Having problems with your account or logging in?
A lot of changes are happening in the community right now. Some may affect you. READ MORE HERE
Respected Contributor.. Stephen Kreusch Respected Contributor..
Respected Contributor..
1011 views

arcsight-taxii-client Python error - AttributeError: 'list' object has no attribute 'split'

Jump to solution

Hi

The problem I am having is with collecting threat intel using arcsight-taxii-client on a scheduled / automated basis.

Version:  arcsight-taxii-client 1.1.3

If I run the client manually I am prompted to enter the password and it successfully polls the threat intel feed:

# /opt/rh/python27/root/usr/bin/arcsight-taxii-client <redacted> /taxii --poll <collection_name> --auth basic --username <redacted> --password --log /opt/arcsight/Connectors/stix_taxii/client/logs --output /opt/arcsight/Connectors/stix_taxii/client/data --hours 24
Password:
2018-08-07 16:17:07,554 : INFO : Polling <collection_name>
2018-08-07 16:17:07,555 : INFO : Storing temporary data on disk
2018-08-07 16:17:22,411 : INFO : Writing data to /opt/arcsight/Connectors/stix_taxii/client/data/out_YLaLWr.csv

The FlexConnector processes the file successfully and I see the data in ESM.

However, there appears to be no option for passing the password on the command line, so I cannot automate the process.

To automate, it appears I need to use a config file.

I created the config file using arcsight-taxii-client --create-config

I edited the config file and changed the password from 'password = changeme' to the correct value.

The resulting config file is:

# cat <collection_name>.conf
[app]
us-cert = False
memory = False
cleanup = True

[server]
hostname = <redacted>
port = None
path = /taxii
https = True
auth_type = basic
username = <redacted>
password = <redacted>
collections = <redacted>
auto = False
begin_date = None
end_date = None

<snip>

Running the client with the config file produces this error:

# /opt/rh/python27/root/usr/bin/arcsight-taxii-client --conf <collection_name>.conf --hours 24
2018-08-07 14:54:41,699 : INFO : Using configuration file.
2018-08-07 14:54:41,703 : CRITICAL : Error occurred while running client, see log file for debug information

Log entries:

2018-08-07 14:54:41,699 : arcsight_stix_taxii : INFO : Using configuration file.
2018-08-07 14:54:41,703 : arcsight_stix_taxii : CRITICAL : Error occurred while running client, see log file for debug information
2018-08-07 14:54:41,704 : arcsight_stix_taxii : DEBUG : Error occurred while running client: 'list' object has no attribute 'split'
Traceback (most recent call last):
  File "/opt/rh/python27/root/usr/lib/python2.7/site-packages/arcsight_stix_taxii/client.py", line 734, in main
    begin_date=begin_date, end_date=end_date)
  File "/opt/rh/python27/root/usr/lib/python2.7/site-packages/arcsight_stix_taxii/client.py", line 287, in read_config
    collections = collections.split(',')
AttributeError: 'list' object has no attribute 'split'

Has anyone encountered this issue and what was the solution?

Regards
Stephen

0 Likes
1 Solution

Accepted Solutions
Respected Contributor.. Stephen Kreusch Respected Contributor..
Respected Contributor..

Re: arcsight-taxii-client Python error - AttributeError: 'list' object has no attribute 'split'

Jump to solution

>> just a workaround: create configuration file for every collection seperately and use them in your automation.

I was using a single config file per collection, but always go the same error.

 

>> another workaround: If it's possible, write a small script that runs the command and waits for the pasword prompt, and then provides the password

Thanks for the suggestion.  I went this route, using Expect.  In case this is useful to others, here's the script:

#!/usr/bin/expect

# Set expect variables
log_file /opt/arcsight/Connectors/stix_taxii/client/logs/expect.log

# Set arcsight-taxii-client variables
set client /opt/rh/python27/root/usr/bin/arcsight-taxii-client
set logdir /opt/arcsight/Connectors/stix_taxii/client/logs
set outputdir /opt/arcsight/Connectors/stix_taxii/client/data
set proxy yourproxy.local:80

# TAXII collection variables
set taxii_hostname api.xforce.ibmcloud.com
set taxii_path /taxii
set authtype basic
set username xxxxx-redacted-xxxxx
set password xxxxx-redacted-xxxxx\r
# Note that the carriage return at the end of the password is important
set hours 1

set collections [list xfe.ipr.botnet.command.and.control.server xfe.url.botnet.command.and.control.server xfe.ipr.bots xfe.url.malware xfe.ipr.malware xfe.url.phishing.urls xfe.ipr.cryptocurrency.mining xfe.url.spam.urls xfe.ipr.scanning.ips xfe.ipr.spam xfe.url.cryptocurrency.mining xfe.ipr.anonymisation.services xfe.url.computer.crime.hacking xfe.url.anonymisation.services]

# This is needed because arcsight-taxii-client writes the log file to the current directory regardless of the --log directory you specify:
cd $logdir

foreach collection $collections {
    set timeout 60
    spawn $client $taxii_hostname $taxii_path --poll $collection --auth $authtype --username $username --password --log $logdir --output $outputdir --proxy $proxy --hours $hours
    match_max 100000
    expect -exact "Password: "
    send -- $password
    expect eof
}

 

Regards, Stephen

0 Likes
6 Replies
Highlighted
Respected Contributor.. Stephen Kreusch Respected Contributor..
Respected Contributor..

Re: arcsight-taxii-client Python error - AttributeError: 'list' object has no attribute 'split'

Jump to solution

Service Request SD02257003 logged with Support earlier this week.

0 Likes
Knowledge Partner
Knowledge Partner

Re: arcsight-taxii-client Python error - AttributeError: 'list' object has no attribute 'split'

Jump to solution

just a workaround: create configuration file for every collection seperately and use them in your automation.

another workaround: If it's possible, write a small script that runs the command and waits for the pasword prompt, and then provides the password. my first google result : https://stackoverflow.com/questions/4857702/how-to-provide-password-to-a-command-that-prompts-for-one-in-bash

------------------------------------
Please use the Like button below, if you find this post useful or mark it as an accepted solution if it resolves your issue.
0 Likes
orson.yu@nychhc1 Contributor.
Contributor.

Re: arcsight-taxii-client Python error - AttributeError: 'list' object has no attribute 'split'

Jump to solution

Hi mr_ergene,

Tried a config file with a single collection, and still it gives exactly the same error. If I'm not mistaken, this error is not unique to the limo.anomali.com site, it also happens when using config file with the hailataxii.com.

Thanks

Orson

0 Likes
Respected Contributor.. Stephen Kreusch Respected Contributor..
Respected Contributor..

Re: arcsight-taxii-client Python error - AttributeError: 'list' object has no attribute 'split'

Jump to solution

>> just a workaround: create configuration file for every collection seperately and use them in your automation.

I was using a single config file per collection, but always go the same error.

 

>> another workaround: If it's possible, write a small script that runs the command and waits for the pasword prompt, and then provides the password

Thanks for the suggestion.  I went this route, using Expect.  In case this is useful to others, here's the script:

#!/usr/bin/expect

# Set expect variables
log_file /opt/arcsight/Connectors/stix_taxii/client/logs/expect.log

# Set arcsight-taxii-client variables
set client /opt/rh/python27/root/usr/bin/arcsight-taxii-client
set logdir /opt/arcsight/Connectors/stix_taxii/client/logs
set outputdir /opt/arcsight/Connectors/stix_taxii/client/data
set proxy yourproxy.local:80

# TAXII collection variables
set taxii_hostname api.xforce.ibmcloud.com
set taxii_path /taxii
set authtype basic
set username xxxxx-redacted-xxxxx
set password xxxxx-redacted-xxxxx\r
# Note that the carriage return at the end of the password is important
set hours 1

set collections [list xfe.ipr.botnet.command.and.control.server xfe.url.botnet.command.and.control.server xfe.ipr.bots xfe.url.malware xfe.ipr.malware xfe.url.phishing.urls xfe.ipr.cryptocurrency.mining xfe.url.spam.urls xfe.ipr.scanning.ips xfe.ipr.spam xfe.url.cryptocurrency.mining xfe.ipr.anonymisation.services xfe.url.computer.crime.hacking xfe.url.anonymisation.services]

# This is needed because arcsight-taxii-client writes the log file to the current directory regardless of the --log directory you specify:
cd $logdir

foreach collection $collections {
    set timeout 60
    spawn $client $taxii_hostname $taxii_path --poll $collection --auth $authtype --username $username --password --log $logdir --output $outputdir --proxy $proxy --hours $hours
    match_max 100000
    expect -exact "Password: "
    send -- $password
    expect eof
}

 

Regards, Stephen

0 Likes
Micro Focus Expert
Micro Focus Expert

Re: arcsight-taxii-client Python error - AttributeError: 'list' object has no attribute 'split'

Jump to solution

Do you have more than 1 version of python installed? What is the ouput of this command?

python -V

It might be that you are on a newer/older version than supported.

-----------------------------------------------------------------------------------------
All topics and replies made is based on my personal opinion, viewpoint and experience, it does not represent the viewpoints of MicroFocus.
All replies is based on best effort, and can not be taken as official support replies.
//Marius
0 Likes
Respected Contributor.. Stephen Kreusch Respected Contributor..
Respected Contributor..

Re: arcsight-taxii-client Python error - AttributeError: 'list' object has no attribute 'split'

Jump to solution

python -V shows:

Python 2.7.5

 

The STIX-TAXII_Install_and_Configure_for_ArcSight.pdf document states the requirements are being:

Python version 2.7 or 3.6

 

I get the same error on Linux with Python 2.7.5, and on Windows with Python 2.7.15 (latest).

 

Per https://stackoverflow.com/questions/30042334/attribute-error-list-object-has-no-attribute-split and https://stackoverflow.com/questions/26942061/attributeerror-list-object-has-no-attribute-split/26942345, this seems to be a coding issue and:

Lists in python do not have a split method. split is a method of strings(str.split())

 

Regards, Stephen

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.