Skip to content

Upgrade Sandbox Connector from 1.0 to 1.5 #42

@SkiTheSlicer

Description

@SkiTheSlicer

When using Result Options -> Send to connector -> Send to malware analysis sandbox, I get no pop-ups, but the following in '/nsm/elsa/data/elsa/log/web.log' (I'm hand-typing the messages because the server is currently air-gapped):

* DEBUG [2016/07/28 18:29:12] /opt/elsa/web/lib/Controller.pm (2201) Controller::_send_to 55264 [undef]
loading plugin Connector::Sandbox
* ERROR [2016/07/28 18:29:12] /opt/elsa/web/lib/Controller.pm (2263) Controller::_send_to 55264 [undef]
Error creating plugin Connector::Sandbox with data $VAR1 = bless( {
<snip>
: Can't locate object method "api" via package "Connector::Sandbox" at /opt/elsa/web/lib/Connector/Sandbox.pm line 19.

When using Info -> Plugin -> Send to Sandbox, I receive a pop-up with a title of 'Error' and message of 'Send failed' and get the following in '/nsm/elsa/data/elsa/log/web.log':

* DEBUG [2016/07/28 18:47:35] /opt/elsa/web/lib/View.pm (380) View::_send_to 58803 [undef]
Decoded HASH(0x56413aeb1148) as : $VAR1 = {
<SNIP>
* DEBUG [2016/07/28 18:47:35] /opt/elsa/web/lib/QueryParser.pm (447) QueryParser::_parse_qury 58803 [undef]
<SNIP>
* DEBUG [2016/07/28 18:47:35] /opt/elsa/web/lib/QueryParser.pm (233) QueryParser::parse 58803 [undef]
<SNIP>
* DEBUG [2016/07/28 18:47:35] /opt/elsa/web/lib/Query.pm (174) BUILD 58803 [undef]
Received query with qid 40 at 1469731655
* ERROR [2016/07/28 18:47:35] /opt/elsa/web/lib/View.pm (161) View::catch {...} 58803 [undef]
Not an ARRAY reference at /opt/elsa/web/lib/Results.pm line 89.

I made the following configuration update to /etc/elsa_web.conf and restarted apache2:

{
<snip>
  "connectors": {
    "sandbox": {
      "site": "192.168.10.24",
      "url": "http://192.168.10.24:8090/tasks/create/file"
    }
  },
<snip>
}

FYI: I'm currently running off the Security Onion ISO 14.04.4.1, ELSA Rev 1205.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions