Skip to content

[Bug] Observable already exists #1963

Closed
@V1D1AN

Description

@V1D1AN

Request Type

Bug

Work Environment

Elastalert 0.2.4
TheHive 4.1.3-1 on docker with Cassandra 3.11

Problem Description

[error] o.t.s.u.Retry [000008f2|1e3928fc] uncaught error, not retrying
org.thp.scalligraph.CreateError: Observable already exists
at org.thp.thehive.services.ObservableSrv.create(ObservableSrv.scala:95)
at org.thp.thehive.services.AlertSrv.createObservable(AlertSrv.scala:125)
at org.thp.thehive.controllers.v0.AlertCtrl.$anonfun$createObservable$6(AlertCtrl.scala:341)
at org.thp.scalligraph.package$RichSeq.$anonfun$toTry$3(package.scala:17)
at scala.collection.LinearSeqOptimized.foldLeft(LinearSeqOptimized.scala:126)
at scala.collection.LinearSeqOptimized.foldLeft$(LinearSeqOptimized.scala:122)
at scala.collection.immutable.List.foldLeft(List.scala:91)
at org.thp.scalligraph.package$RichSeq.toTry(package.scala:16)
at org.thp.thehive.controllers.v0.AlertCtrl.$anonfun$createObservable$1(AlertCtrl.scala:341)
at scala.util.Success.flatMap(Try.scala:251)
[error] o.t.s.m.Database [000008f2|1e3928fc] Exception raised, rollback (Observable already exists)
[warn] o.t.s.ErrorHandler [000008f2|1e3928fc] POST /thehive4/api/alert returned 400
[info] o.t.s.AccessLogFilter [000008f2|] 172.21.0.2 POST /thehive4/api/alert took 143ms and returned 400 60 bytes

Steps to Reproduce

This is my elastalert rule that triggers the error

alert:

  • debug
    description: Suricata Level Alert
    filter:
  • query:
    query_string:
    query: (event_type:"alert" AND alert.severity:"1")
    index: suricata-events-*
    category:
  • Suricata
    name: Suricata Level Alert
    priority: 3
    realert:
    minutes: 0
    title: Suricata Level Alert
    type: any

aggregation:
minutes: 2
aggregation_key: alert.signature_id
summary_table_fiels:

  • alert.signature_id
  • src_ip
  • dest_ip

alert_subject_args:

alert: hivealerter

hive_alert_config_type: classic

hive_alert_config:
type: 'Suricata'
source: '{match[source]}'
severity: 3
tags: ['Suricata','{match[alert][category]}']
tlp: 2
status: 'New'
follow: True

hive_observable_data_mapping:

  • hash: "{match[tls][ja3][hash]}"
  • hash: "{match[fileinfo][md5]}"
  • domain: "{match[dns][query][rrname]}"
  • ip: "{match[src_ip]}"
  • ip: "{match[dest_ip]}"
  • filename: "{match[fileinfo][filename]}"

Complementary information

This is work with TheHive 3 but not with TheHive 4 .. Why ??

Thanks

Metadata

Metadata

Assignees

Labels

TheHive4TheHive4 related issuesbug

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions