Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Load STIX/Taxii feeds from Opentaxii server into HBASE Failed

Load STIX/Taxii feeds from Opentaxii server into HBASE Failed

New Contributor

The version of Metron is 0.4.0. Deploying opentaxii role and fetching latest opentaxii feeds is finished correctly.Then I got a mistake at loading opentaxii feeds into hbase as follows.

[root@node1 ~]# /usr/metron/0.4.0/bin/threatintel_taxii_load.sh -b "2016-08-01 00:00:00" -c ~/connection_config.json -e ~/extractor.json -p 10000
17/08/22 03:35:01 WARN extractor.TransformFilterExtractorDecorator: Unable to setup zookeeper client - zk_quorum url not provided. **This will limit some Stellar functionality**
Exception in thread "main" java.lang.IllegalStateException: Extractor must be a STIX Extractor
at org.apache.metron.dataloads.nonbulk.taxii.TaxiiLoader.main(TaxiiLoader.java:202)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.hadoop.util.RunJar.run(RunJar.java:233)
at org.apache.hadoop.util.RunJar.main(RunJar.java:148)

Any help will be appreciated.

5 REPLIES 5
Highlighted

Re: Load STIX/Taxii feeds from Opentaxii server into HBASE Failed

Rising Star

This is a known bug that has been fixed in master. Here are pointers to more information. Sorry that you ran into this problem.

Re: Load STIX/Taxii feeds from Opentaxii server into HBASE Failed

New Contributor

Thanks for your replay, I sovled this .

Re: Load STIX/Taxii feeds from Opentaxii server into HBASE Failed

New Contributor

Thanks for your help, I handled this; but another problem shows up as follows:

[root@node1 ~]# /usr/metron/0.4.0/bin/threatintel_taxii_load.sh -c ~/connection_config.json -e ~/extractor.json -p 10000
17/08/23 02:35:46 WARN extractor.TransformFilterExtractorDecorator: Unable to setup zookeeper client - zk_quorum url not provided. **This will limit some Stellar functionality**
17/08/23 02:35:46 INFO taxii.TaxiiHandler: Loading configuration: TaxiiConnectionConfig{endpoint=http://localhost:9000/services/discovery, port=443, proxy=null, username='guest', password='******', type=DISCOVER, allowedIndicatorTypes=, collection='guest.phishtank_com', subscriptionId='null', beginTime=null, table=threatintel:t}
17/08/23 02:35:46 INFO taxii.TaxiiHandler: Initializing client..
17/08/23 02:35:46 INFO taxii.TaxiiHandler: Discovering endpoint
17/08/23 02:35:48 INFO taxii.TaxiiHandler: Request made : org.mitre.taxii.messages.xml11.DiscoveryRequest => org.mitre.taxii.messages.xml11.DiscoveryResponse (expected org.mitre.taxii.messages.xml11.DiscoveryResponse)
17/08/23 02:35:48 INFO taxii.TaxiiHandler: Discovered endpoint as http://localhost:9000/services/poll
17/08/23 02:35:48 INFO taxii.TaxiiHandler: Configured, starting polling http://localhost:9000/services/poll for guest.phishtank_com
17/08/23 02:35:48 INFO taxii.TaxiiHandler: Polling...8/23/17 2:35 AM
17/08/23 02:35:48 INFO taxii.TaxiiHandler: Request made : org.mitre.taxii.messages.xml11.PollRequest => org.mitre.taxii.messages.xml11.PollResponse (expected org.mitre.taxii.messages.xml11.PollResponse)
17/08/23 02:35:48 INFO taxii.TaxiiHandler: Got Poll Response with 52 blocks
17/08/23 02:36:12 INFO taxii.TaxiiHandler: Processed 99 in 23636 ms, avg time: 7878
17/08/23 02:36:22 INFO taxii.TaxiiHandler: Polling...8/23/17 2:36 AM
17/08/23 02:36:22 INFO taxii.TaxiiHandler: Begin Time: 2017-08-23T06:35:48Z
17/08/23 02:36:23 INFO taxii.TaxiiHandler: Request made : org.mitre.taxii.messages.xml11.PollRequest => org.mitre.taxii.messages.xml11.PollResponse (expected org.mitre.taxii.messages.xml11.PollResponse)
17/08/23 02:36:23 INFO taxii.TaxiiHandler: Got Poll Response with 0 blocks
17/08/23 02:36:23 INFO taxii.TaxiiHandler: Polling...8/23/17 2:36 AM
17/08/23 02:36:23 INFO taxii.TaxiiHandler: Begin Time: 2017-08-23T06:36:22Z
17/08/23 02:36:23 INFO taxii.TaxiiHandler: Request made : org.mitre.taxii.messages.xml11.PollRequest => org.mitre.taxii.messages.xml11.PollResponse (expected org.mitre.taxii.messages.xml11.PollResponse)

The information roll all the time, whats wrong with this?Look forward for your reply .

Re: Load STIX/Taxii feeds from Opentaxii server into HBASE Failed

Rising Star

It sounds like this is a different problem. Please submit it as a different question, instead of tagging onto this one. Thanks!

Re: Load STIX/Taxii feeds from Opentaxii server into HBASE Failed

New Contributor

okay , Thank you.

Don't have an account?
Coming from Hortonworks? Activate your account here