IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

file.content Artifacts Sending Blank Request to Django CTS

  • 1.  file.content Artifacts Sending Blank Request to Django CTS

    IBM Champion
    Posted Mon August 10, 2020 02:27 PM
    All,

    We're working on making CTSes with Django, as shown in this example. Everything has been going well, until we started creating artifacts of the type 'file.content', such as 'Email Attachment'. 

    When I create an 'Email Attachment' artifact, the request data that comes into my Django process looks like this:

    <QueryDict: {}>

    Where as when a 'net.uri' artifact (URL) is added the requests data looks like this:

    <QueryDict: {'artifact': ['{"type":"net.uri","value":"https://exampleurl.com"}']}>

    The empty request data that comes in from an Email Attachment artifact throws an exception, as the code is expecting there to be data sent with the request.

    I have noticed that the following error gets recorded in our client.log file shortly after uploading an Email Attachment artifact:

    16:26:33.207 [Camel (camel-1) thread #9 - JmsConsumer[interprocessevents.schedule-service]] ERROR [] com.co3.net.Co3SocketFactory - Unable to get managers from keystore /crypt/certs/custcerts
    ...

    I'm hoping this error is what is causing the empty response to be sent to the CTS. 

    Does anyone have any experience with this behavior or fixing this exception?

    Thanks,

    ------------------------------
    Liam Mahoney
    ------------------------------