extrahop / code-examples Goto Github PK

Hello,

Upon attempting to run the sunburst_detect.py Python script against our ECA and EDAs separately, I run into a Unicode decode error such as the following example below.

UnicodeDecodeError: 'utf-8' codec can't decode byte 0x82 in position 108022: invalid start byte

The references bytes, position, and error message are random each time the error appears.

The script appears to execute for a random time interval and errors out.

Here's an example from our ECA -

Here's an example from our 1st EDA -

Continued...

Here are examples from our 2nd EDA -

This error occurs regardless of whether or not an IP address/hostname is used in the 't' configuration variable field. Let me know if additional information is needed.

Thank you!

Here lambda_traffic_mirror.py#L95 references a property NetworkInterfaceId that only exists for traffic targets that are EC2 instances. If the traffic target is a load balancer, the NetworkLoadBalancerArn property is used to link the two objects instead. If I get desperate, I may attempt to fix this and submit a pull request.