IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
Back to discussions
Expand all | Collapse all

Copying properties json dictionary REST API

  • 1.  Copying properties json dictionary REST API

    Posted 11/12/19 11:12 PM
    Hi all,

    I'm trying to copy the properties from an existing incident to a newly created child incident using the following script :-

    new_incident = {"name": inc_name,
    "description": inc_desc,
    "incident_type_ids": inc_types,
    "discovered_date": time_now,
    "properties": {}
    }
    uri = '/incidents'
    parent_incident = resilient_client.get("/incidents/{}?handle_format=names".format(parent_incident_id))

    # Create the incident
    new_incident["properties"]["parent_incident_id"] = parent_incident_id
    incident = resilient_client.post(uri, new_incident)
    child_incident_id = incident["id"]


    print("Created incident {}".format(child_incident_id))


    results = {
    "success": True,
    }

    yield StatusMessage("Child Creation Complete")

    parent_incident = resilient_client.get("/incidents/{}?handle_format=names".format(parent_incident_id))
    child_incident = resilient_client.get("/incidents/{}?handle_format=names".format(child_incident_id))

    print("Testing printing statement")

    incident_put_uri = '/incidents/fields'
    parent_properties_dict = parent_incident.get("properties")
    if parent_properties_dict is not None:
    for key, value in parent_properties_dict.items():
    if value == "null":
    parent_properties_dict[key] = None
    print(json.dumps(parent_properties_dict, indent=2))
    child_incident.get('vers'), "name": child_incident.get('name'), "discovered_date": child_incident.get('discovered_date')}

    parent_properties_json = json.dumps(parent_properties_dict)
    parent_properties_dict['vers'] = child_incident.get('vers')
    parent_properties_dict['name'] = child_incident.get('name')
    parent_properties_dict['discovered_date'] = child_incident.get('discovered_date')

    incident_put_response = resilient_client.post(incident_put_uri + "/" + str(child_incident_id), parent_properties_dict)
    handle_format=names".format(child_incident_id), parent_properties_json)
    print(incident_put_response)

    However, on running the above I'm getting internal server error

    packages/fn_child_incident/fn_child_incident/components/child_incident_create.py", line 77, in _fn_child_incident_function
    incident_put_response = resilient_client.post(incident_put_uri + "/" + str(child_incident_id), parent_properties_dict)
    File "/app/localstorage/jaiswarj/CS7/homes/cs7_integration/.git/resilient-integrations/share/python/lib/python2.7/site-packages/resilient/co3.py", line 300, in post
    _raise_if_error(ex.get_response())
    File "/app/localstorage/jaiswarj/CS7/homes/cs7_integration/.git/resilient-integrations/share/python/lib/python2.7/site-packages/resilient/co3.py", line 163, in _raise_if_error
    raise SimpleHTTPException(response)
    SimpleHTTPException: Internal Server Error: {"success":false,"title":null,"message":"Internal Server Error","hints":[],"error_code":"generic"}
    >

    Can anyone please suggest what do I need to do. I think it might be something to do with posting the json.


    ------------------------------
    Arjun Jaiswal
    ------------------------------


Related Content