zolderio/misp-to-sentinel

VSC Errors on Initializing package

Opened this issue · 5 comments

Awesome work on this project. I'm so glad to get away from the old deprecated MS script.

I've downloaded the files, done all of the other steps, and when I try to initialise the folder for use with VScode it gives me the following error:
#"Error: Internal error: Expected value to be neither null, undefined, nor empty: projectLanguage"

wez3 commented

Unknown error to me. You could try the following:

Hi @wez3,

I've done the first 3 steps, when I attempt to deploy directly, the function does deploy, however, the function does not appear within functions.

I've deployed the function manually, though I can't find any variable in the app configuration to pass my keyvault URI,

Have you seen this before? Thanks -

wez3 commented

You have to add the variable yourself

Hi @wez3 please see attached error from Application Insights for my m2s function:

Result: Failure
Exception: MISPServerError: Error code 500:
{"name":"An Internal Error Has Occurred.","message":"An Internal Error Has Occurred.","url":"/events/restSearch"}
Stack: File "/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/dispatcher.py", line 458, in _handle__invocation_request
call_result = await self._loop.run_in_executor(
File "/usr/local/lib/python3.9/concurrent/futures/thread.py", line 58, in run
result = self.fn(*self.args, **self.kwargs)
File "/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/dispatcher.py", line 701, in _run_sync_func
return ExtensionManager.get_sync_invocation_wrapper(context,
File "/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/extension.py", line 215, in _raw_invocation_wrapper
result = function(**args)
File "/home/site/wwwroot/m2s/init.py", line 119, in main
pmain()
File "/home/site/wwwroot/m2s/init.py", line 74, in pmain
events = _get_events()
File "/home/site/wwwroot/m2s/init.py", line 22, in _get_events
[event['Event'] for event in misp.search(controller='events', return_format='json', **config.misp_event_filters)]
File "/home/site/wwwroot/.python_packages/lib/site-packages/pymisp/api.py", line 2634, in search
normalized_response = self._check_json_response(response)
File "/home/site/wwwroot/.python_packages/lib/site-packages/pymisp/api.py", line 3569, in _check_json_response
r = self._check_response(response, expect_json=True)
File "/home/site/wwwroot/.python_packages/lib/site-packages/pymisp/api.py", line 3587, in _check_response
raise MISPServerError(f'Error code 500:\n{response.text}')

wez3 commented

It looks like your MISP server returns a 500 internal server error response. Maybe try another server first?