Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] IRIS MISP Module is not working. #307

Open
Tedus007 opened this issue Sep 11, 2023 · 1 comment
Open

[BUG] IRIS MISP Module is not working. #307

Tedus007 opened this issue Sep 11, 2023 · 1 comment
Labels
bug Something isn't working

Comments

@Tedus007
Copy link

Describe the bug
IRIS MISP Module is not working.
All IOCs added failed to get MISP insights

To Reproduce
Steps to reproduce the behavior:

  1. Go to 'IOC'
  2. Click on 'Get MISP Insights'
  3. Scroll down to '....'
  4. See error
    _- iriswebapp_app | server=x.x.x.x//socket.io/ client=x.x.x.x:59054 socket shutdown error: [Errno 9] Bad file descriptor2023-09-11 08:31:47 :: INFO :: module_handler :: call_modules_hook :: Calling module iris_misp_module asynchronously for hook on_manual_trigger_ioc :: Get MISP insight_

Expected behavior
The link between MISP and IRIS module is broken

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

  • OS: Ubuntu Server 2022
  • Browser: Chrome
  • Version:116

Smartphone (please complete the following information):

  • Device: [e.g. iPhone6]
  • OS: [e.g. iOS8.1]
  • Browser [e.g. stock browser, safari]
  • Version [e.g. 22]

Additional context
We are on DFIR-IRIS Latest version 2.3.2

@Tedus007 Tedus007 added the bug Something isn't working label Sep 11, 2023
@Pcktech
Copy link

Pcktech commented Dec 26, 2023

I had a similar problem creating the Dummy Module:

server=x.x.x.x//socket.io/ client=y.y.y.y:36106 socket shutdown error: [Errno 9] Bad file descriptor2023-12-26 16:01:05 :: INFO :: module_handler :: call_modules_hook :: Calling module moduleDummy asynchronously for hook on_postload_ioc_create :: None

It turned out to be the rabbitmq docker container wasn't running.

Show all containers running: docker ps | grep iris
Show all containers available: docker ps --all | grep iris
Start missing rabbitmq: docker start iriswebapp_rabbitmq

Then the issue went away for me. I hope this helps someone else as well.

Solution Inspiration Credit to celery/kombu#369 (comment)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants