Rapid7 Nexpose Error while Integrating

[Sandivsu]

Hi All,

I am finding an error, before it was working fine and all of a sudden started receiving the error logs, as checked connectivity is working.

ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" urllib.error.URLError: <urlopen error [Errno 111] Connection refused>

ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" raise URLError(err)

ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" File "/opt/splunk/lib/python3.9/urllib/request.py", line 1349, in do_open

ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" return self.do_open(http.client.HTTPSConnection, req,

ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" File "/opt/splunk/lib/python3.9/urllib/request.py", line 1389, in https_open

ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" result = func(*args)

ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" File "/opt/splunk/lib/python3.9/urllib/request.py", line 494, in _call_chain

ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" result = self._call_chain(self.handle_open, protocol, protocol +

ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" File "/opt/splunk/lib/python3.9/urllib/request.py", line 534, in _open

ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" response = self._open(req, data)

[PickleRick]

<urlopen error [Errno 111] Connection refused>

This suggests one or more of the following:

- network issues

- blocking by some intermediate solution (IPS? proxy?)

- rate-limiting by the Nexpose itself (I'm not sure if it has such functionality).

[livehybrid]

Hi @Sandivsu 

Has anything changed in your environment? e.g Network changes, Firewall updates, Splunk Upgrades, Rapid7 app updates? 

From the years of experience I find things dont just 'stop working' - there is usually an external factor which has changed! 

The error suggests that the connection to Rapid7 was refused - Can you confirm that you can connect from the Splunk server to your Rapid7 Nexpose API endpoint with something like curl?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[Sandivsu]

Hi @livehybrid  and @PickleRick 

Thanks for your response.

I do not have the visibility whether there is any changes at the application end or network end.

I will do curl and check the connectivity.

Meanwhile, how to troubleshoot this kind of not supported TA/Add-on's by Splunk support team.

Thanks,

Sandeep N

[PickleRick]

This is _not_ a Splunk-supported addon.

And typically you want to trace what the debug is trying to do and at which point it is failing. And then try to troubleshoot why it fails. Like with any other software.

[Sandivsu]

@PickleRick ,

Yes, agreed.