Error polling virus total

chirss — Fri, 08 Sep 2017 14:41:21 GMT

I'm running into an issue with the virus total miner. Once the API key is set it continues to throw this error:

2017-09-08T14:24:58 (2986)basepoller._actor_loop INFO: virustotal_notifications-green - command: 1504880698052 poll
2017-09-08T14:24:58 (2986)basepoller._polling_loop INFO: Polling virustotal_notifications-green
2017-09-08T14:24:58 (2986)connectionpool._new_conn INFO: Starting new HTTPS connection (1): www.virustotal.com
2017-09-08T14:24:58 (2986)basepoller._poll ERROR: Exception in polling loop for virustotal_notifications-green: No JSON object could be decoded
Traceback (most recent call last):
  File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/minemeld/ft/basepoller.py", line 721, in _poll
    performed = self._polling_loop()
  File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/minemeld/ft/basepoller.py", line 571, in _polling_loop
    iterator = self._build_iterator(now)
  File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/minemeld/ft/vt.py", line 88, in _build_iterator
    return super(Notifications, self)._build_iterator(now)
  File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/minemeld/ft/json.py", line 135, in _build_iterator
    result = self.extractor.search(r.json())
  File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/requests/models.py", line 819, in json
    return json.loads(self.text, **kwargs)
  File "/usr/lib/python2.7/json/__init__.py", line 338, in loads
    return _default_decoder.decode(s)
  File "/usr/lib/python2.7/json/decoder.py", line 366, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/lib/python2.7/json/decoder.py", line 384, in raw_decode
    raise ValueError("No JSON object could be decoded")
ValueError: No JSON object could be decoded
2017-09-08T14:24:59 (2986)basepoller._polling_loop INFO: Polling virustotal_notifications-green
2017-09-08T14:24:59 (2986)connectionpool._new_conn INFO: Starting new HTTPS connection (1): www.virustotal.com
2017-09-08T14:24:59 (2986)basepoller._poll ERROR: Exception in polling loop for virustotal_notifications-green: No JSON object could be decoded
Traceback (most recent call last):
  File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/minemeld/ft/basepoller.py", line 721, in _poll
    performed = self._polling_loop()
  File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/minemeld/ft/basepoller.py", line 571, in _polling_loop
    iterator = self._build_iterator(now)
  File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/minemeld/ft/vt.py", line 88, in _build_iterator
    return super(Notifications, self)._build_iterator(now)
  File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/minemeld/ft/json.py", line 135, in _build_iterator
    result = self.extractor.search(r.json())
  File "/opt/minemeld/engine/0.9.42/local/lib/python2.7/site-packages/requests/models.py", line 819, in json
    return json.loads(self.text, **kwargs)
  File "/usr/lib/python2.7/json/__init__.py", line 338, in loads
    return _default_decoder.decode(s)
  File "/usr/lib/python2.7/json/decoder.py", line 366, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/lib/python2.7/json/decoder.py", line 384, in raw_decode
    raise ValueError("No JSON object could be decoded")
ValueError: No JSON object could be decoded
2017-09-08T14:25:04 (2986)basepoller._actor_loop INFO: virustotal_notifications-green - command: 1504880698052 age_out

It's not liking something it's getting however I'm not seeing anything else in the logs to help figure this out.

Re: Error polling virus total

xhoms — Fri, 08 Sep 2017 15:07:35 GMT

@chirss : could you please take a look at the following comment? https://live.paloaltonetworks.com/t5/MineMeld-Articles/Using-MineMeld-as-a-Incident-Response-Platform/tac-p/175106#M153

Looks like you VT account lacks "Intelligence" subscription or that you haven't configured any YARA rule in your VT Hunting Panel.

Re: Error polling virus total

chirss — Fri, 08 Sep 2017 15:02:56 GMT

I guess I need to figure out why it won't let me get into the intelligence or hunting sections of the vt website. Thanks for pointing me in the right direction.

Re: Error polling virus total

chirss — Fri, 08 Sep 2017 15:12:41 GMT

Ah it's a paid subscription of some kind and I just have a freebie account. Makes sense.

Re: Error polling virus total

Nupagazy — Sun, 13 Jan 2019 06:26:46 GMT

I have VT intelligent account and created YARA rule but, still get the same error. When I access link

https://www.virustotal.com/intelligence/hunting/notifications-feed/?key=289dca4190400946e5078ffdccb280f18e4ea4941ff4a6a99dff1cb71ecbfd0f

it is blank.

Here are my YARA rulesets:

Re: Error polling virus total

lmori — Sun, 13 Jan 2019 08:46:50 GMT

Hi @Nupagazy,

MineMeld doesn't support v3 API yet, I have opened an issue on github to track this: https://github.com/PaloAltoNetworks/minemeld-core/issues/308

Luigi

Re: Error polling virus total

Nupagazy — Sun, 13 Jan 2019 09:54:16 GMT

Hi Luigi,

Thank you so much. I log in virustotal agaian and it turned back to old API version ( have no idea why) . It works now

Best REgards,

topic Re: Error polling virus total in General Topics

Error polling virus total

Re: Error polling virus total

Re: Error polling virus total

Re: Error polling virus total

Re: Error polling virus total

Re: Error polling virus total

Re: Error polling virus total