"Request failed with status code 400" when escalating alerts.

[w4rc0n]

In the alerts menu in the SO 2.3.21 interface, when clicking the escalate icon, I receive that error at the top of the page.

[weslambert]

Are there any clues from the TheHive log, or docker logs so-thehive?

[w4rc0n]

Hey @weslambert thanks for the pointer. This is what docker logs so-thehive shows:

[warn] a.a.ActorSystemImpl - Illegal request, responding with status '400 Bad Request': Illegal HTTP message start
[error] o.e.s.a.MultiAuthSrv - Authentication failure
org.elastic4play.AuthenticationError: Authentication using API key is not supported
	at org.elastic4play.services.AuthSrv.authenticate(UserSrv.scala:48)
	at org.elastic4play.services.AuthSrv.authenticate$(UserSrv.scala:47)
	at services.LocalAuthSrv.authenticate(LocalAuthSrv.scala:19)
	at org.elastic4play.services.auth.MultiAuthSrv.$anonfun$authenticate$3(MultiAuthSrv.scala:58)
	at org.elastic4play.services.auth.MultiAuthSrv$$anonfun$$nestedInanonfun$forAllAuthProvider$1$1.applyOrElse(MultiAuthSrv.scala:43)
	at org.elastic4play.services.auth.MultiAuthSrv$$anonfun$$nestedInanonfun$forAllAuthProvider$1$1.applyOrElse(MultiAuthSrv.scala:41)
	at scala.concurrent.Future.$anonfun$recoverWith$1(Future.scala:417)
	at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:41)
	at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:64)
	at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:56)
[error] o.e.c.Authenticated - Authentication failure:
	session: AuthenticationError User session not found
	pki: AuthenticationError Certificate authentication is not configured
	key: AuthenticationError Authentication failure
	init: AuthenticationError Use of initial user is forbidden because users exist in database

Which also reminds me that when adding a new user to the main SO web page, it set up the user but spit out an error about setting their user in TheHive, so I'm guessing that's what happened during setup with the original user as well.

[w4rc0n]

Any clues as to what to look for next @weslambert ?

[weslambert]

To be clear, you've never been able to log into TheHive, correct?

[w4rc0n]

I can log into TheHive just fine with the user I setup during the initial SO install.

[w4rc0n]

I did a full reinstall, issue resolved.

[w4rc0n]

I take that back, even after a full reinstall, I can't escalate any alerts to thehive. Now I'm getting this error in the docker logs for so-thehive

[error] o.e.s.a.MultiAuthSrv - Authentication failure
org.elastic4play.AuthenticationError: Authentication using API key is not supported
	at org.elastic4play.services.AuthSrv.authenticate(UserSrv.scala:48)
	at org.elastic4play.services.AuthSrv.authenticate$(UserSrv.scala:47)
	at services.LocalAuthSrv.authenticate(LocalAuthSrv.scala:19)
	at org.elastic4play.services.auth.MultiAuthSrv.$anonfun$authenticate$3(MultiAuthSrv.scala:58)
	at org.elastic4play.services.auth.MultiAuthSrv$$anonfun$$nestedInanonfun$forAllAuthProvider$1$1.applyOrElse(MultiAuthSrv.scala:43)
	at org.elastic4play.services.auth.MultiAuthSrv$$anonfun$$nestedInanonfun$forAllAuthProvider$1$1.applyOrElse(MultiAuthSrv.scala:41)
	at scala.concurrent.Future.$anonfun$recoverWith$1(Future.scala:417)
	at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:41)
	at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:64)
	at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:56)
[error] o.e.c.Authenticated - Authentication failure:
	session: AuthenticationError User session not found
	pki: AuthenticationError Certificate authentication is not configured
	key: AuthenticationError Authentication failure
	init: AuthenticationError Use of initial user is forbidden because users exist in database

[JAEP2]

Hello, in my case i solved the error code 400 when escalated with the follow steps.

Copy thehive key from thehive user, and change it in /opt/so/saltstack/local/pillar/global.sls

You can see the key of the user in the thehive user settings, after that I can escalate alerts whithout any problem

I hope help you.

Kind regards

[B3DTech]

I'm seeing the same issue with the Hive. Do we not have an official solution for this one yet? Already on 2.3.50. My hive install doesn't appear to have a thehive user.

So when I look at the users in TheHive, I do not see the original account I created. Only the two I created since the initial install. If I go to do an so-thehive-user-enable [email protected], I get

so-thehive-user-enable [email protected] true

Failed to update user in TheHive
{"type":"AuthenticationError","message":"Authentication failure"}

In the log:

[error] o.e.c.Authenticated - Authentication failure:
session: AuthenticationError User session not found
pki: AuthenticationError Certificate authentication is not configured
key: AuthenticationError Authentication failure
init: AuthenticationError Use of initial user is forbidden because users exist in database

[B3DTech]

So is there a way to get this working again?

[feitan-root]

Good day Everyone!

Any update here. I also getting same error and logs error.

Is there any solution?

Thank you

[paintedrealms]

I am having this issue except I CAN log into the hive. It still won't let me acknowledge nor escalate on alerts. So my hive is empty.

[jimmypw]

[dougburks]

@jimmypw From #1720:

Start a new discussion instead of replying to somebody else's discussion
Please search to see if you can find similar discussions that may help you. However, in order to avoid confusion, please do NOT reply to somebody else's discussion with your own issue. Instead, please start a new discussion and simply provide a hyperlink to the related discussion.

[jimmypw]

I understand that... at the time I was providing additional, relevant information to an unanswered question. I see you have selected an answer now.

[dougburks]

Right, the original poster was w4c0n and he reported his issue as resolved on January 27.

If other folks are having similar issues and need help, please create a separate discussion in order to avoid confusion. Thanks!