Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] EmlParser_1_2 fails to find iocextract library despite it being installed. #871

Closed
Dave-0-0 opened this issue Oct 2, 2020 · 3 comments
Labels
category:bug Issue is related to a bug

Comments

@Dave-0-0
Copy link

Dave-0-0 commented Oct 2, 2020

Describe the bug
A clear and concise description of what the bug is.

  1. I have pulled the latest code from github for the EmlParser_1_2 analyzer. (parse.py, EmlParser.json and requirements.txt files)
    https://github.com/TheHive-Project/Cortex-Analyzers/tree/master/analyzers/EmlParser
  2. ran sudo both pip3 install -r requirements.txt and sudo pip install -r requirements.txt
  3. Restarted Cortex service

The analyzer always fails with:
Invalid output
You are using python-magic, though this module requires file-magic. Disabling magic usage due to incompatibilities.
Traceback (most recent call last):
File "EmlParser/parse.py", line 11, in
import iocextract
ModuleNotFoundError: No module named 'iocextract'

To Reproduce
Steps to reproduce the behavior:

  1. Run the EmlParser_1_2 analyzer from Cortex selecting a valid .eml file

Expected behavior
Analyzer parses the .eml file and gives the result.

Complementary information
If applicable, add screenshots and any additional information that might help explain your problem.

Work environment
thehive-training-3.3.1 training virtual machine

  • Browse type and version: FireFox 81.0 64-bit
  • Cortex version: 2.1.3-1
  • Cortex Analyzer/Responder name: EmlParser
  • Cortex Analyzer/Responder version: 1.2

Possible solutions
If applicable, indicate possible solutions to the problem.

Additional context
Confirmed this module is installed:

thehive@thehive-training:/opt/Cortex-Analyzers/analyzers/EmlParser$ pip3 list | grep iocextract
DEPRECATION: The default format will switch to columns in the future. You can use --format=(legacy|columns) (or define a format=(legacy|columns) in your pip.conf under the [list] section) to disable this warning.
iocextract (1.13.1)

thehive@thehive-training:/opt/Cortex-Analyzers/analyzers/EmlParser$ pip list | grep iocextract
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip, can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support
iocextract 1.13.1
WARNING: You are using pip version 20.1.1; however, version 20.2.3 is available.
You should consider upgrading via the '/usr/bin/python2 -m pip install --upgrade pip' command.

@Dave-0-0 Dave-0-0 added the category:bug Issue is related to a bug label Oct 2, 2020
@garanews
Copy link
Contributor

garanews commented Oct 5, 2020

Just downloaded what I suppose you are running: https://github.com/TheHive-Project/TheHiveDocs/blob/master/training-material.md#previous-version (So TheHive 3.3.1 and Cortex 2.1.3)
Logged in Cortex and executed EmlParser_1_2 analyzer
It works with no issues.

@Dave-0-0
Copy link
Author

Dave-0-0 commented Oct 6, 2020

Maybe something is messed up with that VM. I have downloaded another one and have started over.

Thank you for taking the time to respond.

@garanews
Copy link
Contributor

garanews commented Oct 7, 2020

You're welcome, going to close this issue.

@garanews garanews closed this as completed Oct 7, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
category:bug Issue is related to a bug
Projects
None yet
Development

No branches or pull requests

2 participants