Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not throw MsticpyVTNoDataError exception when no data is return from vt_lookup.lookup_iocs - vtlookupv3 #198

Closed
2xyo opened this issue Aug 31, 2021 · 1 comment · Fixed by #199
Labels
accepted The request/issue is accepted for a fix bug Something isn't working

Comments

@2xyo
Copy link
Contributor

2xyo commented Aug 31, 2021

Describe the bug

  1. investigate a list of observables
  2. enrich this list of observables with vt_lookup.lookup_iocs from vtlookupv3
  3. get an exception if an observable is not present on virustotal instead of the result

To Reproduce

import pandas as pd
from msticpy import init_notebook
from msticpy.sectools.vtlookupv3 import VTLookupV3, VTEntityType
from msticpy.common.provider_settings import get_provider_settings

import nest_asyncio
nest_asyncio.apply()

init_notebook(namespace=globals());
vt_key = get_provider_settings("TIProviders")["VirusTotal"].args["AuthKey"]
vt_lookup = VTLookupV3(vt_key)

samples_raw = """018ac8f95d5e14b92011cdbfc8c48056ca4891161ed6bdd268770a5b56bb327f
DONOTEXISTDONOTEXISTDONOTEXIST"""
samples = pd.DataFrame({"target":samples_raw.split(),"target_type":"file"})
vt_lookup.lookup_iocs(observables_df=samples, observable_column="target")

Minimized stacktrace

APIError                                  Traceback (most recent call last)
APIError: ('NotFoundError', 'Resource not found.')
The above exception was the direct cause of the following exception:
MsticpyVTNoDataError                      Traceback (most recent call last)
MsticpyVTNoDataError: An error occurred requesting data from VirusTotal

Expected behavior

A dataframe with 2 rows

  1. a first row with the data for 018ac8f95d5e14b92011cdbfc8c48056ca4891161ed6bdd268770a5b56bb327f
  2. a second raw with NaN or None value for DONOTEXISTDONOTEXISTDONOTEXIST (or an equivalent to inform the analyst that the observable was not found on VT)

Not finding an observable on VT is fundamentally not an error, it is an event that is potentially expected and this should not prevent retrieving the results for the other observables.

Additional context

msticpy version installed: 1.3.1

@ianhelle ianhelle added accepted The request/issue is accepted for a fix bug Something isn't working labels Aug 31, 2021
@ianhelle ianhelle linked a pull request Sep 2, 2021 that will close this issue
@ianhelle
Copy link
Contributor

ianhelle commented Sep 2, 2021

Hi @2xyo - this should be fixed in PR #199.
Hopefully will release next week.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
accepted The request/issue is accepted for a fix bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants