Hello World,
Just to share to the community, some feedback with Circuits on an independant RHEL/CEntOS 7.5, using Python 3.6 (RH) and functions from the Resilient .git repos :
- fn_splunk_integration : 1.0.0 (with Splunk SDK 1.6.5)
- fn_utilities : 1.0.3
- rc-cts-misp-29.1.1.dev24+g1c40c13
Feedback :
- Splunk functions (With SDK 1.6.5) : Works fine, calling with functions are OK on a Splunk enterprise.
- Fn_utilities : Correction to do for hash calculation with attachment
1) if you don't mention the algorithms, you will get an error in module 'hashlib' has no attribute 'algorithms'
2) hashlib contains some hash functions that have dynamic length outputs. Specifically, shake_128 and shake_256. This is why you have to rewrite it.
Info : /usr/local/lib/python3.6/site-packages/fn_utilities/components/utilities_attachment_hash.py
You have to correct from line 56 :
#BEFORE
for algo in hashlib.algorithms:
impl = hashlib.new(algo)
impl.update(data)
results[algo] = impl.hexdigest()
#AFTER CORRECTION
for algo in hashlib.algorithms_guaranteed:
if algo.startswith('shake_'):
continue
impl = hashlib.new(algo)
impl.update(data)
results[algo] = impl.hexdigest()
- Rc_cts_misp :
With self signed certificate on Misp
Error : INFO [threat_webservice] Lookup complete: <net.ip[cts_search.misp] (d1412576-484a-5a72-a84b-da4f69dc0149)>, (<class 'pymisp.exceptions.PyMISPError'>, PyMISPError('Unable to connect to MISP (https://misp.zoldax.local). Please make sure the API key and the URL are correct (http/https is required): Could not find a suitable TLS CA certificate bundle, invalid path: False',), <traceback object at 0x7f4d125f4708>)
Info : /usr/local/lib/python3.6/site-packages/rc_cts_misp/components/searcher.py
Line 160 : the self.misp_verifycert is not typed in False boolean
Work around line 160 :
misp_api = PyMISP(self.misp_url, self.misp_key, False, 'json')
Everything works fine after these modifications.
Just for sharing.
------------------------------
Just to share.
Regards,
@zoldax
------------------------------