12 17-41-22

I am still wondering where to specify the cortex user key to use the analyzers, I'll keep you informed @lostInSpaceSomewhere

francoisihry picture francoisihry on 12 Jun 2018

I could not find any docker entrypoint to set the cortex api key.. How do I set it ?

francoisihry picture francoisihry on 12 Jun 2018

Logs : 

thehive_1        | [error] c.c.s.CortexSrv - Request to Cortex fails
thehive_1        | connectors.cortex.services.CortexError: Cortex error on http://172.18.0.3:9001/api/analyzer?range=all (401) 
thehive_1        | {"type":"AuthenticationError","message":"Authentication failure"}
thehive_1        |  at connectors.cortex.services.CortexClient.$anonfun$request$3(CortexClient.scala:55)
thehive_1        |  at scala.util.Success.$anonfun$map$1(Try.scala:251)
thehive_1        |  at scala.util.Success.map(Try.scala:209)
thehive_1        |  at scala.concurrent.Future.$anonfun$map$1(Future.scala:289)
thehive_1        |  at scala.concurrent.impl.Promise.liftedTree1$1(Promise.scala:29)
thehive_1        |  at scala.concurrent.impl.Promise.$anonfun$transform$1(Promise.scala:29)
thehive_1        |  at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:60)
thehive_1        |  at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55)
thehive_1        |  at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:91)
thehive_1        |  at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:12)
francoisihry picture francoisihry on 12 Jun 2018

And even if info shows cortex1, when I want to choose an analyzer there is no cortex server :
screenshot from 2018-06-13 09-34-57

francoisihry picture francoisihry on 13 Jun 2018

I confirm that there is a problem using docker compose with Cortex2 as initialization script can't configure TheHive with Cortex API key. Let me find a solution.

To-om picture To-om on 13 Jun 2018

I managed to get it workin :) I added the --cortex-key arg in the entrypoint and rebuilt the docker image.

francoisihry picture francoisihry on 13 Jun 2018

Here is my fork :
https://github.com/francoisihry/TheHive/blob/master/package/docker/entrypoint

and I add in the docker-compose.yml : 

thehive:
    image: a12023a65f4e 
    depends_on:
      - elasticsearch
      - cortex
    volumes:
      - /home/boulou/thehive/config/thehive/application.conf:/etc/thehive/application.conf
    ports:
      - "0.0.0.0:9000:9000"
    command: --cortex-port 9001 --cortex-key <your Cortex API key>
francoisihry picture francoisihry on 13 Jun 2018

Hello guys,
I have the same problem.
I have added the key in docker-compose file as francoisihry suggested.
Now I am able to call respond from thehive, but under observable I can not call the Analyzer. I can not indicate cortex server.
Also if I select an observable I do not see any respond, however it is visible called at level before.

Any log and/or information to help me to solve the issue will be appreciate :)
Many thanks for the help :)

Ciao

Nymeria1 picture Nymeria1 on 21 Jan 2019
👍1

Selection_122

I have the same issue with @Nymeria1

apigban picture apigban on 19 Mar 2019

Ciao apigban,
I solved the issue checking the type of observable. You are able to see analyzers only if it match with the type of observable.

Nymeria1 picture Nymeria1 on 19 Mar 2019

I am also currently experiencing the unknown version on Hive 3.3 and Cortex 2.1

image

romans8 picture romans8 on 26 Mar 2019

"I am using k8x and mounting the application.conf files with configmaps. Is this change something which can be specified in a config map?"

romans8 picture romans8 on 27 Mar 2019

Cortex Logs:
[error] o.e.c.Authenticated - Authentication failure:
session: AuthenticationError User session not found
pki: AuthenticationError Certificate authentication is not configured
key: AuthenticationError Authentication header not found
init: AuthenticationError Use of initial user is forbidden because users exist in database
[info] o.t.c.s.ErrorHandler - GET /api/user/current returned 401
org.elastic4play.AuthenticationError: Authentication failure
at org.elastic4play.controllers.Authenticated.$anonfun$getContext$4(Authenticated.scala:254)
at scala.concurrent.Future.$anonfun$flatMap$1(Future.scala:303)
at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:37)
at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:60)
at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55)
at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:91)
at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:12)
at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:81)
at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:91)
at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:40)

Hive Logs:
[error] c.c.s.CortexAnalyzerSrv - Request to Cortex fails
connectors.cortex.services.CortexError: Cortex error on http://[IPHERE]:9001/api/analyzer?range=all (401)
{"type":"AuthenticationError","message":"Authentication failure"}
at connectors.cortex.services.CortexClient.$anonfun$request$3(CortexClient.scala:95)
at scala.util.Success.$anonfun$map$1(Try.scala:251)
at scala.util.Success.map(Try.scala:209)
at scala.concurrent.Future.$anonfun$map$1(Future.scala:288)
at scala.concurrent.impl.Promise.liftedTree1$1(Promise.scala:29)
at scala.concurrent.impl.Promise.$anonfun$transform$1(Promise.scala:29)
at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:60)
at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55)
at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:91)
at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:12)

romans8 picture romans8 on 27 Mar 2019

FIXED: Changed my config map

FROM:

play.modules.enabled += connectors.cortex.CortexConnector

cortex {
"CORTEX-SERVER-ID" {
url = "http://URL:9001"
key = "KEY"

TO:

play.modules.enabled += connectors.cortex.CortexConnector

cortex {
"cortex1" {
url = "http://URL:9001"
key = "KEY"
}

romans8 picture romans8 on 28 Mar 2019
👍2

@romans8 This helped me, thank you

rykers84 picture rykers84 on 6 May 2019

I just spent few hours to figure out, that this error can also mean additional, unnecessary bracket, if you're reading this, check twice.

dominik335 picture dominik335 on 10 Jul 2019
Was this page helpful?
0 / 5 - 0 ratings

Related issues

torsolaso picture torsolaso  Â·  6Comments
Xumeiquer picture Xumeiquer  Â·  6Comments
UndecodedFuture picture UndecodedFuture  Â·  5Comments
auslaender6 picture auslaender6  Â·  6Comments
milesflo picture milesflo  Â·  3Comments