Playbook - TheHive Template Creation Failed

[greatapoc]

2.3.2 Standalone

I've attempted to activate some plays in Playbook and then ran so-playbook-sync. It then gives me this output (and on and on until I ctrl+c):

[root@securityonion so]# so-playbook-sync
TheHive Template Creation Failed: {'_content': b'{"type":"java.lang.RuntimeException","message":"HttpResponse(403,Some(StringEntity({\"error\":{\"root_cause\":[{\"type\":\"cluster_block_exception\",\"reason\":\"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];\"}],\"type\":\"cluster_block_exception\",\"reason\":\"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];\"},\"status\":403},Some(UTF-8))),Map(content-type -> application/json; charset=UTF-8, content-length -> 259))"}', '_content_consumed': True, '_next': None, 'status_code': 500, 'headers': {'Server': 'nginx/1.17.10', 'Date': 'Mon, 02 Nov 2020 22:41:09 GMT', 'Content-Type': 'application/json', 'Content-Length': '457', 'Connection': 'keep-alive'}, 'raw': <urllib3.response.HTTPResponse object at 0x7fdc5d3976d0>, 'url': 'https://securityonion/thehive/api/case/template', 'encoding': None, 'history': [], 'reason': 'Internal Server Error', 'cookies': <RequestsCookieJar[]>, 'elapsed': datetime.timedelta(microseconds=47279), 'request': <PreparedRequest [POST]>, 'connection': <requests.adapters.HTTPAdapter object at 0x7fdc5d3e4d90>}
TheHive Template Creation Failed: {'_content': b'{"type":"java.lang.RuntimeException","message":"HttpResponse(403,Some(StringEntity({\"error\":{\"root_cause\":[{\"type\":\"cluster_block_exception\",\"reason\":\"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];\"}],\"type\":\"cluster_block_exception\",\"reason\":\"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];\"},\"status\":403},Some(UTF-8))),Map(content-type -> application/json; charset=UTF-8, content-length -> 259))"}', '_content_consumed': True, '_next': None, 'status_code': 500, 'headers': {'Server': 'nginx/1.17.10', 'Date': 'Mon, 02 Nov 2020 22:41:13 GMT', 'Content-Type': 'application/json', 'Content-Length': '457', 'Connection': 'keep-alive'}, 'raw': <urllib3.response.HTTPResponse object at 0x7fdc5d3976d0>, 'url': 'https://securityonion/thehive/api/case/template', 'encoding': None, 'history': [], 'reason': 'Internal Server Error', 'cookies': <RequestsCookieJar[]>, 'elapsed': datetime.timedelta(microseconds=49209), 'request': <PreparedRequest [POST]>, 'connection': <requests.adapters.HTTPAdapter object at 0x7fdc5d4e6250>}

[weslambert]

Sounds like you got above the disk threshold value for ES. What is the output of df -h?

Try running the following and retrying the creation to see if it helps:

sudo so-elasticsearch-indices-rw
sudo so-thehive-restart

[greatapoc]

Thanks Wes, looks like those commands got it going. Playbook sync ran successfully.

[root@securityonion onion]# df -h
Filesystem Size Used Avail Use% Mounted on
devtmpfs 32G 0 32G 0% /dev
tmpfs 32G 340K 32G 1% /dev/shm
tmpfs 32G 26M 32G 1% /run
tmpfs 32G 0 32G 0% /sys/fs/cgroup
/dev/mapper/system-root 293G 42G 252G 15% /
/dev/sda2 492M 189M 303M 39% /boot
/dev/mapper/system-nsm 814G 720G 95G 89% /nsm
/dev/mapper/system-tmp 2.0G 50M 1.9G 3% /tmp
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/9f3fe2f7cb5cdcd449e4c621042d4a8ca9f4fcd1e84c73cb31a0f10043488c5d/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/017f0cadc85019febb50b95f343b1e74048708b59799d60a3828750109d86222/merged
tmpfs 6.3G 0 6.3G 0% /run/user/1000
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/586f4a6c6488c47e8af89984c0ddce2dc8abd11e9ad04af4a6b0a5ec65120a3e/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/ef5a7359a93ddc9ee49478ae66ac61adaa4f15d7399a1331f39f36943d6a8a1d/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/9fd6b808c12bd140aff3e0885b63e1bd0bce36a8471853ee6b6458f6d4671ec4/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/500b926d1dd12f924c482879c0001890d690fb40a94588a21ba5743e8cc88288/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/f20006123fd48146e31bb84534754e03471bc67779042656a589903ec9f714e3/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/5f8b842bb09939ffbd60187965d6dd20952ffe29a6276598d1f4cf8a4d2e9e6f/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/470198e07a0c18466262b2c2fd2e9fd3cf84291e18374391059d38111ffa576c/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/d6e611058da686e09294a4bfe36434ab4c03b57e2310046a4b59976eaeda969b/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/ffa5294c0d4596d06d5a119925a8c65b261327f32779ca5b6b28f00ecbc88cef/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/4889ee6bc4e3793a0a80cd6769d4c8a4bc30ad2ed20a453fee1a7eb52ea7c0c3/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/0e63c9908e00d1984e00aa9361a084e69e207899998dc2f695ece881079a3325/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/62d4cad209b55d3432547153c78e84763ce45704c103020d34acf22e59bb44b9/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/164bfabd05416a115f2f03f3db36b35e8ad0214da65df459d1c9fdab26384951/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/ffad90725b376410bb5312277e58fe79e517892539228720942b090d26ab6728/merged
tmpfs 6.3G 0 6.3G 0% /run/user/0
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/770975bee6007bb4f644a09e84811eaee47b2f51e6b30c403f73df493d42afd3/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/b0d743b5252da59affb45b489b141bed317781f219a27da54019e5f19dd8566a/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/fd82e00e0867e36eb397786d07a30f6ca5c7e581ff43f4587928f3e98819f731/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/7455577b729b887e6b9d2187988cca6bca49a9189491465b9e96cb7c182368bf/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/3faa3042f9d39b1012defdc319ec3fc4840c35d4ac3745f17f30e82c49182863/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/c343b3658502108844659b607e91431882a221e108944b045ac872a5a5f9da32/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/11cd2c472671dc92f59e8e043e71388dda8a9bd87b9e2e4a4880f5f311a19b4c/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/7f84a0e7bed867c1f539e5ca6a2008b2015cb295ec492c9f39e6a95380e7e152/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/55ae2dd51fbb5fc1b5f4744a238e544eceb6e4c2e58c31003338dae354657d35/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/7f3dfb8a70bfa50e39efd122253ff9891eeba142d95b0d91660bb3dfbe1b78e9/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/30ca6fb9592194aa7c105974da7efef159b6c3100f8178aa117986478bf03384/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/212de6692edcc5cc2222e6453a3ee5e0f2cc068adfdc83ba1b4a80e0b618eb1b/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/d6305f154718964b240b01c64540c764c37daa9c46489b4edb3bf57ca4cce855/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/9374d9cef457cb815ce4da754b476d9472d5e81caa620fd2bebe1564c299651e/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/929af94f3465d0b78e6d88a3de34d6c1b62c307da94b429bd60061ac6843656a/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/6d5b1fe3665d5859c03b95394e34387030e8882484d084f47d5d91fb58bc2bf7/merged
overlay 293G 42G 252G 15% /var/lib/docker/overlay2/4281b959ed44f0aecab4f3fe139c943011fac4c92ba4ff0f4a962503677f69b1/merged