Hybrid Analysis analyzer successful even if rate limit reached

[srilumpa]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Debian
Cortex Analyzer Name	HybridAnalysis
Cortex Analyzer Version	1.0
Cortex Version	1.1.4-1

Description

If the rate limit is reached when querying the Hybrid Analysis service, the analyzer return a successful state instead of an error, like the VirusTotal analyzer for example.

I know that with Cortex 2, rate limit can be handled in the configuration, but the analyzer shoudl still alert for this kind of problem instead of letting go smoothly the fact that the query failed.

Steps to Reproduce

(keep this section only if the issue relates to a bug)

1. Reach your limit of query for the Hybrid Analysis service
2. Submit a new job with the analyzer
3. See the job set as successful even if the result states the rate limit was reached

Possible Solutions

Apply a logic similar to the VirusTotal analyzer and trigger an error if the rate limit is reached.

Complementary information

Current report when the rate limiter is triggered:

{
  "artifacts": [],
  "full": {
    "results": {
      "response_code": -1,
      "response": {
        "error": "Exceeded maximum API requests per minute (5). Please try again later or contact support for other options."
      }
    }
  },
  "summary": {},
  "success": true
}

Expected report when rate limiter is triggered

{
  "errorMessage": "Exceeded maximum API requests per minute (5). Please try again later or contact support for other options.",
  "input": {
    "dataType": "hash",
    "config": {
      "max_tlp": 3,
      "check_tlp": true,
      "service": "get",
      "key": "REMOVED"
    },
    "tlp": 2,
    "data": "[redacted]"
  },
  "success": false
}

[saadkadhi]

@srilumpa please confirm that you are not analyzing the same observable with the same TLP within cache.job period (10 mins).

[nadouani]

@saadkadhi This is an issue on the Analyzer side that doesn't handle the "Hybrid Analysis" rate limit reached error. It's not related to the rate limiting configured on Cortex.

[srilumpa]

Yes, we are not using Cortex2 for now (we are currently planning the migration to it)

[nadouani]

Well, I've just took a look to the analyzer and found this:

if "error" in r.json().get('response') == "Exceeded maximum API requests per minute(5). Please try again later."

It looks like the rate limit text has been changed from HybridAnalysis, so the Analyzer is no longer handling the error correctly. This is bad :)

[3c7]

Check for that specific error fits now for both error message variations.