IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  get_file_attachment failed

    Posted 05/08/19 09:28 AM
    Hello,

    I'm developing a new integration for the resilient platform.

    Following the guide I have my function installed successfully, also defined a workflow.

    When calling the workflow from actions menu, I'm getting the following error:

    2019-05-03 04:43:01,000 ERROR [actions_component] <task[functionworker] (<function _call_the_task at 0x7fb2d0249758>, <fn_sndbox_sandbox_analyzer[functions.fn_sndbox_sandbox_analyzer] (id=2, workflow=example_sndbox_sandbox_analyzer_attachment, user=tomer@sndbox.com) 2019-05-03 04:43:00.427000> incident_id=2096, attachment_id=4)> (<class 'resilient_circuits.action_message.FunctionException_'>): FunctionException_: <Traceback (most recent call last):
  File "/home/resadmin/.local/lib/python2.7/site-packages/fn_sndbox_analyzer/components/fn_sndbox_sandbox_analyzer.py", line 98, in _fn_sndbox_sandbox_analyzer_function
    attachment_id=attachment_id)
  File "/usr/local/lib/python2.7/site-packages/resilient_lib/components/resilient_common.py", line 101, in get_file_attachment
    return res_client.get_content(data_uri)
  File "/usr/local/lib/python2.7/site-packages/resilient/co3.py", line 278, in get_content
    _raise_if_error(ex.get_response())
  File "/usr/local/lib/python2.7/site-packages/resilient/co3.py", line 163, in _raise_if_error
    raise SimpleHTTPException(response)
SimpleHTTPException: Bad Request:  <!DOCTYPE html>
<html lang="en"><head>
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <title>Co3 Systems Download Error</title>
    <meta name="description" content="">
    <meta name="author" content="">
    <link rel="shortcut icon" href="/assets/favicon.ico" />
    <link rel="stylesheet" href="/css/bootstrap3.3.5.min.css">
    <script src="/js/jquery.js"></script>
    <script src="/js/jquery.placeholder.min.js"></script>
  </head>
  <body>
    <h1><img src="/assets/co3-logo.png"></h1>
    <p>
        An error occurred while downloading the content.
    </p>
    <a href="javascript:window.history.back()">Back</a>
  </body>
</html>
>
  File "/usr/local/lib/python2.7/site-packages/circuits/core/manager.py", line 856, in processTask
    raise value.extract()
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/site-packages/circuits/core/manager.py", line 617, in _dispatcher
    event_handlers = self._cache[(event.name, channels)]
KeyError: ('exception', ('*',))
^C2019-05-03 04:43:​


    ------------------------------
    Tomer
    ------------------------------


  • 2.  RE: get_file_attachment failed

    Posted 05/08/19 11:41 AM
    Hi Tomer,

    Can you provide us the status code for this error, you could check the client log and copy paste it here.
    It would be easier to asses what's happening if you could also provide the snippet of your code.

    Here is a quick example how to get the content of an attachment using resilient_lib:
    from resilient_lib import get_file_attachment

# Get the function parameters:
incident_id = kwargs.get("incident_id")  # number
task_id = kwargs.get("task_id")  # number
attachment_id = kwargs.get("attachment_id")  # number
artifact_id = kwargs.get("artifact_id") # number

# Build the document payload which is a base64-encoded string.
client = self.rest_client()

# Get the attachment data
data = get_file_attachment(client, incident_id, artifact_id, task_id, attachment_id)​

    Best,
    Tamara



    ------------------------------
    Tamara Zlender
    ------------------------------



Related Content