so-playbook-sync takes a long run time #7394

sleepingbel · 2022-03-02T15:22:06Z

sleepingbel
Mar 2, 2022

Hello all,

SO 2.3.100 Hotfix [20220301] standalone
8 vCores
24 vRAM
1TB diskspace

The hive is not installed and following extra sigma rulesets installed:
- network
- generic
- web
- application
- apt
- compliance
- proxy

When I give the so-playbook-sync command myself, I always see an error because the hive template cannot be created.

TheHive Template Creation Failed: {'_content': b'<html>\r\n<head><title>401 Authorization Required</title></head>\r\n<body>\r\n<center><h1>401 Authorization Required</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n', '_content_consumed': True, '_next': None, 'status_code': 401, 'headers': {'Server': 'nginx', 'Date': 'Wed, 02 Mar 2022 15:09:51 GMT', 'Content-Type': 'text/html', 'Content-Length': '172', 'Connection': 'keep-alive'}, 'raw': <urllib3.response.HTTPResponse object at 0x7facf1872280>, 'url': 'https://seconion2.thuisvanhees.net/thehive/api/case/template', 'encoding': 'ISO-8859-1', 'history': [], 'reason': 'Unauthorized', 'cookies': <RequestsCookieJar[]>, 'elapsed': datetime.timedelta(microseconds=25784), 'request': <PreparedRequest [POST]>, 'connection': <requests.adapters.HTTPAdapter object at 0x7facf2176640>}

I see also that with the errors it takes a lot of time and the windows rules passes quick

Is the hive realy needed for the playbook rules?

Suggestion: let the script first check if the hive is installed

Regards

Bart