[RST Cloud - Threat Feed] The connector seems active, raises no errors, but nothing is imported

[Lhorus6]

Description

The connector seems active, raises no errors, but nothing is imported (no work is even created). It's as if it never does anything.

Environment

OCTI 6.3.6

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Enable the connector and wait
   -> Nothing ever happens

[Lhorus6]

I'll switch the log level to “debug” to see if I can get more information.

I'll update this issue after

UPDATE: Nothing more...

[k1r10n]

Did you specify the API Key? this is the only parameter you need to change to test it. The errors will be in the docker output if no key provided

[Lhorus6]

Hi @k1r10n,

• The referenced API key is the same as the one in the connector for reports (which retrieves data), so I imagine that it is valid.
• The connector is in log level debug and I have no logs.

This is the configuration that I'm currently using (with the correct API key, not "changeme" of course)

[k1r10n]

Please send the Docker logs output to [email protected]. The issue may be related to connectivity within your network. The API returns a temporary link to AWS S3 to get the feed.

docker logs containername

Usually, there are no issues with the connector. Just set the key.

Additionally, consider clearing the state for the connector from the UI. If you see the 'lastrun' with an epoch value in it, the connector will wait for 86400 sec till the next run, so that is why 'nothing happens'. Just in case, after the state is cleared, kill the container so it is rebuilt and see if it helps.