Recorded Future Integration Package Setup Stack Traces

Elastic Stack Kibana
#1

Setting up the Recorded Future integration package. Package installed smoothly and I was setting up feeds for domain, hash, url, ip.

When setting up the url feed, I got an error when clicking Save. Believe it was from choosing the same Integration name as a previously configured feed.

I canceled setup for the new feed. Since that step, when I navigate to the integration and choose Integration Policies, I get a stack trace.

I am able to run configuration for a new feed by choosing "+ Add Recorded Future", but after saving, I also see a stack trace.

Here is a copy of the stack trace:

Error: Cannot read properties of undefined (reading 'agents')
    at render (http://172.30.129.161:5601/50668/bundles/plugin/fleet/kibana/fleet.chunk.0.js:18:10692)
    at n.value (http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:197657)
    at http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:195107
    at Array.forEach (<anonymous>)
    at n.value (http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:194931)
    at http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:193806
    at Array.map (<anonymous>)
    at n.value (http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:193699)
    at n.value (http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:189176)
    at n.value (http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:188630)

Here is a screenshot of the problematic tab:

Screen Shot 2022-04-28 at 5.16.44 PM
Screen Shot 2022-04-28 at 5.16.44 PM1269×379 52.7 KB

#2

Hi @codewriterguy

I think your configuration got corrupted somehow, we use two different document (saved objects) to store agent policies and package policy and I think you probably have a package policy referring an agent policy that do not exists anymore.

I created a bug ticket in Kibana so we can have a better experience for that [Fleet] Do not crash when a package policy refer a non existing agent policy · Issue #131928 · elastic/kibana · GitHub

In the mean time you could probably delete the problematic saved object from the .kibana index (be carefull of what you delete in that index) and use those queries to find the problematic package policy

GET .kibana/_search?q=type:ingest-agent-policies
{
  "fields": [],
  "_source": false
}

GET .kibana/_search?q=type:ingest-package-policies
{
  "fields": [
    "ingest-package-policies.policy_id"
  ],
  "_source": false
}

Let me know if it work for you

1 Like
#3

Thank you for filing a bug ticket on this! I will take a look with these queries and see what I can do, and report back here