AWS Security Hub Connector invalid ELF header error #8527

Pathward-MikeM · 2023-07-13T13:24:42Z

Describe the bug
AWS Security Hub function app has an error "invalid ELF header". Copy of error here:

Result: Failure Exception: ImportError: /home/site/wwwroot/.python_packages/lib/site-packages/cryptography/hazmat/bindings/_rust.abi3.so: invalid ELF header. Troubleshooting Guide: https://aka.ms/functions-modulenotfound Stack: File "/azure-functions-host/workers/python/3.8/LINUX/X64/azure_functions_worker/dispatcher.py", line 314, in _handle__function_load_request func = loader.load_function( File "/azure-functions-host/workers/python/3.8/LINUX/X64/azure_functions_worker/utils/wrappers.py", line 42, in call raise extend_exception_message(e, message) File "/azure-functions-host/workers/python/3.8/LINUX/X64/azure_functions_worker/utils/wrappers.py", line 40, in call return func(*args, **kwargs) File "/azure-functions-host/workers/python/3.8/LINUX/X64/azure_functions_worker/loader.py", line 85, in load_function mod = importlib.import_module(fullmodname) File "/usr/local/lib/python3.8/importlib/init.py", line 127, in import_module return _bootstrap._gcd_import(name[level:], package, level) File "", line 1014, in _gcd_import File "<frozen (... etc etc)

To Reproduce
This is a read only app that is ran from a vendor managed package. We have made no custom changes on our end. To replicate, simply deploy the function app and wait for the error to populate.

Expected behavior
No ELF header error, expected behavior is ingestion of AWS Security Hub findings into Sentinel.

Screenshots

Desktop (please complete the following information):

OS: Linux
Browser: N/A
Version: 3.20.0.0

github-actions · 2023-07-13T13:24:54Z

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

github-actions · 2023-07-13T13:27:48Z

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

github-actions · 2023-07-13T13:27:55Z

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

github-actions · 2023-07-13T13:27:55Z

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

v-rbajaj · 2023-07-17T10:16:42Z

Hi @Pathward-MikeM, thanks for flagging this, we will look into this and provide an update soon.

v-rbajaj · 2023-07-18T10:17:25Z

Hi @Pathward-MikeM, can you please change the runtime version to 4 and restart the function app then check the invocation logs?

Pathward-MikeM · 2023-07-18T15:01:12Z

Hi @v-rbajaj, I updated the runtime version and am still receiving the same error. Please advise. Thanks!

v-rbajaj · 2023-07-20T11:15:21Z

Hi @Pathward-MikeM, we are checking on this with the team internally and once will receive an update will let you know

v-rbajaj · 2023-07-24T10:25:50Z

Hi @Pathward-MikeM, we are still checking on this with the team internally and once will receive an update will let you know

github-actions · 2023-07-25T15:27:06Z

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

v-rbajaj · 2023-07-26T11:23:37Z

Hi @Pathward-MikeM,
The error message "invalid ELF header" is related to a module import error in the Azure Function app. The error message indicates that the module "cryptography" is not loading properly The error message suggests that the issue is with the "rust" module, which is a dependency of the "cryptography" module.

Please follow this document for help on troubleshooting.
https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/azure-functions/recover-python-functions.md.

Pathward-MikeM · 2023-07-26T15:47:40Z

Hi @v-rbajaj, this is function app runs from a package file. We do not make changes to the package file as that would prevent future updates - this is Azure best practice. Your recommended path to remediation would involve disabling the run from package setting, thereby preventing future updates. Please correct me if I am wrong here? Thanks!

v-rbajaj · 2023-07-27T11:30:00Z

Hi @Pathward-MikeM, we will get back to you on this.

v-rbajaj · 2023-07-31T11:55:15Z

Hi @Pathward-MikeM, we are looking into the query asked here, we will get back to you once there is an update.

v-rbajaj · 2023-08-03T14:20:36Z

Hi @Pathward-MikeM, we are looking into the query asked here, we will get back to you once there is an update.

v-rbajaj · 2023-08-08T12:45:27Z

Hi @Pathward-MikeM, we are trying to reproduce this issue.

v-rbajaj · 2023-08-10T13:31:58Z

Thanks for your patience @Pathward-MikeM, we are able to reproduce the issue, we are figuring out the fix.

Just wanted to know, have you read the readme file and did the configuration as per the readme file?

v-rbajaj · 2023-08-16T11:42:03Z

Hi @Pathward-MikeM, can you please look into the above comment?

Pathward-MikeM · 2023-08-16T16:45:01Z

Hi yes I have done all the configuration steps as part of the readme and configuration. Thanks

Pathward-MikeM · 2023-08-22T15:26:47Z

Is there a way to revert to a previous stable version?

v-rbajaj · 2023-08-28T17:13:45Z

Hi @Pathward-MikeM, I'll get back to you on this as we are reaching out to concerned team. Apologies for the delay in response.

v-rbajaj · 2023-09-18T13:48:13Z

Hi @Pathward-MikeM, sorry for the delay, we are reaching out to concerned team and will get back to you with details by 21st Sept

v-rbajaj · 2023-10-05T11:37:39Z

Hi @Pathward-MikeM, sorry for the delay, we are reaching out to concerned team for this issue.

v-rbajaj · 2023-10-11T18:33:12Z

Hi @Pathward-MikeM, sorry for the delay, we are reaching out to concerned team for this issue, will update you by 17 Oct 2023.

rcscoggin · 2023-10-18T12:40:12Z

Any updates on this issue, it is after 10/17.

v-rbajaj · 2023-10-26T11:48:15Z

Hi @rcscoggin, sorry for the delay, please give us more time to investigate till 31 Oct 2023.

v-muuppugund · 2023-12-15T03:57:39Z

Hi @Pathward-MikeM ,Apologies for late response,as blocked with high priority issue, unable to focus on this issue,will get back to you with an update by 13Dec2023.
Hi @Pathward-MikeM ,Till yesterday working on the high priority issue,will focus on this asap and share updates

Pathward-MikeM · 2023-12-18T17:15:53Z

Hi team, any update?

v-muuppugund · 2023-12-19T08:58:52Z

Hi @Pathward-MikeM ,Working on this one,will share updates by eod

v-muuppugund · 2023-12-19T13:07:59Z

Hi @Pathward-MikeM ,Please use the package url i.e. https://github.com/Azure/Azure-Sentinel/raw/users/v-muuppugund/AWSchanges/DataConnectors/AWS-SecurityHubFindings/AzFunAWSSecurityHubIngestion.zip point this url to WEBSITE_RUN_FROM_PACKAGE in existing function app settings and restart the function app,please let me know if you have any issues,will connect over teams meeting.

Pathward-MikeM · 2023-12-19T15:24:58Z

Hi @v-muuppugund, good morning! I unfortuntaly am still receiving an error. Screenshot is attached.

v-muuppugund · 2023-12-20T11:14:36Z

Hi @Pathward-MikeM ,Apologies for the delayed response,for me i am not getting issues as i don't have valid account credentials to check this issue,Could you please share email id and conveninet time slots for trouble shooting this issue via teams meeting

Pathward-MikeM · 2023-12-20T17:02:11Z

Hi, can you drop your email and I will send you an email with availability? Thank you!

v-muuppugund · 2023-12-22T05:52:49Z

Hi @Pathward-MikeM ,Apologies for the delayed response, don't see email id from profile,could you please share couple of time slots to (v-muuppugund@microsoft.com) for teams meeting,Thanks

v-sudkharat · 2023-12-26T11:39:37Z

Hi @Pathward-MikeM, Could you please confirm have you sent your slot time on above mentioned mail id? Thanks!

Pathward-MikeM · 2023-12-26T14:52:30Z

Hi all, yes I have sent an email to begin scheduling a call. Thanks!

v-muuppugund · 2023-12-27T12:11:51Z

Hi @Pathward-MikeM ,Blocked time for the issue troubleshooting, please let me know if this time isn't convenient.

v-muuppugund · 2023-12-28T16:17:17Z

Hi @Pathward-MikeM ,As discussed over call today ,I am trying the set up in our AWS environment and will update you

v-muuppugund · 2024-01-04T04:18:16Z

Hi @Pathward-MikeM ,As discussed on last Thursday call i,e. 28Dec2023, the initial error is fixed with the package shared by me and the error now getting while token generation and we have environment and i am working on using that replicating the same issue at my end if required will let you know.

v-muuppugund · 2024-01-12T14:13:20Z

Hi @Pathward-MikeM ,I have created security hub in our environment and role ,debugging it,Will update you and trying to replicate the second issue after first issue fix at my end

v-muuppugund · 2024-01-17T17:14:51Z

Hi @Pathward-MikeM ,still working on fixes in the environment created,will update you,once fix is completed ,will block your calendar.

v-muuppugund · 2024-01-23T03:46:23Z

Hi @Pathward-MikeM ,Still need some time to complete debugging,will share an update this week and will block your calendar for the same.

v-muuppugund · 2024-01-27T15:06:28Z

Hi @Pathward-MikeM ,Fixed the issues while generating token,please find below screen shot for reference,please share convenient time slot for teams meeting

v-muuppugund · 2024-02-01T09:15:19Z

Hi @Pathward-MikeM ,Tomorrow call has been scheduled for redeploying entire solution earlier call fixed aws permissions and azure function configuration issues.

v-muuppugund · 2024-02-02T13:38:51Z

Hi @Pathward-MikeM , As discussed over teams confirmed the issue has been resolved, so, closing this issue (#8527 raising the PR and Post updates over chat . If you still need support for this issue, feel free to re-open at any time. Thank you for your co-operation!

CyberHunter7 · 2024-02-06T20:51:33Z

Hi @v-muuppugund we have been waiting for a fix for this issue for a couple of months now. We see it's marked as resolved, we have deployed to Azure once again but the original message error still there. Could you please confirm if the AzFunAWSSecurityHubIngestion.zip is now updated on (Azure-Sentinel/DataConnectors/AWS-SecurityHubFindings) to reflect the last updates ? If yes could we schedule a call in order to look into this matter. Thank you.

v-muuppugund · 2024-02-07T03:01:39Z

Hi @v-muuppugund we have been waiting for a fix for this issue for a couple of months now. We see it's marked as resolved, we have deployed to Azure once again but the original message error still there. Could you please confirm if the AzFunAWSSecurityHubIngestion.zip is now updated on (Azure-Sentinel/DataConnectors/AWS-SecurityHubFindings) to reflect the last updates ? If yes could we schedule a call in order to look into this matter. Thank you.

Will be raising PR ,will update you

v-muuppugund · 2024-02-08T05:59:24Z

Hi @v-muuppugund we have been waiting for a fix for this issue for a couple of months now. We see it's marked as resolved, we have deployed to Azure once again but the original message error still there. Could you please confirm if the AzFunAWSSecurityHubIngestion.zip is now updated on (Azure-Sentinel/DataConnectors/AWS-SecurityHubFindings) to reflect the last updates ? If yes could we schedule a call in order to look into this matter. Thank you.

Will be raising PR ,will update you

@CyberHunter7 raised pr for it #9910

CyberHunter7 · 2024-02-20T15:47:53Z

Hi @v-muuppugund we have been waiting for a fix for this issue for a couple of months now. We see it's marked as resolved, we have deployed to Azure once again but the original message error still there. Could you please confirm if the AzFunAWSSecurityHubIngestion.zip is now updated on (Azure-Sentinel/DataConnectors/AWS-SecurityHubFindings) to reflect the last updates ? If yes could we schedule a call in order to look into this matter. Thank you.

Will be raising PR ,will update you

@CyberHunter7 raised pr for it #9910
Hi @v-muuppugund Any news ?

v-muuppugund · 2024-02-20T15:53:38Z

Hi @v-muuppugund we have been waiting for a fix for this issue for a couple of months now. We see it's marked as resolved, we have deployed to Azure once again but the original message error still there. Could you please confirm if the AzFunAWSSecurityHubIngestion.zip is now updated on (Azure-Sentinel/DataConnectors/AWS-SecurityHubFindings) to reflect the last updates ? If yes could we schedule a call in order to look into this matter. Thank you.

Will be raising PR ,will update you

@CyberHunter7 raised pr for it #9910
Hi @v-muuppugund Any news ?

Hi @CyberHunter7 , Working on PR push as team has asked me to check another issue i.e. dependency bot version compatibility issue for this connector ,so i am occupied with other items, didn't get chance to check it, will be checking that also and pushing it.

v-muuppugund · 2024-02-25T06:15:09Z

Hi @v-muuppugund we have been waiting for a fix for this issue for a couple of months now. We see it's marked as resolved, we have deployed to Azure once again but the original message error still there. Could you please confirm if the AzFunAWSSecurityHubIngestion.zip is now updated on (Azure-Sentinel/DataConnectors/AWS-SecurityHubFindings) to reflect the last updates ? If yes could we schedule a call in order to look into this matter. Thank you.

Will be raising PR ,will update you

@CyberHunter7 raised pr for it #9910
Hi @v-muuppugund Any news ?

Hi @CyberHunter7 , Working on PR push as team has asked me to check another issue i.e. dependency bot version compatibility issue for this connector ,so i am occupied with other items, didn't get chance to check it, will be checking that also and pushing it.

Hi @CyberHunter7 ,I have completed the package compatability for cryptography version upgrade by dependency bot and PR is under review as team asked me to check on the another item for the same connector,will update you once completed.

CyberHunter7 · 2024-03-05T14:42:03Z

Hi @v-muuppugund we have been waiting for a fix for this issue for a couple of months now. We see it's marked as resolved, we have deployed to Azure once again but the original message error still there. Could you please confirm if the AzFunAWSSecurityHubIngestion.zip is now updated on (Azure-Sentinel/DataConnectors/AWS-SecurityHubFindings) to reflect the last updates ? If yes could we schedule a call in order to look into this matter. Thank you.

Will be raising PR ,will update you

@CyberHunter7 raised pr for it #9910
Hi @v-muuppugund Any news ?

Hi @CyberHunter7 , Working on PR push as team has asked me to check another issue i.e. dependency bot version compatibility issue for this connector ,so i am occupied with other items, didn't get chance to check it, will be checking that also and pushing it.

Hi @CyberHunter7 ,I have completed the package compatability for cryptography version upgrade by dependency bot and PR is under review as team asked me to check on the another item for the same connector,will update you once completed.

Hi @v-muuppugund Thank you for your support. It's working now.

CyberHunter7 · 2024-03-05T14:51:30Z

Hi @Pathward-MikeM since you opened this issue, just checking if you noticed that events related to Macie and GuardDuty, even if it's showing in Security Hub (in the aws console or aws cli output), it does not appear on Azure Log Analytics side ? What's visible in Azure log analytics side are only events related to security standards.

Pathward-MikeM · 2024-03-20T14:49:48Z

Yes, I have experienced issues with the connector since update. @CyberHunter7 have you found any workarounds?

CyberHunter7 · 2024-03-20T18:08:46Z

@Pathward-MikeM I opened an issue about it here.

#10180 (comment)

v-amolpatil added the Connector Connector specialty review needed label Jul 13, 2023

v-amolpatil assigned v-vdixit and v-rbajaj Jul 13, 2023

v-amolpatil unassigned v-vdixit Jul 25, 2023

v-muuppugund closed this as completed Feb 2, 2024

AWS Security Hub Connector invalid ELF header error #8527

AWS Security Hub Connector invalid ELF header error #8527

Comments

Pathward-MikeM commented Jul 13, 2023

github-actions bot commented Jul 13, 2023

github-actions bot commented Jul 13, 2023

github-actions bot commented Jul 13, 2023

github-actions bot commented Jul 13, 2023

v-rbajaj commented Jul 17, 2023

v-rbajaj commented Jul 18, 2023

Pathward-MikeM commented Jul 18, 2023

v-rbajaj commented Jul 20, 2023 • edited Loading

v-rbajaj commented Jul 24, 2023

github-actions bot commented Jul 25, 2023

v-rbajaj commented Jul 26, 2023

Pathward-MikeM commented Jul 26, 2023

v-rbajaj commented Jul 27, 2023

v-rbajaj commented Jul 31, 2023

v-rbajaj commented Aug 3, 2023

v-rbajaj commented Aug 8, 2023

v-rbajaj commented Aug 10, 2023

v-rbajaj commented Aug 16, 2023

Pathward-MikeM commented Aug 16, 2023

Pathward-MikeM commented Aug 22, 2023

v-rbajaj commented Aug 28, 2023 • edited Loading

v-rbajaj commented Sep 18, 2023 • edited Loading

v-rbajaj commented Oct 5, 2023

v-rbajaj commented Oct 11, 2023

rcscoggin commented Oct 18, 2023

v-rbajaj commented Oct 26, 2023

v-muuppugund commented Dec 15, 2023

Pathward-MikeM commented Dec 18, 2023

v-muuppugund commented Dec 19, 2023

v-muuppugund commented Dec 19, 2023

Pathward-MikeM commented Dec 19, 2023

v-muuppugund commented Dec 20, 2023

Pathward-MikeM commented Dec 20, 2023

v-muuppugund commented Dec 22, 2023

v-sudkharat commented Dec 26, 2023

Pathward-MikeM commented Dec 26, 2023

v-muuppugund commented Dec 27, 2023

v-muuppugund commented Dec 28, 2023 • edited Loading

v-muuppugund commented Jan 4, 2024 • edited Loading

v-muuppugund commented Jan 12, 2024 • edited Loading

v-muuppugund commented Jan 17, 2024

v-muuppugund commented Jan 23, 2024 • edited Loading

v-muuppugund commented Jan 27, 2024 • edited Loading

v-muuppugund commented Feb 1, 2024

v-muuppugund commented Feb 2, 2024

CyberHunter7 commented Feb 6, 2024

v-muuppugund commented Feb 7, 2024

v-muuppugund commented Feb 8, 2024 • edited Loading

CyberHunter7 commented Feb 20, 2024

v-muuppugund commented Feb 20, 2024

v-muuppugund commented Feb 25, 2024 • edited Loading

CyberHunter7 commented Mar 5, 2024

CyberHunter7 commented Mar 5, 2024

Pathward-MikeM commented Mar 20, 2024

CyberHunter7 commented Mar 20, 2024

v-rbajaj commented Jul 20, 2023 •

edited

Loading

v-rbajaj commented Aug 28, 2023 •

edited

Loading

v-rbajaj commented Sep 18, 2023 •

edited

Loading

v-muuppugund commented Dec 28, 2023 •

edited

Loading

v-muuppugund commented Jan 4, 2024 •

edited

Loading

v-muuppugund commented Jan 12, 2024 •

edited

Loading

v-muuppugund commented Jan 23, 2024 •

edited

Loading

v-muuppugund commented Jan 27, 2024 •

edited

Loading

v-muuppugund commented Feb 8, 2024 •

edited

Loading

v-muuppugund commented Feb 25, 2024 •

edited

Loading