Custom connector fails to start. Unable to reach OpenCTI API

Please replace every line in curly brackets { like this } with an appropriate answer, and remove this line.

Description

Created my own custom connector to watch and parse JSON files from an FTP server folder and then pushes the parsed data to OpenCTI. The connector would fail to start. Error as seen below. DNS does’nt seem to be a problem here as other connectors installed (Alienvault for example has the same OPENCTI_URL config) works.

Environment

1. OS (where OpenCTI server runs): Ubuntu 20.04
2. OpenCTI version: 3.3.2
3. OpenCTI client: python 3.8

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Build custom connector: docker build -t opencti/connector-ftp-receiver:rolling .
2. copy/paste connector yml to opencti docker-compose.yml
3. start compose instance: docker-compose -f docker-compose.yml up -d

Expected Output

Connector should load and start watching for FTP folder contents.

Actual Output

 INFO:root:Listing Threat-Actors with filters null.
 INFO:root:{"errors":[{"message":"Cannot query field \"standard_id\" on type \"ThreatActor\".","locations":[{"line":8,"column":13}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"spec_version\" on type \"ThreatActor\".","locations":[{"line":11,"column":13}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"createdBy\" on type \"ThreatActor\". Did you mean \"created\", \"createdByRef\", \"created_at\", or \"creator\"?","locations":[{"line":14,"column":13}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"standard_id\" on type \"Identity\".","locations":[{"line":17,"column":21}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"spec_version\" on type \"Identity\".","locations":[{"line":20,"column":21}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"roles\" on type \"Identity\". Did you mean to use an inline fragment on \"User\"?","locations":[{"line":23,"column":21}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"x_opencti_aliases\" on type \"Identity\".","locations":[{"line":25,"column":21}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"objectLabel\" on type \"Identity\".","locations":[{"line":28,"column":21}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"x_opencti_organization_type\" on type \"Organization\".","locations":[{"line":39,"column":21}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"x_opencti_reliability\" on type \"Organization\". Did you mean \"reliability\"?","locations":[{"line":40,"column":21}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Unknown type \"Individual\".","locations":[{"line":42,"column":24}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"objectMarking\" on type \"ThreatActor\".","locations":[{"line":47,"column":13}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"objectLabel\" on type \"ThreatActor\".","locations":[{"line":62,"column":13}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"standard_id\" on type \"ExternalReference\".","locations":[{"line":75,"column":25}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"aliases\" on type \"ThreatActor\". Did you mean \"alias\"?","locations":[{"line":93,"column":13}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"threat_actor_types\" on type \"ThreatActor\". Did you mean \"parent_types\"?","locations":[{"line":94,"column":13}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"roles\" on type \"ThreatActor\". Did you mean \"notes\"?","locations":[{"line":97,"column":13}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"goals\" on type \"ThreatActor\". Did you mean \"goal\"?","locations":[{"line":98,"column":13}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"secondary_motivations\" on type \"ThreatActor\". Did you mean \"secondary_motivation\", \"primary_motivation\", or \"personal_motivation\"?","locations":[{"line":102,"column":13}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}},{"message":"Cannot query field \"personal_motivations\" on type \"ThreatActor\". Did you mean \"personal_motivation\", \"primary_motivation\", or \"secondary_motivation\"?","locations":[{"line":103,"column":13}],"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}}]}

 OpenCTI API is not reachable. Waiting for OpenCTI API to start or check your configuration...

Additional information

docker-compose.yml:

  connector-ftp-receiver:
    image: opencti/connector-ftp-receiver:rolling
    environment:
      - OPENCTI_URL=http://opencti:8080
      - OPENCTI_TOKEN={token}
      - CONNECTOR_ID={connector id}
      - CONNECTOR_TYPE=EXTERNAL_IMPORT
      - CONNECTOR_NAME=FTP Receiver
      - CONNECTOR_SCOPE=identity,attack-pattern,course-of-action,intrusion-set,malware,tool,report,external-reference-as-report
      - CONNECTOR_CONFIDENCE_LEVEL=3
      - CONNECTOR_UPDATE_EXISTING_DATA=False
      - CONNECTOR_LOG_LEVEL=info
      - FTP_SERVER_ADDRESS={ip address}
      - FTP_USERNAME={username}
      - FTP_PASSWORD={password}
      - FTP_FOLDER_IN=in
      - FTP_FOLDER_OUT=out
      - FTP_INTERVAL=600 # Seconds (10 minutes)
    restart: always

[timebotdon]

Did the change and rebuilt the connector. It works now! Thanks alot for the help!

[richard-julien]

I think you can use pycti==3.3.3 in your requirements.txt