[BUG] cannot add account into instance configuration

[RuthLMeng]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Splunk 9
TheHive version / git hash	theHive5

Problem Description

Describe your problem here

Steps to Reproduce

1. On the page "Instances"
2. Select "add a new insatnce" button
3. No global account could be selelcted.

Possible Solutions

• Any requests for Splunk capabilities for this addon? I am using Splunk user´s capabilities, must it be Splunk Admin?

Logs (issued from the search.log with logging mode set to DEBUG under Settings/Configuration)

[RuthLMeng]

The search to add instance to the csv table not working:

[LetMeR00t]

Hello,
You need to create a global account by having the admin capability.
You are missing this part of the documentation: https://github.com/LetMeR00t/TA-thehive-cortex/blob/main/docs/installation.md#accounts

Thank you

[LetMeR00t]

Hello
Any update on your side ?

[RuthLMeng]

Hello, Because the platform is one of those I don´t have admin permission, so I am asking for the internal logs about this addon´s errors or warnings, so I could give you a feedback. With best regards

…

On Sat, Sep 14, 2024 at 8:04 AM LmR ***@***.***> wrote: Hello Any update on your side ? — Reply to this email directly, view it on GitHub <#97 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A3WILUXB3U3SZBPVKJGU47DZWPGVVAVCNFSM6AAAAABMX6O4DGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGNJQHA3DGNRZGQ> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[LetMeR00t]

Hello,
Any update?
Thank you

[RuthLMeng]

Hello,

The instance still not added into the table. When we searched the errors for this TA, we got following error message:

ERROR AdminManagerExternal [1837517 TcpChannelThread] - Stack trace from python handler:\nTraceback (most recent call last):\n File "/opt/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/splunktaucclib/rest_handler/handler.py", line 117, in wrapper\n for name, data, acl in meth(self, *args, **kwargs):\n File "/opt/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/splunktaucclib/rest_handler/handler.py", line 172, in all\n **query\n File "/opt/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/splunklib/binding.py", line 291, in wrapper\n return request_fun(self, *args, **kwargs)\n File "/opt/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/splunklib/binding.py", line 72, in new_f\n val = f(*args, **kwargs)\n File "/opt/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/splunklib/binding.py", line 697, in get\n response = self.http.get(path, all_headers, **query)\n File "/opt/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/splunklib/binding.py", line 1230, in get\n return self.request(url, { 'method': "GET", 'headers': headers })\n File "/opt/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/splunklib/binding.py", line 1302, in request\n raise HTTPError(response)\nsplunklib.binding.HTTPError: HTTP 404 Not Found -- b'{"messages":[{"type":"ERROR","text":"Not Found"}]}'\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File "/opt/splunk/lib/python3.7/site-packages/splunk/admin.py", line 114, in init_persistent\n hand.execute(info)\n File "/opt/splunk/lib/python3.7/site-packages/splunk/admin.py", line 647, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "/opt/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/splunk_aoblib/rest_migration.py", line 39, in handleList\n AdminExternalHandler.handleList(self, confInfo)\n File "/opt/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/splunktaucclib/rest_handler/admin_external.py", line 51, in wrapper\n for entity in result:\n File "/opt/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/splunktaucclib/rest_handler/handler.py", line 122, in wrapper\n raise RestError(exc.status, str(exc))\nsplunktaucclib.rest_handler.error.RestError: REST Error [404]: Not Found -- HTTP 404 Not Found -- b'{"messages":[{"type":"ERROR","text":"Not Found"}]}'\n

[RuthLMeng]

We saved the account, but cannot correctly use the button "add an instance" into lookup table.

[LetMeR00t]

I don’t get what you mean
You just have to select the « Add an instance » and fullfill the fields to populate the lookup.

[RuthLMeng]

Hello,

some points found for this addon:

1. The current package didn´t provide csv lookup. The lookup defination thehive_cortex_instances is existed but thehive_cortex_instances.csv not inclusived in this addon.
2. The view instances:
3. When submitButton turned to true, but still I got some error msgs about a deprecated method:
   10-30-2024 11:42:20.969 +0000 ERROR PersistentScript [1874756 PersistentScriptIo] - From {/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-thehive-cortex/bin/TA_thehive_cortex_rh_account.py persistent}: /opt/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/solnlib/utils.py:153: UserWarning: _get_all_passwords is deprecated, please use get_all_passwords_in_realm instead.

[LetMeR00t]

Hello,

some points found for this addon:

1. The current package didn´t provide csv lookup. The lookup defination thehive_cortex_instances is existed but thehive_cortex_instances.csv not inclusived in this addon.
2. The view instances:
3. When submitButton turned to true, but still I got some error msgs about a deprecated method:
   10-30-2024 11:42:20.969 +0000 ERROR PersistentScript [1874756 PersistentScriptIo] - From {/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-thehive-cortex/bin/TA_thehive_cortex_rh_account.py persistent}: /opt/splunk/etc/apps/TA-thehive-cortex/bin/ta_thehive_cortex/aob_py3/solnlib/utils.py:153: UserWarning: _get_all_passwords is deprecated, please use get_all_passwords_in_realm instead.

Hello

Lookups are forbidden by Splunkbase in applications so we can't create this upfront. If the file doesn't exist, the python script will be creating it.

Thanks for the 3rd comment, I'll check that.

[RuthLMeng]

On Splunk Cloud 9.2, it cannot add a csv automatically. The query for "add an instance" always waiting for input, but never runnable.

[LetMeR00t]

Hello
Did you tried to enter a value in all input fields on the top of this dashboard ? Especially on the blank ones.
thank you

[RuthLMeng]

Thank you for your comment, I found why the record not inserted into lookup. The comment field was missing, so the lookup table never there.