Analyzer creation : "invalid output"

[ovalrem]

Request Type

Bug

Work Environment

N/A

Description

Hi everyone, I'm currently facing an issue, and I don't know how to resolve it....
I'm trying to create my own analyzer : really simple, in python, based on the one which is provided for abuse_finder (because, it's probably a good example, and quite simple to understand).

Everytime I test it under cortex, I get an "invalid output" error message on the GUI, so no success. I precise that I don't use a responder. The code is only under analyzers/myscript/myscript.py. I juste have one requirement file, my script and so the json file.

What could be wrong ?
I tried to investigate about this error : by comparing my analyzer with some existing ones (who work), Check the rights on files in my folder (same rights for other analyzers that are working, with execution flax for the .py file)....
To be sure that it could not be a problem in my code, i keep it really simple : just a main function run, containing the result function that should give me a success (dict in argument, with something like a "hello world").

I see nothing in my program, that could be different that abuse_finder or everything else...

Important : I also have a problem with my shebang : #!/usr/bin/env python
When I run my analyzer, Cortex in addition returns me the following messgae with the "invalid output" one: "#!/usr/bin/env python unable to find this file (not the exact sentence)". Really strange, cause it's the same shebang in every analyzers.... that are working in those ones. (BTW it seems to work instead with #!/usr/bin/python).

Possible Solutions

• Rights...
• Something that I don't do, or that I'm currently doing wrong (in my code)...

Complementary information

No screen for the moment. I could provide some with my code in the future, if no suggestions about the problem.

[nadouani]

Hello @ovalrem

Invalid Output error means that the result returned by the analyzer doesn't have the expected format:

• check it's valid JSON (remove and debug prints)
• check it has the following schema: https://github.com/TheHive-Project/CortexDocs/blob/master/api/how-to-create-an-analyzer.md#output

[ovalrem]

Hello and thank you for the quick answer.
I just find this :
#331
I could maybe facing the same issue.
I will check that in the next days.

[ovalrem]

It seems that the problem is due to something regarding the python editor...
Could you say me what's you are using to type your code ?

The strange thing is the following :
I write my own simple "hello world" code for my own analyser, and have this two errors for my module.
But if I copy and paste an existing analyzer, change the code in the py file by my simple code and produce my own json, everything seems OK.

(files and folders rights are OK, regarding chmod, chgrp, chown).

If you have more information about the way you're typing the code (editor, indentations, names of files and flavors ? maybe there is a key that I do not understand for the moment).

[nadouani]

You can use PyCharm, Atom, VSCode, Vi, I mean any text editor.

[ovalrem]

Thank you, I will try this. I've only test with Gedit and nano for the moment.