Hi Guys,

On our customer's site Example: Whois Query Against Artifact - Whois: Query runs to an error:



------------------------------
Adam
------------------------------

@Adam,

From this error NoneType' object has no attribute 'items', that means that the object you are calling ​isn't set to anything (the variable has no value). You will need to verify that you are actually passing it the correct input for the function in the pre-process script.

If you want you can post your workflow and pre-process script for the fn_whois and I can try to help you out.

------------------------------
Richard Giesige
Security Engineer
Oshkosh Corporation
Oshkosh
------------------------------

Hi Richard,

Pre-Process script:
inputs.whois_query = artifact.value

Post-Process script:
def format_link(item):
if item and (item.startswith("https://") or item.startswith("http://")):
return "<a target='blank' href='{0}'>{0}</a>".format(item)
else:
return item

def expand_list(list_value, separator="<br>"):
if not isinstance(list_value, list):
return format_link(list_value)
else:
try:
items = []
for item in list_value:
if isinstance(item, dict):
items.append("<div style='padding:10px'>{}</div>".format(walk_dict(item)))
else:
items.append(format_link(item))
return separator.join(items)
except:
pass

def walk_dict(sub_dict):
notes = []
for key, value in sub_dict.items():
if key not in ['display_content']:
if isinstance(value, dict):
notes.append(u"<b>{}</b>: <div style='padding:10px'>{}</div>".format(key, walk_dict(value)))
else:
notes.append(u"<b>{}</b>: {}".format(key, expand_list(value)))

return u"<br>".join(notes)


note = u"Whois for artifact: {}<br><br>".format(artifact.value)
if results["success"]:
note = note + walk_dict(results["domain_details"])
else:
note = note + u"This Artifact has no whois information"

incident.addNote(helper.createRichText(note))

Please see attached the workflow.

Thank you.

------------------------------
Adam
------------------------------

Original Message:
Sent: Fri September 25, 2020 09:57 AM
From: Richard Giesige
Subject: fn_whois-1.0.2 error

@Adam,

From this error NoneType' object has no attribute 'items', that means that the object you are calling ​isn't set to anything (the variable has no value). You will need to verify that you are actually passing it the correct input for the function in the pre-process script.

If you want you can post your workflow and pre-process script for the fn_whois and I can try to help you out.

------------------------------
Richard Giesige
Security Engineer
Oshkosh Corporation
Oshkosh
------------------------------

It looks like from the first error message the issue is that the post-processing script failed, not the pre processing script.

Ben

------------------------------
Ben Lurie
------------------------------

Original Message:
Sent: Mon September 28, 2020 04:32 AM
From: Adam
Subject: fn_whois-1.0.2 error

Hi Richard,

Pre-Process script:
inputs.whois_query = artifact.value

Post-Process script:
def format_link(item):
if item and (item.startswith("https://") or item.startswith("http://")):
return "<a target='blank' href='{0}'>{0}</a>".format(item)
else:
return item

def expand_list(list_value, separator="<br>"):
if not isinstance(list_value, list):
return format_link(list_value)
else:
try:
items = []
for item in list_value:
if isinstance(item, dict):
items.append("<div style='padding:10px'>{}</div>".format(walk_dict(item)))
else:
items.append(format_link(item))
return separator.join(items)
except:
pass

def walk_dict(sub_dict):
notes = []
for key, value in sub_dict.items():
if key not in ['display_content']:
if isinstance(value, dict):
notes.append(u"<b>{}</b>: <div style='padding:10px'>{}</div>".format(key, walk_dict(value)))
else:
notes.append(u"<b>{}</b>: {}".format(key, expand_list(value)))

return u"<br>".join(notes)


note = u"Whois for artifact: {}<br><br>".format(artifact.value)
if results["success"]:
note = note + walk_dict(results["domain_details"])
else:
note = note + u"This Artifact has no whois information"

incident.addNote(helper.createRichText(note))

Please see attached the workflow.

Thank you.

------------------------------
Adam
------------------------------


Original Message:
Sent: Fri September 25, 2020 09:57 AM
From: Richard Giesige
Subject: fn_whois-1.0.2 error

@Adam,

From this error NoneType' object has no attribute 'items', that means that the object you are calling ​isn't set to anything (the variable has no value). You will need to verify that you are actually passing it the correct input for the function in the pre-process script.

If you want you can post your workflow and pre-process script for the fn_whois and I can try to help you out.

------------------------------
Richard Giesige
Security Engineer
Oshkosh Corporation
Oshkosh

So how can we fix that?

------------------------------
Adam
------------------------------

Original Message:
Sent: Tue September 29, 2020 07:53 AM
From: Ben Lurie
Subject: fn_whois-1.0.2 error

It looks like from the first error message the issue is that the post-processing script failed, not the pre processing script.

Ben

------------------------------
Ben Lurie
------------------------------


Original Message:
Sent: Mon September 28, 2020 04:32 AM
From: Adam
Subject: fn_whois-1.0.2 error

Hi Richard,

Pre-Process script:
inputs.whois_query = artifact.value

Post-Process script:
def format_link(item):
if item and (item.startswith("https://") or item.startswith("http://")):
return "<a target='blank' href='{0}'>{0}</a>".format(item)
else:
return item

def expand_list(list_value, separator="<br>"):
if not isinstance(list_value, list):
return format_link(list_value)
else:
try:
items = []
for item in list_value:
if isinstance(item, dict):
items.append("<div style='padding:10px'>{}</div>".format(walk_dict(item)))
else:
items.append(format_link(item))
return separator.join(items)
except:
pass

def walk_dict(sub_dict):
notes = []
for key, value in sub_dict.items():
if key not in ['display_content']:
if isinstance(value, dict):
notes.append(u"<b>{}</b>: <div style='padding:10px'>{}</div>".format(key, walk_dict(value)))
else:
notes.append(u"<b>{}</b>: {}".format(key, expand_list(value)))

return u"<br>".join(notes)


note = u"Whois for artifact: {}<br><br>".format(artifact.value)
if results["success"]:
note = note + walk_dict(results["domain_details"])
else:
note = note + u"This Artifact has no whois information"

incident.addNote(helper.createRichText(note))

Please see attached the workflow.

Thank you.

------------------------------
Adam


Original Message:
Sent: Fri September 25, 2020 09:57 AM
From: Richard Giesige
Subject: fn_whois-1.0.2 error

@Adam,

From this error NoneType' object has no attribute 'items', that means that the object you are calling ​isn't set to anything (the variable has no value). You will need to verify that you are actually passing it the correct input for the function in the pre-process script.

If you want you can post your workflow and pre-process script for the fn_whois and I can try to help you out.

------------------------------
Richard Giesige
Security Engineer
Oshkosh Corporation
Oshkosh

Hi Adam

I think the issue is in this function:

def walk_dict(sub_dict):
    notes = []
    for key, value in sub_dict.items():
    if key not in ['display_content']:
    if isinstance(value, dict):
        notes.append(u"<b>{}</b>: <div style='padding:10px'>{}</div>".format(key, walk_dict(value)))
    else:
        notes.append(u"<b>{}</b>: {}".format(key, expand_list(value)))

    return u"<br>".join(notes)

On this line:
    for key, value in sub_dict.items():

sub_dict is probably None.
You could check for None at the top of the routine and return empty string?

AnnMarie

------------------------------
AnnMarie Norcross
------------------------------

Original Message:
Sent: Tue September 29, 2020 08:09 AM
From: Adam
Subject: fn_whois-1.0.2 error

So how can we fix that?

------------------------------
Adam
------------------------------


Original Message:
Sent: Tue September 29, 2020 07:53 AM
From: Ben Lurie
Subject: fn_whois-1.0.2 error

It looks like from the first error message the issue is that the post-processing script failed, not the pre processing script.

Ben

------------------------------
Ben Lurie


Original Message:
Sent: Mon September 28, 2020 04:32 AM
From: Adam
Subject: fn_whois-1.0.2 error

Hi Richard,

Pre-Process script:
inputs.whois_query = artifact.value

Post-Process script:
def format_link(item):
if item and (item.startswith("https://") or item.startswith("http://")):
return "<a target='blank' href='{0}'>{0}</a>".format(item)
else:
return item

def expand_list(list_value, separator="<br>"):
if not isinstance(list_value, list):
return format_link(list_value)
else:
try:
items = []
for item in list_value:
if isinstance(item, dict):
items.append("<div style='padding:10px'>{}</div>".format(walk_dict(item)))
else:
items.append(format_link(item))
return separator.join(items)
except:
pass

def walk_dict(sub_dict):
notes = []
for key, value in sub_dict.items():
if key not in ['display_content']:
if isinstance(value, dict):
notes.append(u"<b>{}</b>: <div style='padding:10px'>{}</div>".format(key, walk_dict(value)))
else:
notes.append(u"<b>{}</b>: {}".format(key, expand_list(value)))

return u"<br>".join(notes)


note = u"Whois for artifact: {}<br><br>".format(artifact.value)
if results["success"]:
note = note + walk_dict(results["domain_details"])
else:
note = note + u"This Artifact has no whois information"

incident.addNote(helper.createRichText(note))

Please see attached the workflow.

Thank you.

------------------------------
Adam


Original Message:
Sent: Fri September 25, 2020 09:57 AM
From: Richard Giesige
Subject: fn_whois-1.0.2 error

@Adam,

From this error NoneType' object has no attribute 'items', that means that the object you are calling ​isn't set to anything (the variable has no value). You will need to verify that you are actually passing it the correct input for the function in the pre-process script.

If you want you can post your workflow and pre-process script for the fn_whois and I can try to help you out.

------------------------------
Richard Giesige
Security Engineer
Oshkosh Corporation
Oshkosh

Hi AnnMarie,

What do you mean?
Where should I check for None?

------------------------------
Adam
------------------------------

Original Message:
Sent: Wed September 30, 2020 09:13 AM
From: AnnMarie Norcross
Subject: fn_whois-1.0.2 error

Hi Adam

I think the issue is in this function:

def walk_dict(sub_dict):
    notes = []
    for key, value in sub_dict.items():
    if key not in ['display_content']:
    if isinstance(value, dict):
        notes.append(u"<b>{}</b>: <div style='padding:10px'>{}</div>".format(key, walk_dict(value)))
    else:
        notes.append(u"<b>{}</b>: {}".format(key, expand_list(value)))

    return u"<br>".join(notes)

On this line:
    for key, value in sub_dict.items():

sub_dict is probably None.
You could check for None at the top of the routine and return empty string?

AnnMarie

------------------------------
AnnMarie Norcross
------------------------------


Original Message:
Sent: Tue September 29, 2020 08:09 AM
From: Adam
Subject: fn_whois-1.0.2 error

So how can we fix that?

------------------------------
Adam


Original Message:
Sent: Tue September 29, 2020 07:53 AM
From: Ben Lurie
Subject: fn_whois-1.0.2 error

It looks like from the first error message the issue is that the post-processing script failed, not the pre processing script.

Ben

------------------------------
Ben Lurie


Original Message:
Sent: Mon September 28, 2020 04:32 AM
From: Adam
Subject: fn_whois-1.0.2 error

Hi Richard,

Pre-Process script:
inputs.whois_query = artifact.value

Post-Process script:
def format_link(item):
if item and (item.startswith("https://") or item.startswith("http://")):
return "<a target='blank' href='{0}'>{0}</a>".format(item)
else:
return item

def expand_list(list_value, separator="<br>"):
if not isinstance(list_value, list):
return format_link(list_value)
else:
try:
items = []
for item in list_value:
if isinstance(item, dict):
items.append("<div style='padding:10px'>{}</div>".format(walk_dict(item)))
else:
items.append(format_link(item))
return separator.join(items)
except:
pass

def walk_dict(sub_dict):
notes = []
for key, value in sub_dict.items():
if key not in ['display_content']:
if isinstance(value, dict):
notes.append(u"<b>{}</b>: <div style='padding:10px'>{}</div>".format(key, walk_dict(value)))
else:
notes.append(u"<b>{}</b>: {}".format(key, expand_list(value)))

return u"<br>".join(notes)


note = u"Whois for artifact: {}<br><br>".format(artifact.value)
if results["success"]:
note = note + walk_dict(results["domain_details"])
else:
note = note + u"This Artifact has no whois information"

incident.addNote(helper.createRichText(note))

Please see attached the workflow.

Thank you.

------------------------------
Adam


Original Message:
Sent: Fri September 25, 2020 09:57 AM
From: Richard Giesige
Subject: fn_whois-1.0.2 error

@Adam,

From this error NoneType' object has no attribute 'items', that means that the object you are calling ​isn't set to anything (the variable has no value). You will need to verify that you are actually passing it the correct input for the function in the pre-process script.

If you want you can post your workflow and pre-process script for the fn_whois and I can try to help you out.

------------------------------
Richard Giesige
Security Engineer
Oshkosh Corporation
Oshkosh

Hi,

I think she means it like this:

def walk_dict(sub_dict):
    if sub_dict is None:
        return ""
    else:
         notes = []
        for key, value in sub_dict.items():
            if key not in ['display_content']:
                if isinstance(value, dict):
                    notes.append(u"<b>{}</b>: <div style='padding:10px'>{}</div>".format(key, walk_dict(value)))
            else:
                notes.append(u"<b>{}</b>: {}".format(key, expand_list(value)))
        return u"<br>".join(notes)
This way, if sub_dict is empty (None), it only returns with an empty string and the function will not fail.

Could you try if it solves the problem?

------------------------------
Viktoria Laposi
------------------------------

Original Message:
Sent: Wed October 14, 2020 02:38 AM
From: Adam
Subject: fn_whois-1.0.2 error

Hi AnnMarie,

What do you mean?
Where should I check for None?

------------------------------
Adam
------------------------------


Original Message:
Sent: Wed September 30, 2020 09:13 AM
From: AnnMarie Norcross
Subject: fn_whois-1.0.2 error

Hi Adam

I think the issue is in this function:

def walk_dict(sub_dict):
    notes = []
    for key, value in sub_dict.items():
    if key not in ['display_content']:
    if isinstance(value, dict):
        notes.append(u"<b>{}</b>: <div style='padding:10px'>{}</div>".format(key, walk_dict(value)))
    else:
        notes.append(u"<b>{}</b>: {}".format(key, expand_list(value)))

    return u"<br>".join(notes)

On this line:
    for key, value in sub_dict.items():

sub_dict is probably None.
You could check for None at the top of the routine and return empty string?

AnnMarie

------------------------------
AnnMarie Norcross


Original Message:
Sent: Tue September 29, 2020 08:09 AM
From: Adam
Subject: fn_whois-1.0.2 error

So how can we fix that?

------------------------------
Adam


Original Message:
Sent: Tue September 29, 2020 07:53 AM
From: Ben Lurie
Subject: fn_whois-1.0.2 error

It looks like from the first error message the issue is that the post-processing script failed, not the pre processing script.

Ben

------------------------------
Ben Lurie


Original Message:
Sent: Mon September 28, 2020 04:32 AM
From: Adam
Subject: fn_whois-1.0.2 error

Hi Richard,

Pre-Process script:
inputs.whois_query = artifact.value

Post-Process script:
def format_link(item):
if item and (item.startswith("https://") or item.startswith("http://")):
return "<a target='blank' href='{0}'>{0}</a>".format(item)
else:
return item

def expand_list(list_value, separator="<br>"):
if not isinstance(list_value, list):
return format_link(list_value)
else:
try:
items = []
for item in list_value:
if isinstance(item, dict):
items.append("<div style='padding:10px'>{}</div>".format(walk_dict(item)))
else:
items.append(format_link(item))
return separator.join(items)
except:
pass

def walk_dict(sub_dict):
notes = []
for key, value in sub_dict.items():
if key not in ['display_content']:
if isinstance(value, dict):
notes.append(u"<b>{}</b>: <div style='padding:10px'>{}</div>".format(key, walk_dict(value)))
else:
notes.append(u"<b>{}</b>: {}".format(key, expand_list(value)))

return u"<br>".join(notes)


note = u"Whois for artifact: {}<br><br>".format(artifact.value)
if results["success"]:
note = note + walk_dict(results["domain_details"])
else:
note = note + u"This Artifact has no whois information"

incident.addNote(helper.createRichText(note))

Please see attached the workflow.

Thank you.

------------------------------
Adam


Original Message:
Sent: Fri September 25, 2020 09:57 AM
From: Richard Giesige
Subject: fn_whois-1.0.2 error

@Adam,

From this error NoneType' object has no attribute 'items', that means that the object you are calling ​isn't set to anything (the variable has no value). You will need to verify that you are actually passing it the correct input for the function in the pre-process script.

If you want you can post your workflow and pre-process script for the fn_whois and I can try to help you out.

------------------------------
Richard Giesige
Security Engineer
Oshkosh Corporation
Oshkosh