-
Notifications
You must be signed in to change notification settings - Fork 10
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Unable to update Indicator Type / Unable to update Malware Family #170
Comments
Same issue me also facing, but with lot more Indicators and Malware families: |
With same error : Connection failure [2024-07-10 02:04:53,836] WARNING processor/thread_14 Connection failure, could not save event. ¯(°_o)/¯ |
Can anyone please investigate what could be the issue here? |
I am using the latest version of script : 0.7.4 |
Context: Problem: python3 misp_import.py -all --publish --force --config /home/misp/MISP-tools-0.7.4/misp_import.ini I encounter frequent connection failures with the following error: [WARNING] processor/thread_x Connection failure, could not save event. ¯(°_o)/¯ Additionally, I'm seeing errors indicating failures to update Indicator Types and Malware Families. Details: Errors include: Unable to update Indicator Type (e.g., SHA256, MD5, SHA1 hashes) Unable to update Malware Family (e.g., Salityv4, Rifdoor, Mofksys) Configuration tweaks i already tried: Reduced attribute_batch_size to 1000 from 2500 Discovered that the system was using 16 threads Set max_threads to 8 for stability Adjusted event_save_memory_refresh_interval from 180 to 300 Changed max_threads to 8 and then to 32, but the error persisted Restarted Docker, but the issue remained Using Python virtualenv for managing dependencies still same error. Request: Has anyone else experienced the same error using this script? If not, What are the configuration changes required to resolve this issue? Solutions to prevent connection failures. Thank you! |
all the error i am getting : Connection failure, could not save event. ¯(°_o)/¯ [2024-07-12 11:18:32,493] WARNING processor/thread_0 Unable to update Indicator Type: SHA256 hashes with new indicators after 507.54 seconds. |
I am facing following errors while running MISP import script :- |
Can anyone please checked, multiple users facing same issue. |
Hello,
using 0.7.3 in container mode, all is working fine, but tow malware families always fail when launch import (Cobalstrike and TimeStealerTriggerCobaltStrike).
The process import and update all indicators of all families and shows these errors in those two "Connection failure, could not save event." and "Unable to update Indicator Type" retries this update continously and process never ends.
Is there any way to limit the number of retries and is tis problem with these two families a known problem?
Thanks.
The text was updated successfully, but these errors were encountered: