Skip to content

[microsoft-sentinel-incidents] Exception when converting "remediations" information in the description #4081

@romain-filigran

Description

@romain-filigran

Description

An exception is observed when formatting the description and processing the "remediations" information.
The problem is critical as it seems to block the connector execution.

Here the stacktrace:

"exc_info": "Traceback (most recent call last):\n File \"/opt/opencti-connector-microsoft-sentinel-incidents/microsoft_sentinel_incidents_connector/connector.py\", line 399, in process_message\n incident_stix_objects = self._extract_intelligence(\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^\n File \"/opt/opencti-connector-microsoft-sentinel-incidents/microsoft_sentinel_incidents_connector/connector.py\", line 117, in _extract_intelligence\n stix_incident = self.converter_to_stix.create_incident(alert)\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n File \"/opt/opencti-connector-microsoft-sentinel-incidents/microsoft_sentinel_incidents_connector/converter_to_stix.py\", line 29, in decorator\n return decorated_function(self, *args, **kwargs)\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n File \"/opt/opencti-connector-microsoft-sentinel-incidents/microsoft_sentinel_incidents_connector/converter_to_stix.py\", line 92, in create_incident\n f\"**Remediation**: \\n{''.join([f\"{step} \\n\" for step in json.loads(alert.get('RemediationSteps', \"[]\"))])} \\n\"\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n File \"/usr/local/lib/python3.12/json/__init__.py\", line 346, in loads\n return _default_decoder.decode(s)\n ^^^^^^^^^^^^^^^^^^^^^^^^^^\n File \"/usr/local/lib/python3.12/json/decoder.py\", line 338, in decode\n obj, end = self.raw_decode(s, idx=_w(s, 0).end())\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n File \"/usr/local/lib/python3.12/json/decoder.py\", line 356, in raw_decode\n raise JSONDecodeError(\"Expecting value\", s, err.value) from None\njson.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)"

Environment

OpenCTI version: 6.6.14

Metadata

Metadata

Assignees

Labels

buguse for describing something not working as expectedcriticaluse to identify critical bug to fix ASAPregressionsolveduse to identify issue that has been solved (must be linked to the solving PR)

Type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions