IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  401 Client Error: Unauthorized for url, REST API fn_utilities, PagerDuty

    Posted Tue January 02, 2024 12:21 PM

    Hi,

    I am currently attempting to get PagerDuty OnCall Information using the fn_utilities REST API function.

    Here is my code so far:

    import json

    pagerduty_oncalls_url = "https://api.pagerduty.com/oncalls?limit=1"

    pagerduty_token = "Token token=ABCDEFGHIJKLMNOPQRSTUVWXYZ"

    payload = {}

    headers = {
      "Accept": "application/vnd.pagerduty+json;version=2",
      "Content-Type": "application/json",
    "Authorization": pagerduty_token
    }

    inputs.rest_method = "GET"
    inputs.rest_headers = json.dumps(headers)
    inputs.rest_body = json.dumps(payload)
    inputs.rest_url = pagerduty_oncalls_url
    inputs.rest_verify = True

    I seem to be getting '401 Client Error: Unauthorized for url' error messages. I have attempted to use the same code on PagerDuty API Developer Platform as well as Postman and I have no issues with them. I think it's something to do with attempting to pass Authorization through the header. Does anyone have any suggestions or recommendations on how best to format this please?



    ------------------------------
    Iqra Haq
    ------------------------------


  • 2.  RE: 401 Client Error: Unauthorized for url, REST API fn_utilities, PagerDuty

    Posted Tue January 02, 2024 04:31 PM

    Hi Iqra,

    The fn_utilities REST API function will be deprecated soon as we have focused development on the REST API app available on the App Exchange here .

    I would try the new function out and see if you have any issue. 



    ------------------------------
    AnnMarie Norcross
    ------------------------------



  • 3.  RE: 401 Client Error: Unauthorized for url, REST API fn_utilities, PagerDuty

    Posted Wed January 03, 2024 07:05 AM
    Edited by Iqra Haq Wed January 03, 2024 09:41 AM

    Hi AnnMarie,

    Thanks for your response. The app and documentation look pretty promising. I've attempted migrating some existing (already working with the previous app) functionality. But I seem to be having issues with that.

    I have managed to get this code to work:

    import json
    
    
    body = {
        "payload": {
            "summary": pagerduty_summary,
            "severity": "critical",
            "source": "QRadar Suite (XDR)",
            "custom_details": incident_details,
        },
        "routing_key": "XXXXXX",
        "dedup_key": pagerduty_incident_identifier,
        "event_action": "trigger",
        "links": [
            {
                "href": incident_url,
                "text": "QRadar Suite Incident Page"
            }
        ]
    }
    
    header = """
      Accept : application/json
      Content-type : application/json
    """
    
    
    
    inputs.rest_api_url = pagerduty_events_url
    inputs.rest_api_body = json.dumps(body)
    inputs.rest_api_headers = header
    inputs.rest_api_verify = True
    inputs.rest_api_method = "POST"
      
      
    
    

    However, when I attempt to use "{{variable_reference_to_key}}" rather than "XXXX" (the actual key), it doesn't work (I get the 400 error). It only appears to work if I directly input the key. Can you advise on how I can use "{{}}" referencing but for a python dict that I can then perform json.dumps() on?

    Regards,

    Iqra



    ------------------------------
    Iqra Haq
    ------------------------------



  • 4.  RE: 401 Client Error: Unauthorized for url, REST API fn_utilities, PagerDuty

    Posted Wed January 03, 2024 08:56 AM

    Hi Iqra,

    There is a known bug that we has been fixed in fn_rest_api but it has not been released yet.

    Can you change the header to "Content-Type" to "Content-type" and see if it works ?

    headers = {
        "Content-type": "application/json",
        "Accept": "application/json"
    }


    ------------------------------
    AnnMarie Norcross
    ------------------------------



  • 5.  RE: 401 Client Error: Unauthorized for url, REST API fn_utilities, PagerDuty

    Posted Wed January 03, 2024 09:11 AM

    Hi AnnMarie,

    Thanks again for your help. That's worked great for the second piece of code. However, I look to still be having issues with the original piece of code (the OnCall information).

    This is what I attempted:

    pagerduty_oncalls_url = "https://api.pagerduty.com/oncalls?limit=1&schedule_ids%5B%5D=XXXXX"
    
    header = """
      Accept: application/json
      Content-type: application/json
      Authorization: Token token={{pagerduty_token}}
    """
    
    inputs.rest_api_method = "GET"
    inputs.rest_api_headers = header
    inputs.rest_api_url = pagerduty_oncalls_url
    inputs.rest_api_verify = True

    Any ideas? Do you suggest I use json again for the header and perform a json.dumps? I did attempt that too but I still get the 401 error.

    Regards,

    Iqra



    ------------------------------
    Iqra Haq
    ------------------------------



  • 6.  RE: 401 Client Error: Unauthorized for url, REST API fn_utilities, PagerDuty

    Posted Wed January 03, 2024 09:41 AM

    Hi AnnMarie,

    Turns out I had the JSON format wrong. I've fixed my code and it is now working. Thank you for all your help!

    Regards,

    Iqra



    ------------------------------
    Iqra Haq
    ------------------------------



  • 7.  RE: 401 Client Error: Unauthorized for url, REST API fn_utilities, PagerDuty

    Posted Wed January 03, 2024 09:47 AM

    Great!  A new fn_rest_api app will be published in early January with the fix for the header that you encountered.

    Best regards,

    AnnMarie



    ------------------------------
    AnnMarie Norcross
    ------------------------------



  • 8.  RE: 401 Client Error: Unauthorized for url, REST API fn_utilities, PagerDuty

    Posted Wed January 10, 2024 06:21 PM
    Package 'fn-rest-api 1.1.0':
        OK to import customizations from 'fn-rest-api 1.1.0'? (y/n):y
    RetryHTTPException: 'resilient' API Request FAILED:
    Response Code: 403
    Reason: Unknown Reason. {"success":false,"title":null,"message":"Forbidden","hints":[],"error_code":"generic"} in resilient.co3base.BaseClient.post.<locals>.__post, retrying in 2 seconds...
    RetryHTTPException: 'resilient' API Request FAILED:
    Response Code: 403
    Reason: Unknown Reason. {"success":false,"title":null,"message":"Forbidden","hints":[],"error_code":"generic"} in resilient.co3base.BaseClient.post.<locals>.__post, retrying in 4 seconds...
    RetryHTTPException: 'resilient' API Request FAILED:
    Response Code: 403
    

    Hi @AnnMarie Norcross,

    I have the same problem with fn rest api. Any advice would be appreciated. (integration server)

    https://community.ibm.com/community/user/security/discussion/an-app-using-an-api-key-cannot-connect-to-ibm-security-qradar-soar#bm5230ea73-30a6-4d5a-9c8a-1bb45b0830bf



    ------------------------------
    Jasmin
    ------------------------------