IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Description patch conflict - REST API

    Posted 06/02/20 09:46 AM
    Hi everyone

    I am trying to update an incident through the API. I create an incident as:

    curl --location --request POST 'https://192.168.1.178/rest/orgs/201/incidents' \
    --header 'Authorization: Basic <token>' \
    --header 'Content-Type: application/json' \
    --header 'Cookie: JSESSIONID=<token>' \
    --data-raw '{
        "name": "title",
        "description": "desc",
        "discovered_date": 1589391874472
    }'​


    and update as:

    curl --location --request PATCH 'https://192.168.1.178/rest/orgs/201/incidents/2132' \
    --header 'Authorization: Basic <token>' \
    --header 'Content-Type: application/json' \
    --header 'Cookie: JSESSIONID=<token>' \
    --data-raw '{
        "changes": [
            {
                "field": {
                    "name": "name"
                },
                "old_value": {
                    "text": "title"
                },
                "new_value": {
                    "text": "titleupdate"
                }
            },
            {
                "field": {
                    "name": "description"
                },
                "old_value": { 
                    "text": "desc"
                },
                "new_value": {
                    "text": "descupdated"
                }
            }
        ]
    }'

    I get the following error:

    {
        "success": false,
        "title": "Patch Failure",
        "message": "One or more edits to an object (Type=Incident, ID 2,132) could not be applied due to a conflicting edit by another user. The following fields were in conflict:  description",
        "hints": [
            "patch_conflict_detected"
        ],
        "error_code": "generic",
        "field_failures": [
            {
                "field": 15,
                "your_original_value": "desc",
                "actual_current_value": "desc"
            }
        ]
    }

    I do not understand why. The fields are identical (my value and actual value). I tried also to change

    "old_value": {
                    "text": "title"
                },
                "new_value": {
                    "text": "titleupdate"
                }

    to

    "old_value": {
                    "format": "html", "content": "desc"
                },
                "new_value": {
                    "format": "html", "content": "descupdated"
                }​

    but I get the following error:

    {
        "success": false,
        "title": null,
        "message": "Unable to process the supplied JSON. The field 'format' is not recognized. The error occurred at line #18 and column #39.",
        "hints": [],
        "error_code": "generic"
    }


    This is happening only when I am trying to update the description. If I remove the description the tile is updated correctly.

    Any ideas of what I am doing wrong?

    ------------------------------
    Christos Nasikas
    ------------------------------


  • 2.  RE: Description patch conflict - REST API

    Posted 06/03/20 08:47 AM
    Try with this type of input for changing the incident description:

    {
    "changes": [
    {
    "field": "description",
    "old_value": {
    "textarea": {
    "format": "html",
    "content": "<div class=\"rte\"><div>This is the new description</div></div>"
    }
    },
    "new_value": {
    "textarea": {
    "format": "html",
    "content": "<div class=\"rte\"><div>updated</div></div>"
    }
    }
    }
    ]
    }


    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: Description patch conflict - REST API

    Posted 06/08/20 12:18 PM
    Thank you for your answer. This solution did not work. Your answer made me think of this solution: I created an incident as

    {
        "name": "title",
        "description": {
                    "format": "html", "content": "desc"
                },
        "discovered_date": 1589391874472
    }


    and update as 


    {
      "changes": [
        {
          "field": "description",
          "old_value": {
            "textarea": {
              "format": "html",
              "content": "desc"
            }
          },
          "new_value": {
            "textarea": {
              "format": "html",
              "content": "updated"
            }
          }
        }
      ]
    }


    ------------------------------
    Christos Nasikas
    ------------------------------