owasp-amass/amass · error

failed to extract the Service asset

Error message

failed to extract the Service asset

What it means

The JARM plugin's check() asserts e.Entity.Asset to *oamplat.Service because JARM fingerprinting operates on service endpoints. If the event carries a different asset type, this error is returned and the event fails. It signals the subscription routed a non-Service entity into the JARM handler.

Source

Thrown at engine/plugins/jarm.go:69

		Transforms:   []string{string(oam.Service)},
		EventType:    oam.Service,
		Callback:     j.check,
	}); err != nil {
		return err
	}

	j.log.Info("Plugin started")
	return nil
}

func (j *jarmPlugin) Stop() {
	j.log.Info("Plugin stopped")
}

func (j *jarmPlugin) check(e *et.Event) error {
	_, ok := e.Entity.Asset.(*oamplat.Service)
	if !ok {
		return errors.New("failed to extract the Service asset")
	}

	since, err := support.TTLStartTime(e.Session.Config(), string(oam.Service), string(oam.Service), j.name)
	if err != nil {
		return err
	}

	if !j.hasCertificate(e, since) {
		return nil
	}

	src := j.source
	if !support.AssetMonitoredWithinTTL(e.Session, e.Entity, src, since) {
		j.query(e, since)
		support.MarkAssetMonitored(e.Session, e.Entity, src)
	}
	return nil
}

View on GitHub (pinned to 79299dce87)

Solutions

1. Return nil (ignore) instead of an error when the cast fails, so non-Service events are skipped
2. Narrow the event subscription to Service-typed entities only
3. Verify all emitters of service events use *oamplat.Service

Example fix

// before
_, ok := e.Entity.Asset.(*oamplat.Service)
if !ok {
	return errors.New("failed to extract the Service asset")
}

// after
_, ok := e.Entity.Asset.(*oamplat.Service)
if !ok {
	return nil
}

if _, ok := e.Entity.Asset.(*oamplat.Service); !ok {
	return nil
}

func asService(e *et.Event) (*oamplat.Service, bool) {
	s, ok := e.Entity.Asset.(*oamplat.Service)
	return s, ok
}

if err := j.check(ev); err != nil {
	if strings.Contains(err.Error(), "failed to extract the Service") {
		continue // non-Service event
	}
	log.Error(err)
}

When it happens

Trigger: Events matching the plugin's topic but holding e.g. *oamnet.IPAddress or *oamdns.FQDN assets reach jarmPlugin.check.

Common situations: Event topic filters that match more than Service assets; new plugin versions emitting services under a different type; custom service wrappers not implementing the expected struct.

Understand the failure class

Background: Type mismatch errors: IllegalArgumentException, TypeError and type guards across 150 open-source libraries — this error's family across 150 libraries.

Related errors

• failed to cast the DomainRecord
• failed to cast the IPNetRecord
• failed to cast the TLSCertificate asset
• failed to extract the IPAddress asset
• failed to extract the FQDN asset

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/a3935b821ac97ba4. Report an issue: GitHub.