Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Malpedia - Connector #3056

Open
TimoteiM opened this issue Dec 2, 2024 · 0 comments
Open

Malpedia - Connector #3056

TimoteiM opened this issue Dec 2, 2024 · 0 comments
Labels
needs triage use to identify issue needing triage from Filigran Product team question use for asking information about a functionality or behavior

Comments

@TimoteiM
Copy link

TimoteiM commented Dec 2, 2024

Prerequisites

I read the Deployment and Setup section of the OpenCTI documentation as well as the Troubleshooting page and didn't find anything relevant to my problem.
I went through old GitHub issues and couldn't find anything relevant.
I googled the issue and didn't find anything relevant.

Description

I am encountering an issue regarding the Malpedia connector while creating a STIX 2.1 relationship object in OpenCTI. The system responds with the error:
{'name': 'UNSUPPORTED_ERROR', 'error_message': 'Input resolve refs expect single value'}

The object being sent is as follows:

{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0271322f-4714-5b22-b4c4-ad8405a79f1e",
"created_by_ref": "identity--180d3ffd-a014-54ff-a817-211dddd29059",
"created": "2024-11-30T04:14:11.111244Z",
"modified": "2024-11-30T04:14:11.111244Z",
"relationship_type": "indicates",
"source_ref": "indicator--9505e0ad-73ba-5a96-88e2-fadb096e012a",
"target_ref": "malware--20f52322-29a4-5ac9-b58c-a105bddc624f",
"object_marking_refs": ["marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"],
"nb_deps": 1,
"x_opencti_stix_ids": null,
"x_opencti_granted_refs": null,
"x_opencti_workflow_id": null
}

Environment

  1. OS (where OpenCTI server runs): Ubuntu 20.04
  2. OpenCTI version: 5.4.0
  3. OpenCTI client: Python API client
  4. Other environment details: Dockerized deployment using the OpenCTI Docker Compose setup.

Reproducible Steps

Steps to recreate the issue:

  1. Send the above relationship object via the OpenCTI Python API.
  2. Receive the UNSUPPORTED_ERROR with the message 'Input resolve refs expect single value'.

Additional information

Logs:
-No additional logs from OpenCTI aside from the provided error message.
Troubleshooting steps taken:
-Validated the STIX 2.1 object format.
-Ensured all referenced objects exist in the OpenCTI database.
-Confirmed correct usage of object_marking_refs as an array of valid marking-definition identifiers.

@TimoteiM TimoteiM added needs triage use to identify issue needing triage from Filigran Product team question use for asking information about a functionality or behavior labels Dec 2, 2024
@SamuelHassine SamuelHassine transferred this issue from OpenCTI-Platform/opencti Dec 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs triage use to identify issue needing triage from Filigran Product team question use for asking information about a functionality or behavior
Projects
None yet
Development

No branches or pull requests

1 participant