Fix OTX and Whois data adapter issues #75
Merged
Conversation
86968f7
to
88d916b
This fixes an issue where the processing blocked because of whois socket connections without a timeout. - Use WhoisClient from apache commons-net and configure timeouts for the connection - Introduce config values for read and connect timeout - Add data adapter documentation - Add metrics
The OTX adapter isn't restarted when its configuration is changed on the Overview page. If the adapter is disabled and a lookup is attempted via the table's detail page, an NPE is thrown. This might be a shortcoming of the overall system, probably nothing specific to the OTX adapter. |
The OTX adapter doesn't do any background checks and the API token is also not a hard requirement.
@kroepke Good catch! I removed the config setting to disable the OTX adaper because it doesn't need to be disabled/enabled. There is no background data fetching and also the API key is not strictly required. |
With the latest changes it works for me, too. |
kroepke
added a commit
that referenced
this pull request
Dec 15, 2017
* Add OTX data adapter and use it for the OTX lookup tables * Do not modify method parameter in Domain#prepareDomain() * Remove outdated OTX API key note from ThreatIntelPluginConfig * Fix Whois data adapter implementation This fixes an issue where the processing blocked because of whois socket connections without a timeout. - Use WhoisClient from apache commons-net and configure timeouts for the connection - Introduce config values for read and connect timeout - Add data adapter documentation - Add metrics * Remove "disabled" config option for the OTX adapter The OTX adapter doesn't do any background checks and the API token is also not a hard requirement. * Remove unused variables in ThreatIntelPluginConfig.jsx * Replace HTTP host/port/scheme settings with "api_url" (cherry picked from commit 799c6f6)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
This adds a separate OTX data adaper and uses that one for the OTX API lookup tables to fix several issues and actually makes the OTX features work.
It also fixes the Whois data adapter by adding a client with timeouts.
Notes: This needs to be cherry-picked into 2.4 once merged
ATTENTION: Run the following MongoDB shell script via
mongo <filename>.js
to cleanup the existing lookup table/cache/adapter entries. This is only needed if you are running with a previous 2.4-alpha/beta.