Skip to content
This repository was archived by the owner on Dec 5, 2025. It is now read-only.

Conversation

@pdamoune
Copy link
Contributor

@pdamoune pdamoune commented Aug 18, 2025

Proposed changes

Original issue :

{
  "timestamp": "2025-08-12T14:52:15.286095Z", 
  "level": "ERROR", 
  "name": "Microsoft Sentinel", 
  "message": "Error in ListenStream loop, exit.", 
  "exc_info": "Traceback (most recent call last):
File \"/usr/local/lib/python3.12/site-packages/pycti/connector/opencti_connector_helper.py\", line 786, in run
    state[\"start_from\"] = str(msg.id)
    ~~~~^^^^^^^^^^^
TypeError: 'NoneType' object does not support item assignment", 
"attributes": {"reason": "'NoneType' object does not support item assignment"}}

In order to handle the reset of the state in the UI for stream connectors, this conditions had been implemented in the past :
38fc5c4#diff-d5f76d595ba569b42f34c9cbf943833f0e132010315ed4680b7966f2ee961868R418-R422

+                        if state is None:
+                            self.exit = True
+                        else:
+                            state["start_from"] = str(msg.id)
+                            self.helper.set_state(state)

However, no else condition was added here :
38fc5c4#diff-d5f76d595ba569b42f34c9cbf943833f0e132010315ed4680b7966f2ee961868R428-R429

+                        if state is None:
+                            self.exit = True

Also, an error in the code had been fixed by this code :
2efa061#diff-d5f76d595ba569b42f34c9cbf943833f0e132010315ed4680b7966f2ee961868L519

-                            self.exit = True
+                            self.exit_event.set()

And wasn't changed on L786

This Fix handle the NoneType error and fix the exit_event.set()

Related issues

Checklist

  • I consider the submitted work as finished
  • I tested the code for its functionality
  • I wrote test cases for the relevant uses case
  • I added/update the relevant documentation (either on github or on notion)
  • Where necessary I refactored code to improve the overall quality

Further comments

If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution you did and what alternatives you considered, etc...

@pdamoune pdamoune self-assigned this Aug 18, 2025
@pdamoune pdamoune requested a review from helene-nguyen August 18, 2025 08:23
@pdamoune pdamoune force-pushed the bug/4482-microsoft-sentinel-intel-statestart_from-error-from-new-microsoft-sentinel-intel-connector branch from c91d3dc to 067d157 Compare August 18, 2025 08:24
@pdamoune pdamoune force-pushed the bug/4482-microsoft-sentinel-intel-statestart_from-error-from-new-microsoft-sentinel-intel-connector branch from 067d157 to 7cc1d6e Compare August 18, 2025 08:46
Copy link
Member

@helene-nguyen helene-nguyen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pdamoune Thank you for this fix !

Tested and all good for me :)

@helene-nguyen helene-nguyen merged commit 73c78f2 into master Aug 18, 2025
9 checks passed
@helene-nguyen helene-nguyen deleted the bug/4482-microsoft-sentinel-intel-statestart_from-error-from-new-microsoft-sentinel-intel-connector branch August 18, 2025 14:31
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Microsoft Sentinel Intel] state[\"start_from\"] error from new Microsoft sentinel intel connector

3 participants