What causes "failed to obtain organizations with norm name %s" in owasp-amass/amass?

Confirm an Organization asset with that exact normalized name exists in the graph; otherwise this is an expected miss and the caller creates a new asset.

owasp-amass/amass · info

failed to obtain organizations with norm name %s

Error message

failed to obtain organizations with norm name %s

What it means

FindOrgByNormNameAndJurisdictionClaim searches for Organization assets by their normalized name via FindEntitiesByContent on oam.Organization with a 'name' content filter. If the query errors or no organization has that normalized name, this error is returned, meaning no Organization asset exists yet with that norm name.

Source

Thrown at engine/plugins/support/org/claims.go:165

	}

	return fmt.Errorf("failed to create the jurisdiction claim %s for organization %s", jurisdiction, orgent.Asset.Key())
}

func FindOrgByNormNameAndJurisdictionClaim(sess et.Session, norm, jurisdiction string) (*dbt.Entity, error) {
	var country string
	if parts := strings.Split(jurisdiction, "-"); len(parts) == 2 {
		country = parts[0]
	}

	ctx, cancel := context.WithTimeout(sess.Ctx(), 10*time.Second)
	defer cancel()

	orgents, err := sess.DB().FindEntitiesByContent(ctx, oam.Organization, time.Time{}, 1, dbt.ContentFilters{
		"name": norm,
	})
	if err != nil || len(orgents) == 0 {
		return nil, fmt.Errorf("failed to obtain organizations with norm name %s", norm)
	}

	seconds := 10 * len(orgents)
	octx, ocancel := context.WithTimeout(sess.Ctx(), time.Duration(seconds)*time.Second)
	defer ocancel()

	for _, orgent := range orgents {
		tags, err := sess.DB().FindEntityTags(octx, orgent, time.Time{}, "jurisdiction")
		if err != nil || len(tags) == 0 {
			continue
		}

		for _, tag := range tags {
			jc, valid := tag.Property.(*oamgen.SimpleProperty)
			if !valid {
				continue
			}
			jv := jc.PropertyValue

View on GitHub (pinned to 79299dce87)

Solutions

Confirm an Organization asset with that exact normalized name exists in the graph; otherwise this is an expected miss and the caller creates a new asset.
Compare genNormName output with stored organization names to catch normalization drift; align the normalization logic.
Check DB health if the query itself errored rather than returned zero rows.
If jurisdiction normalization changed recently, re-verify existing assets were stored with matching country codes.

Defensive patterns

Strategy: fallback

Validate before calling

orgents, err := sess.DB().FindEntitiesByContent(ctx, oam.Organization, time.Time{}, 1, dbt.ContentFilters{"name": norm})
if err != nil || len(orgents) == 0 {
    // no org with this normalized name: expected on first discovery
}

Try / catch

if _, err := org.FindOrgByNormNameAndJurisdictionClaim(sess, norm, jurisdiction); err != nil {
    // fall through to creating a new Organization asset
}

Prevention

Verify genNormName matches the normalization used when assets were stored.
Keep normalization logic stable across versions.
Check DB health when the query errors instead of returning empty.
Accept empty results as normal cache misses.

When it happens

Trigger: CreateOrgAsset calls it (when Jurisdiction is set and prior lookups missed) with normName = genNormName(o); the graph contains no Organization entity whose 'name' content equals the normalized name, or the DB query fails within the context.

Common situations: First encounter of the organization; normalization function produces a different form than previously stored names; DB outage; jurisdiction normalization changed (e.g., country code mapping) so a differently-normalized name/jurisdiction pair was stored earlier.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/56bb97130d8045c1. Report an issue: GitHub.