Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] #867

Closed
PurpleV0id opened this issue Sep 28, 2020 · 2 comments
Closed

[Bug] #867

PurpleV0id opened this issue Sep 28, 2020 · 2 comments
Labels
category:bug Issue is related to a bug

Comments

@PurpleV0id
Copy link

Running analysis with the MISPWarningLists causes python with the mispwarninglists.py to consume 100% of 1 cpu core until timeout, i have set to 5 hours with no luck. The server is a fresh build with no other activity at the moment, 6 cores and 6gb RAM.

Latest stable Cortex and updated analyzers and responders. Python 3.6.9

Work environment

  • Client OS: Windows 10

  • Server OS: Ubuntu 18.04.5 LTS

  • Cortex version:
    Cortex3.0.1-1
    Elastic4Play1.11.5
    Play2.6.23
    Elastic4s6.5.1
    ElasticSearch client6.5.2

  • Cortex Analyzer: MISPWarningLists_2_0

@PurpleV0id PurpleV0id added the category:bug Issue is related to a bug label Sep 28, 2020
@garanews
Copy link
Contributor

This is not a bug, is how this analyzer worked at the beginning.
For this reason we added support to postgresql :)
Have a look here https://blog.thehive-project.org/2020/05/15/cortex-analyzers-2-7-0-5-analyzers-1-responder/ and read "MISPWarningLists reloaded"
You can easily import lists in postgresql database and gain like 1000x speed!

@PurpleV0id
Copy link
Author

Thats great, i did read about it been slow at the start but i thought 5 hours would be enough to let it run.

Ive spenta fair chunk of time trying to research the setup for MISPWarnings and some how never saw that. Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
category:bug Issue is related to a bug
Projects
None yet
Development

No branches or pull requests

2 participants