Hi Mark
Thanks for the answer. Yes, the circuits it's running and the threat service is started.
The fact is that it works if, like described above, I add the same artifact a second time. At first it won't work (and this is why I create this thread) but at second yes.
I would like to add this: at first try, in the app.log file I see this log:
2019-11-04 09:32:12,218 INFO [threat_webservice] <Request POST /cts/MYCTS HTTP/1.1>
2019-11-04 09:32:12,219 DEBUG [threat_webservice] {u'type': u'net.ip', u'value': u'163.172.40.218'}
2019-11-04 09:32:12,219 INFO [threat_webservice] 303 See Other: {"retry_secs": 5, "hits": [], "id": "00a2b17c-8c57-5bde-9bfa-bd964c6bec55"}
2019-11-04 09:32:12,234 INFO [threat_webservice] helper: <net.ip[threat_lookup_helper] (00a2b17c-8c57-5bde-9bfa-bd964c6bec55)>, cts_search.MYCTS
2019-11-04 09:32:32,937 INFO [searcher] HITS: [Hit([('props', [{'type': 'string', 'name': u'Malware', 'value': 'Heodo'}, {'type': 'string', 'name': u'LastOnline', 'value': '2019-11-04'}, {'type': 'string', 'name': u'Firstseen', 'value': '2019-10-30 15:42:11'}, {'type': 'string', 'name': u'DstPort', 'value': '7080'}, {'type': 'string', 'name': u'Lista', 'value': u'BOTNET_C2_IP_BLOCKLIST_ALL'}, {'type': 'uri', 'name': u'URL', 'value': u'https://feodotracker.abuse.ch/downloads/ipblocklist.txt'}, {'type': 'string', 'name': u'MasterFile Timestamp', 'value': u'2019-10-31 17:45:36'}])])]
2019-11-04 09:32:32,941 DEBUG [client] Received heart-beat
2019-11-04 09:32:32,942 DEBUG [client] Received MESSAGE frame [headers={u'expires': u'0', u'Co3ContextToken': u'eyJhbGciOiJIUzI1NiJ9.bnVsbA.cH1P6y_AmRWRTr3dQNNnNr8bpl88i-VT6p95433_KY0', u'ack': u'ID:HOST-36225-1572448310497-32:307', u'timestamp': u'1572856331477', u'JMSXUserID': u'SYSTEM', u'destination': u'/queue/actions.201.fn_elasticsearch', u'correlation-id': u'invid:94427', u'persistent': u'true', u'priority': u'4', u'Co3MessagePayload': u'FunctionDataDTO', u'Co3RemoteAddr': u'127.0.0.1', u'reply-to': u'/queue/acks.201.fn_elasticsearch', u'message-id': u'ID:HOST-43717-1572448359513-3:3:1877:1:1', u'Co3ContentType': u'application/json', u'subscription': u'actions.201.fn_elasticsearch'}, body='{"function":{"creato...', version=1.2]
2019-11-04 09:32:32,943 DEBUG [stomp_component] Recieved frame MESSAGE
What concern me is: why do I have a 303 error and an empty hits list (even if, as you can see, my log show that the list is populated) ? If I add the artifact a second time, it work without that 303.
Also, correct me if I am wrong, does the app.log file is being updated after the client.log ? If yes, then we "return" to the issue above (the stack trace).
Why, in client.log file, I have a response with an empty hits list ?
A video of the steps I make actually:
Thanks
------------------------------
Bruce Wayne
Senior Dark Knight
------------------------------
Original Message:
Sent: Fri November 01, 2019 07:25 AM
From: Mark Scherfling
Subject: Custom Threat Source - java.lang.RuntimeException: Unexpected response from...
Hi Bruce,
The stack trace shows that Resilient is unable to communicate with your custom threat service: http://MYIP:9000/cts/MYCTS/aacf4e02-f5c2-5702-abc6-7d597ef3f2f2. Confirm that you have resilient-circuits running on your integrations server with your threat service started.
Good luck
------------------------------
Mark Scherfling
------------------------------