You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
OS (where OpenCTI server runs): { e.g. Mac OS 10, Windows 10, Ubuntu 16.4, etc. } Amazon Linux - Docker Container
OpenCTI version: { e.g. OpenCTI 1.0.2 } 5.10.3
OpenCTI client: { e.g. frontend or python }
Other environment details:
Reproducible Steps
Steps to create the smallest reproducible scenario:
{ e.g. Run ... } Compose Docker file
{ e.g. Click ... } Stream live data into an Elastic instance
{ e.g. Error ... }
Expected Output
Data would continue to flow through into Elastic, as new data comes in.
Actual Output
After a few hours, data slowed so that the event would be created in elastic several hours/ days after it was in OpenCTI. We have confirmed this is due to OpenCTI. I believe this is related to the Graph QL API.
Additional information
We have the following error messages:
{
"category": "APP",
"error": {
"context": {},
"message": "Cannot read properties of undefined (reading 'standard_id')",
"name": "TypeError",
"stack": "TypeError: Cannot read properties of undefined (reading 'standard_id')\n at resolveAndPublishMissingRefs (/opt/opencti/build/src/graphql/sseMiddleware.js:373:38)\n at resolveAndPublishDependencies (/opt/opencti/build/src/graphql/sseMiddleware.js:387:31)\n at hA.autoReconnect (/opt/opencti/build/src/graphql/sseMiddleware.js:588:47)\n at processStreamResult (/opt/opencti/build/src/database/redis.ts:599:3)\n at processStep (/opt/opencti/build/src/database/redis.ts:653:31)\n at processingLoop (/opt/opencti/build/src/database/redis.ts:670:13)"
},
"level": "error",
"message": "Error in redis streams read for USER",
"timestamp": "2023-10-10T08:56:26.356Z",
"version": "5.10.3"
}
{
"category": "APP",
"error": {
"context": {},
"message": "Cannot read properties of undefined (reading 'standard_id')",
"name": "TypeError",
"stack": "TypeError: Cannot read properties of undefined (reading 'standard_id')\n at resolveAndPublishMissingRefs (/opt/opencti/build/src/graphql/sseMiddleware.js:373:38)\n at resolveAndPublishDependencies (/opt/opencti/build/src/graphql/sseMiddleware.js:387:31)\n at hA.autoReconnect (/opt/opencti/build/src/graphql/sseMiddleware.js:588:47)\n at processStreamResult (/opt/opencti/build/src/database/redis.ts:599:3)\n at processStep (/opt/opencti/build/src/database/redis.ts:653:31)\n at processingLoop (/opt/opencti/build/src/database/redis.ts:670:13)\n at Object.shutdown (/opt/opencti/build/src/database/redis.ts:693:9)"
},
"level": "error",
"message": "Error in redis streams read for USER",
"timestamp": "2023-10-10T09:04:10.726Z",
"version": "5.10.3"
}
This seems to result in the connector Dropping the connection to openCTI:
{"timestamp": "2023-10-12T09:39:57.988733Z", "level": "DEBUG", "name": "urllib3.connectionpool", "message": "http://opencti:8080 "POST /graphql HTTP/1.1" 200 176"}
{"timestamp": "2023-10-12T09:40:37.990216Z", "level": "DEBUG", "name": "urllib3.connectionpool", "message": "Resetting dropped connection: opencti"}
SamuelHassine
changed the title
Elastic Connector delay
"TypeError: Cannot read properties of undefined (reading 'standard_id')\n at resolveAndPublishMissingRefs
Jan 21, 2024
SamuelHassine
changed the title
"TypeError: Cannot read properties of undefined (reading 'standard_id')\n at resolveAndPublishMissingRefs
TypeError: Cannot read properties of undefined (reading 'standard_id')\n at resolveAndPublishMissingRefs
Jan 21, 2024
Description
Environment
Reproducible Steps
Steps to create the smallest reproducible scenario:
Expected Output
Data would continue to flow through into Elastic, as new data comes in.Actual Output
After a few hours, data slowed so that the event would be created in elastic several hours/ days after it was in OpenCTI. We have confirmed this is due to OpenCTI. I believe this is related to the Graph QL API.Additional information
We have the following error messages:
{
"category": "APP",
"error": {
"context": {},
"message": "Cannot read properties of undefined (reading 'standard_id')",
"name": "TypeError",
"stack": "TypeError: Cannot read properties of undefined (reading 'standard_id')\n at resolveAndPublishMissingRefs (/opt/opencti/build/src/graphql/sseMiddleware.js:373:38)\n at resolveAndPublishDependencies (/opt/opencti/build/src/graphql/sseMiddleware.js:387:31)\n at hA.autoReconnect (/opt/opencti/build/src/graphql/sseMiddleware.js:588:47)\n at processStreamResult (/opt/opencti/build/src/database/redis.ts:599:3)\n at processStep (/opt/opencti/build/src/database/redis.ts:653:31)\n at processingLoop (/opt/opencti/build/src/database/redis.ts:670:13)"
},
"level": "error",
"message": "Error in redis streams read for USER",
"timestamp": "2023-10-10T08:56:26.356Z",
"version": "5.10.3"
}
{
"category": "APP",
"error": {
"context": {},
"message": "Cannot read properties of undefined (reading 'standard_id')",
"name": "TypeError",
"stack": "TypeError: Cannot read properties of undefined (reading 'standard_id')\n at resolveAndPublishMissingRefs (/opt/opencti/build/src/graphql/sseMiddleware.js:373:38)\n at resolveAndPublishDependencies (/opt/opencti/build/src/graphql/sseMiddleware.js:387:31)\n at hA.autoReconnect (/opt/opencti/build/src/graphql/sseMiddleware.js:588:47)\n at processStreamResult (/opt/opencti/build/src/database/redis.ts:599:3)\n at processStep (/opt/opencti/build/src/database/redis.ts:653:31)\n at processingLoop (/opt/opencti/build/src/database/redis.ts:670:13)\n at Object.shutdown (/opt/opencti/build/src/database/redis.ts:693:9)"
},
"level": "error",
"message": "Error in redis streams read for USER",
"timestamp": "2023-10-10T09:04:10.726Z",
"version": "5.10.3"
}
This seems to result in the connector Dropping the connection to openCTI:
{"timestamp": "2023-10-12T09:39:57.988733Z", "level": "DEBUG", "name": "urllib3.connectionpool", "message": "http://opencti:8080 "POST /graphql HTTP/1.1" 200 176"}
{"timestamp": "2023-10-12T09:40:37.990216Z", "level": "DEBUG", "name": "urllib3.connectionpool", "message": "Resetting dropped connection: opencti"}
We also get similar messages to OpenCTI-Platform/connectors#1446
Lastly, we get several error messages as refered to in #2373
Due to the several error messages, I am unable to ascertain a root cause.
Screenshots (optional)
The text was updated successfully, but these errors were encountered: