Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Tanium Intel] Connector is crashing on YARA rule creation #3591

Closed
SamuelHassine opened this issue Mar 8, 2025 · 0 comments
Closed

[Tanium Intel] Connector is crashing on YARA rule creation #3591

SamuelHassine opened this issue Mar 8, 2025 · 0 comments
Assignees
Labels
bug use for describing something not working as expected filigran support [optional] use to identify an issue related to feature developed & maintained by Filigran. filigran team use to identify PR from the Filigran team solved use to identify issue that has been solved (must be linked to the solving PR)
Milestone

Comments

@SamuelHassine
Copy link
Member

Description

[Tanium Intel] Connector is crashing on YARA rule creation

I've tried to push YARA rules in Tanium Threat Response, making the connector crashing with the following stack trace:

{"timestamp": "2025-03-08T17:29:43.503105Z", "level": "ERROR", "name": "Tanium Threat Response Intel", "message": "Error in ListenStream loop, exit.", "exc_info": "Traceback (most recent call last):\n  File \"/usr/local/lib/python3.12/site-packages/pycti/connector/opencti_connector_helper.py\", line 658, in run\n    self.callback(msg)\n  File \"/opt/opencti-connector-tanium-intel/tanium_intel_connector/connector.py\", line 125, in process_message\n    self._handle_create_event(data)\n  File \"/opt/opencti-connector-tanium-intel/tanium_intel_connector/connector.py\", line 72, in _handle_create_event\n    self.intel_manager.create_intel_from_indicator(data)\n  File \"/opt/opencti-connector-tanium-intel/tanium_intel_connector/intel_manager.py\", line 97, in create_intel_from_indicator\n    intel_document = self.tanium_api_handler.create_indicator_yara(indicator)\n                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/opt/opencti-connector-tanium-intel/tanium_intel_connector/api_handler.py\", line 152, in create_indicator_yara\n    \"description\": entity[\"description\"].replace(\"\\n\", \" \").strip(),\n                   ~~~~~~^^^^^^^^^^^^^^^\nKeyError: 'description'", "taskName": null, "attributes": {"reason": "'description'"}}
@SamuelHassine SamuelHassine added bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team filigran team use to identify PR from the Filigran team filigran support [optional] use to identify an issue related to feature developed & maintained by Filigran. labels Mar 8, 2025
@SamuelHassine SamuelHassine added this to the Release 6.5.5 milestone Mar 8, 2025
@SamuelHassine SamuelHassine removed the needs triage use to identify issue needing triage from Filigran Product team label Mar 8, 2025
@SamuelHassine SamuelHassine self-assigned this Mar 8, 2025
@SamuelHassine SamuelHassine added the solved use to identify issue that has been solved (must be linked to the solving PR) label Mar 8, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug use for describing something not working as expected filigran support [optional] use to identify an issue related to feature developed & maintained by Filigran. filigran team use to identify PR from the Filigran team solved use to identify issue that has been solved (must be linked to the solving PR)
Projects
None yet
Development

No branches or pull requests

1 participant