timesketch: YETI analyzer does not work
when trying to analyze timeline through YETI, im getting an error, it seems to me that the problem is with timesketch but if not i will forward it to YETI
Timesketch version: 20230913
To Reproduce Steps to reproduce the behavior:
- analyze timeline with YETI
error in timesketch:
Traceback (most recent call last): File "/usr/local/lib/python3.10/dist-packages/requests/models.py", line 971, in json return complexjson.loads(self.text, **kwargs) File "/usr/lib/python3.10/json/__init__.py", line 346, in loads return _default_decoder.decode(s) File "/usr/lib/python3.10/json/decoder.py", line 337, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) File "/usr/lib/python3.10/json/decoder.py", line 355, in raw_decode raise JSONDecodeError("Expecting value", s, err.value) from None json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/local/lib/python3.10/dist-packages/timesketch/lib/analyzers/interface.py", line 1153, in run_wrapper result = self.run() File "/usr/local/lib/python3.10/dist-packages/timesketch/lib/analyzers/yetiindicators.py", line 107, in run self.get_indicators("x-regex") File "/usr/local/lib/python3.10/dist-packages/timesketch/lib/analyzers/yetiindicators.py", line 70, in get_indicators + response.json() File "/usr/local/lib/python3.10/dist-packages/requests/models.py", line 975, in json raise RequestsJSONDecodeError(e.msg, e.doc, e.pos) requests.exceptions.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
error in yeti:
yeti-yeti-1 | INFO:_internal:x.x.x.x - - [22/Oct/2023 07:26:20] "POST /api/indicators/filter/ HTTP/1.1" 405 - yeti-yeti-1 | ERROR:_internal:x.x.x.x - - [22/Oct/2023 07:26:20] code 400, message Bad request version ('"x-regex"}') yeti-yeti-1 | INFO:_internal:x.x.x.x - - [22/Oct/2023 07:26:20] "None /api/indicators/filter/ HTTP/0.9" HTTPStatus.BAD_REQUEST -
About this issue
- Original URL
- State: closed
- Created 8 months ago
- Comments: 15
i tried to upgrade the db before upgrading timesketch, as the guide say, “db current” didn’t gave result so i used “db history” and “db stamp <REVISION_ID>” (i replaced the revision with what i had) ran “db upgrade” and as far i remember it gave me the same result as “db current” did.
than i upgraded timesketch and each sketch i tried to enter gave an error… something with administrator… so i dropped the db and created a new user and now it’s seems fine i had only test sketches so i don’t really care, next time i wont be able to upgrade ill open a new bug thanks for all the help !