Unexpected Error: list index out of range

[ghuser0234]

I'm using eml_parser with TheHive project and all analysis fails with

Unexpected Error: list index out of range

I'm not sure where else to find any other logging or info to troubleshoot this.

[sim0nx]

Can you test it outside of thehive? Does that work or produce the same error?

Try increasing the loglevel.

[ghuser0234]

I ran the script from 'Example on how to use:' quoted here
`import datetime
import json
import eml_parser

def json_serial(obj):
if isinstance(obj, datetime.datetime):
serial = obj.isoformat()
return serial

with open('sample.eml', 'rb') as fhdl:
raw_email = fhdl.read()

parsed_eml = eml_parser.eml_parser.decode_email_b(raw_email)

print(json.dumps(parsed_eml, default=json_serial))`

Running this returns a proper JSON output. However i'm not sure how to run the actual 'parse.py' that comes with the analyzers outside of thehive.

[sim0nx]

Ok so eml_parser does work then, it is more related to the integration to thehive, correct?

I have not worked with it yet, could you give me more pointers on what that "parse.py" is (+link) and what you are trying to do?

[ghuser0234]

Looking at the analyzer requirements here https://github.com/TheHive-Project/CortexDocs/blob/master/analyzer_requirements.md#emlparser it makes me think i'm using this GOVCERT-LU/eml_parser
parser.
However, looking at the actual analyzer that's downloaded https://github.com/TheHive-Project/Cortex-Analyzers/tree/master/analyzers/EmlParser the requirements.txt says to use this GOVCERTLU lib instead. I suppose i'm not sure how this is supposed to work or how to get eml_parser working instead of EmlParser.

[sim0nx]

Ok I see.
So in the-hive, they have various analysers, one of them being that "emlparser".
The project here (https://github.com/GOVCERT-LU/eml_parser) is a library for doing the actual parsing, which they use in their analyser.

I guess it would be best to open an issue regarding your experience with thehive project as this is more related to their analyser than to this library.

Please do reference that issue in this one, as it might help others who land here as well.

[ghuser0234]

Closing issue - see issue at TheHive-Project/Cortex-Analyzers#352