Estreamer FMC and Azure Sentinel

[MatheusMendes26336]

Hi, 

I'm trying to connect the Estreamer with OMSagent, so i can send log to Sentinel, but i'm receiving this error.

Process Process-1:
Traceback (most recent call last):
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/baseproc.py", line 111, in _start
callback()
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/receiver.py", line 159, in next
self._parseMessageBundle( message )
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/receiver.py", line 111, in _parseMessageBundle
self._send( message )
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/receiver.py", line 143, in _send
self.callback( message )
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/pipeline.py", line 475, in onEvent
parseDecorateTransformWrite( message, self.settings )
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/pipeline.py", line 256, in parseDecorateTransformWrite
event = transform( event, settings )
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/pipeline.py", line 205, in transform
output = adapters[ index ].dumps( event['record'] )
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/adapters/cef. py", line 822, in dumps
return cefAdapter.dumps()
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/adapters/cef. py", line 812, in dumps
self.__convert()
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/adapters/cef. py", line 756, in __convert
self.output[ key ] = Cef.__sanitize( self.output[ key ] )
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/adapters/cef. py", line 708, in __sanitize
if not isinstance( value, basestring
NameError: name 'basestring' is not defined

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/lib/python3.8/multiprocessing/process.py", line 315, in _bootstrap
self.run()
File "/usr/lib/python3.8/multiprocessing/process.py", line 108, in run
self._target(*self._args, **self._kwargs)
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/pipeline.py", line 467, in __init__
super( SingleWorker, self ).__init__(
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/pipeline.py", line 280, in __init__
super( Subscriber, self ).__init__(
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/baseproc.py", line 293, in __init__
super( BatchQueueProcess, self ).__init__(
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/baseproc.py", line 136, in __init__
self.start()
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/pipeline.py", line 302, in start
self._start( self.receiver.next )
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/baseproc.py", line 118, in _start
self.logger.exception(ex)
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/crossprocessl ogging/baseClient.py", line 106, in exception
data = self.__serialise( data, True )
File "/home/suporte/fp-05-microsoft-sentinel-connector/estreamer/crossprocessl ogging/baseClient.py", line 35, in __serialise
message = data.__class__.__name__ + ': ' + data.message
AttributeError: 'NameError' object has no attribute 'message'

It is a Ubuntu 20.04.3 VM using python3.

[pactag23]

Hi, did you ever find a solution for this? I am facing exactly the same problem.

[AshbyJohnDNV]

Hi, great post have a few issues in trying to get this working too..... 

oot@GSS-IT-Sentinel-eStreamer-DataGateway:/home/azureuser/fp-05-firepower-cli# ./encore.sh test
2024-09-09T08:53:26.101115 Diagnostics  INFO  Checking that configFilepath (estreamer.conf) exists
2024-09-09 08:53:26,111 Diagnostics  INFO     Check certificate
2024-09-09 08:53:26,111 Diagnostics  INFO     Creating connection
2024-09-09 08:53:26,111 Connection   INFO     Connecting to 172.22.66.150:8302
2024-09-09 08:53:26,112 Connection   INFO     Using TLS v1.0
Traceback (most recent call last):
  File "/home/azureuser/fp-05-firepower-cli/./estreamer/diagnostics.py", line 169, in main
    diagnostics.execute()
  File "/home/azureuser/fp-05-firepower-cli/./estreamer/diagnostics.py", line 83, in execute
    connection.connect()
  File "/home/azureuser/fp-05-firepower-cli/estreamer/connection.py", line 73, in connect
    self.socket = ssl.wrap_socket(
                  ^^^^^^^^^^^^^^^^
TypeError: SSLContext.wrap_socket() got an unexpected keyword argument 'keyfile'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/azureuser/fp-05-firepower-cli/./estreamer/diagnostics.py", line 180, in <module>
    Diagnostics.main()
  File "/home/azureuser/fp-05-firepower-cli/./estreamer/diagnostics.py", line 175, in main
    logger.exception(ex)
  File "/home/azureuser/fp-05-firepower-cli/estreamer/crossprocesslogging/baseClient.py", line 106, in exception
    data = self.__serialise( data, True )
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/azureuser/fp-05-firepower-cli/estreamer/crossprocesslogging/baseClient.py", line 35, in __serialise
    message = data.__class__.__name__ + ': ' + data.message