-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Description
Description
OpenAEV might reject a STIX bundle based on certain criterias, such as the modified attribute, which is a permanent error and OAEV return HTTP 400 to signify this.
However, the OCTI worker will insist in requeuing the already rejected message, only to be rejected again.
opencti/opencti-worker/src/listen_handler.py
Lines 65 to 77 in bf566f0
| if response.status_code != 200 and response.status_code != 202: | |
| raise RequestException(response.status_code, response.text) | |
| return "ack" | |
| except (RequestException, Timeout): | |
| self.logger.error( | |
| "Error executing listen handling, a connection error or timeout occurred" | |
| ) | |
| # Platform is under heavy load: wait for unlock & retry almost indefinitely. | |
| sleep_jitter = round(random.uniform(10, 30), 2) | |
| time.sleep(sleep_jitter) | |
| return "requeue" |
Environment
OCTI master branch
Reproducible Steps
Steps to create the smallest reproducible scenario:
- Setup OCTIxOAEV interconnection (OAEV Coverage connector)
- Create a report in OCTI and add a Security Coverage (automated, connector)
- The scenario is created in OAEV and simulation might start
- Open the Enrichement menu (three dot menu next to the upper-right Update button)
- Trigger the connector a second time, which will resend the identical STIX bundle to OAEV
Expected Output
OAEV rejects the identical bundle (it's a guard in OAEV to not reprocess a Security Coverage base don the modified attribute, or md5 digest) and the worker acknowledges it, setting the work item as errored with reason.
Actual Output
Work item is permanently in the queue, and is also clogging the queue, preventing the normal course of operations in OCTI.
OAEV is constantly called with the rejected STIX bundle and keeps rejecting it.
2026-02-26T12:10:30.145+01:00 ERROR 2267235 --- [OpenAEV API] [0.0-8080-exec-6] io.openaev.api.stix_process.StixApi : Parsing error while processing STIX bundle
Error: The STIX package is obsolete because a newer version has already been computed.
