[Bug] Wazuh responder not working.

[abhijeetasawant]

Describe the bug
I see following error when try to block an IP.
{
"errorMessage": "Traceback (most recent call last):\n File "Wazuh/wazuh.py", line 40, in \n Wazuh().run()\n File "Wazuh/wazuh.py", line 24, in run\n ipaddress.ip_address(self.observable)\nNameError: name 'ipaddress' is not defined\n",
"input": null,
"success": false
}

To Reproduce
Steps to reproduce the behavior:

1. Configure Wazuh responder from cortex.
2. Create case in Hive and add observable(IP).
3. Add custom required case custom fields.
4. Click on action and choose Wazuh responder.
5. You can see error message in Cortex jobs.

Expected behavior
Responder should get executed without exception.

Complementary information

Work environment

• Client OS: Windows 10
• Server OS: Ubuntu (Virtualbox VM)
• Browse type and version: Chrome 83.0.4103.61
• Cortex version:
• Cortex Analyzer/Responder name: Wazuh_1_0
• Cortex Analyzer/Responder version: 3.0.1-1

Possible solutions
Looks like - import ipaddress in python code missing.

Additional context
.

[weslambert]

Thanks for reporting! I'll take a look and test this as soon as I can.

[dadokkio]

Hi @weslambert , thanks for the fix.
Regarding requirements ipaddress is a standard lib so it should not be included. Can you please double check?

[weslambert]

Yes, I believe it is standard -- was more of a belt and suspenders approach 😄 I can certainly remove it.

[dadokkio]

This PR has been merged manually.