IBM QRadar SOAR

Is anyone else suddenly experiencing encoding issues after the v38.2 upgrade?

It used to be the case that passing UTF-8 from a variable into a field was fine (ie if it came from a function as "results" in the post-processor). This no longer appears to be the case, and is now returning errors.

Here is a simple example character that is suddenly causing us headaches: →

------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
------------------------------

Can you share details on what the post processing script is? And what the field type is and how it looks on the UI?

Ben

------------------------------
Ben Lurie
------------------------------

Original Message:
Sent: Tue October 27, 2020 02:20 PM
From: Jared Fagel
Subject: Encoding Issues in v38.2

Is anyone else suddenly experiencing encoding issues after the v38.2 upgrade?

It used to be the case that passing UTF-8 from a variable into a field was fine (ie if it came from a function as "results" in the post-processor). This no longer appears to be the case, and is now returning errors.

Here is a simple example character that is suddenly causing us headaches: →

------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
------------------------------

Jared reached out to us over email and supplied us with all of the needed information, thanks Ben.

------------------------------
Sean Mc Cann
------------------------------

Original Message:
Sent: Wed October 28, 2020 09:15 AM
From: Ben Lurie
Subject: Encoding Issues in v38.2

Can you share details on what the post processing script is? And what the field type is and how it looks on the UI?

Ben

------------------------------
Ben Lurie

Original Message:
Sent: Tue October 27, 2020 02:20 PM
From: Jared Fagel
Subject: Encoding Issues in v38.2

Is anyone else suddenly experiencing encoding issues after the v38.2 upgrade?

It used to be the case that passing UTF-8 from a variable into a field was fine (ie if it came from a function as "results" in the post-processor). This no longer appears to be the case, and is now returning errors.

Here is a simple example character that is suddenly causing us headaches: →

------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
------------------------------

Just an update, you should see this fixed in v39.0

------------------------------
Sean Mc Cann
------------------------------

Original Message:
Sent: Tue October 27, 2020 02:20 PM
From: Jared Fagel
Subject: Encoding Issues in v38.2

Is anyone else suddenly experiencing encoding issues after the v38.2 upgrade?

It used to be the case that passing UTF-8 from a variable into a field was fine (ie if it came from a function as "results" in the post-processor). This no longer appears to be the case, and is now returning errors.

Here is a simple example character that is suddenly causing us headaches: →

------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
------------------------------

Thanks @Sean Mc Cann and team!​

------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
------------------------------

Original Message:
Sent: Thu November 12, 2020 01:13 PM
From: Sean Mc Cann
Subject: Encoding Issues in v38.2

Just an update, you should see this fixed in v39.0

------------------------------
Sean Mc Cann

Original Message:
Sent: Tue October 27, 2020 02:20 PM
From: Jared Fagel
Subject: Encoding Issues in v38.2

Is anyone else suddenly experiencing encoding issues after the v38.2 upgrade?

It used to be the case that passing UTF-8 from a variable into a field was fine (ie if it came from a function as "results" in the post-processor). This no longer appears to be the case, and is now returning errors.

Here is a simple example character that is suddenly causing us headaches: →

------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
------------------------------

Thanks @Sean Mc Cann and team!​

------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
------------------------------

Original Message:
Sent: Thu November 12, 2020 01:13 PM
From: Sean Mc Cann
Subject: Encoding Issues in v38.2

Just an update, you should see this fixed in v39.0

------------------------------
Sean Mc Cann

Original Message:
Sent: Tue October 27, 2020 02:20 PM
From: Jared Fagel
Subject: Encoding Issues in v38.2

Is anyone else suddenly experiencing encoding issues after the v38.2 upgrade?

It used to be the case that passing UTF-8 from a variable into a field was fine (ie if it came from a function as "results" in the post-processor). This no longer appears to be the case, and is now returning errors.

Here is a simple example character that is suddenly causing us headaches: →

------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
------------------------------

Hi, Sean - I'd like to register my interest/concern in this issue too.  I am currently testing V38.2 and coincidentally switching to Python3 for our extensive circuits code.  I noted some encoding issues and initially assumed them to be due to the Python2 -> Python3 transition.  But I had gone through a previous phase of tests on V37.2 + Python3 with no noted encode issues, and having read this thread I now suspect I am witnessing the same issue as Jared.

Is there any way you can share the detail of the now resolved issue so I can be more confident that this is also my issue?  Unless V39.x is released soon, this issue on V38 may enforce a pause to our conversion/test/update plan, so I would like to check the data that appears to force us into that pause.

Thanks and regards - Edwin Bolton

------------------------------
Edwin Bolton
------------------------------

Original Message:
Sent: Thu November 12, 2020 01:13 PM
From: Sean Mc Cann
Subject: Encoding Issues in v38.2

Just an update, you should see this fixed in v39.0

------------------------------
Sean Mc Cann

Original Message:
Sent: Tue October 27, 2020 02:20 PM
From: Jared Fagel
Subject: Encoding Issues in v38.2

Is anyone else suddenly experiencing encoding issues after the v38.2 upgrade?

It used to be the case that passing UTF-8 from a variable into a field was fine (ie if it came from a function as "results" in the post-processor). This no longer appears to be the case, and is now returning errors.

Here is a simple example character that is suddenly causing us headaches: →

------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
------------------------------

Do you know when v39 is released?

------------------------------
Juan Cruz Del Col
------------------------------

Original Message:
Sent: Wed November 18, 2020 11:22 AM
From: Edwin Bolton
Subject: Encoding Issues in v38.2

Hi, Sean - I'd like to register my interest/concern in this issue too.  I am currently testing V38.2 and coincidentally switching to Python3 for our extensive circuits code.  I noted some encoding issues and initially assumed them to be due to the Python2 -> Python3 transition.  But I had gone through a previous phase of tests on V37.2 + Python3 with no noted encode issues, and having read this thread I now suspect I am witnessing the same issue as Jared.

Is there any way you can share the detail of the now resolved issue so I can be more confident that this is also my issue?  Unless V39.x is released soon, this issue on V38 may enforce a pause to our conversion/test/update plan, so I would like to check the data that appears to force us into that pause.

Thanks and regards - Edwin Bolton

------------------------------
Edwin Bolton

Original Message:
Sent: Thu November 12, 2020 01:13 PM
From: Sean Mc Cann
Subject: Encoding Issues in v38.2

Just an update, you should see this fixed in v39.0

------------------------------
Sean Mc Cann

Original Message:
Sent: Tue October 27, 2020 02:20 PM
From: Jared Fagel
Subject: Encoding Issues in v38.2

Is anyone else suddenly experiencing encoding issues after the v38.2 upgrade?

It used to be the case that passing UTF-8 from a variable into a field was fine (ie if it came from a function as "results" in the post-processor). This no longer appears to be the case, and is now returning errors.

Here is a simple example character that is suddenly causing us headaches: →

------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
------------------------------

Juste released ! Dowloading it currently from Fix Central

------------------------------
BENOIT ROSTAGNI
------------------------------

Original Message:
Sent: Wed November 18, 2020 09:21 PM
From: Juan Cruz Del Col
Subject: Encoding Issues in v38.2

Do you know when v39 is released?

------------------------------
Juan Cruz Del Col

Original Message:
Sent: Wed November 18, 2020 11:22 AM
From: Edwin Bolton
Subject: Encoding Issues in v38.2

Hi, Sean - I'd like to register my interest/concern in this issue too.  I am currently testing V38.2 and coincidentally switching to Python3 for our extensive circuits code.  I noted some encoding issues and initially assumed them to be due to the Python2 -> Python3 transition.  But I had gone through a previous phase of tests on V37.2 + Python3 with no noted encode issues, and having read this thread I now suspect I am witnessing the same issue as Jared.

Is there any way you can share the detail of the now resolved issue so I can be more confident that this is also my issue?  Unless V39.x is released soon, this issue on V38 may enforce a pause to our conversion/test/update plan, so I would like to check the data that appears to force us into that pause.

Thanks and regards - Edwin Bolton

------------------------------
Edwin Bolton

Original Message:
Sent: Thu November 12, 2020 01:13 PM
From: Sean Mc Cann
Subject: Encoding Issues in v38.2

Just an update, you should see this fixed in v39.0

------------------------------
Sean Mc Cann

Original Message:
Sent: Tue October 27, 2020 02:20 PM
From: Jared Fagel
Subject: Encoding Issues in v38.2

Is anyone else suddenly experiencing encoding issues after the v38.2 upgrade?

It used to be the case that passing UTF-8 from a variable into a field was fine (ie if it came from a function as "results" in the post-processor). This no longer appears to be the case, and is now returning errors.

Here is a simple example character that is suddenly causing us headaches: →

------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
------------------------------

Hi Edwin,

The error Jared faced here was

Script execution failed with message 'AttributeError: 'NoneType' object has no attribute 'collection_item_changed''

V39.0 is now released, if you are still seeing the same encoding issues you mentioned, please private message me some more details about the scripts causing you problems so that I can take a look into it.

Thanks,

------------------------------
Sean Mc Cann
------------------------------

Original Message:
Sent: Wed November 18, 2020 11:22 AM
From: Edwin Bolton
Subject: Encoding Issues in v38.2

Hi, Sean - I'd like to register my interest/concern in this issue too.  I am currently testing V38.2 and coincidentally switching to Python3 for our extensive circuits code.  I noted some encoding issues and initially assumed them to be due to the Python2 -> Python3 transition.  But I had gone through a previous phase of tests on V37.2 + Python3 with no noted encode issues, and having read this thread I now suspect I am witnessing the same issue as Jared.

Is there any way you can share the detail of the now resolved issue so I can be more confident that this is also my issue?  Unless V39.x is released soon, this issue on V38 may enforce a pause to our conversion/test/update plan, so I would like to check the data that appears to force us into that pause.

Thanks and regards - Edwin Bolton

------------------------------
Edwin Bolton

Original Message:
Sent: Thu November 12, 2020 01:13 PM
From: Sean Mc Cann
Subject: Encoding Issues in v38.2

Just an update, you should see this fixed in v39.0

------------------------------
Sean Mc Cann

Original Message:
Sent: Tue October 27, 2020 02:20 PM
From: Jared Fagel
Subject: Encoding Issues in v38.2

Is anyone else suddenly experiencing encoding issues after the v38.2 upgrade?

It used to be the case that passing UTF-8 from a variable into a field was fine (ie if it came from a function as "results" in the post-processor). This no longer appears to be the case, and is now returning errors.

Here is a simple example character that is suddenly causing us headaches: →

------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
------------------------------