Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CrowdStrike] 'NoneType' object cannot be interpreted as an integer #3275

Closed
dominictory opened this issue Jan 14, 2025 · 1 comment
Closed
Labels
bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team

Comments

@dominictory
Copy link

Description

We are seeing the below error constantly (4-5 messages per minute) with CrowdStrike:

'NoneType' object cannot be interpreted as an integer

It appears no work is being done with this connector whilst seeing these messages as it shows INACTIVE. Connector was working a few days ago (10/1/25) and no modifications have been made since.

Environment

6.4.6

Reproducible Steps

connector-crowdstrike:
    image: opencti/connector-crowdstrike:${OPENCTI_VERSION}
    environment:
      - OPENCTI_URL=http://opencti-connector:8080
      - OPENCTI_TOKEN=247e6c24-970e-4f20-89ab-3d3c780969bf
      - CONNECTOR_ID=5f00b533-db94-4326-a5c7-d915257d5f83
      - CONNECTOR_NAME=CrowdStrike
      - CONNECTOR_SCOPE=crowdstrike
      - CONNECTOR_LOG_LEVEL=error
      - CONNECTOR_DURATION_PERIOD=PT30M
      - CROWDSTRIKE_BASE_URL=https://api.eu-1.crowdstrike.com
      - CROWDSTRIKE_CLIENT_ID=redacted
      - CROWDSTRIKE_CLIENT_SECRET=redacted
      - CROWDSTRIKE_TLP=AMBER
      - CROWDSTRIKE_CREATE_OBSERVABLES=true
      - CROWDSTRIKE_CREATE_INDICATORS=true
      - CROWDSTRIKE_SCOPES=actor
      - CROWDSTRIKE_ACTOR_START_TIMESTAMP=0
      - CROWDSTRIKE_REPORT_START_TIMESTAMP=0
      - CROWDSTRIKE_REPORT_STATUS=New
      - CROWDSTRIKE_REPORT_INCLUDE_TYPES=notice,tipper,intelligence report,periodic report
      - CROWDSTRIKE_REPORT_TYPE=threat-report
      - CROWDSTRIKE_REPORT_GUESS_MALWARE=true
    restart: always

Expected Output

Connector ingests CrowdStrike data.

Actual Output

Nothing except error message.

@dominictory dominictory added bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team labels Jan 14, 2025
@dominictory
Copy link
Author

even though we only import crowdstrike actors (with scope defined as such), we still had to include the rest of the connector's config for indicators, reports, for the connector to work

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team
Projects
None yet
Development

No branches or pull requests

1 participant