IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  IBM SOAR encoded params request so that I got 400 error code using REST API functions (app)

    Posted 04/10/24 09:42 AM

    Hello, 

    I'm trying to integrate IBM Qradar SOAR to a third party solution using REST API functions app, so the provided python code from the third party solution is this :

    #Python version - 3.8
#This script requires requests module installed in python.
import requests
 
url = "https://10.49..x.x:8086/api/v3/users"
headers ={"authtoken":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"}
input_data = '''{
    "list_info": {
        "search_fields": {
            "email_id": "myemail@xxxx.xx"
        }
    },
    "fields_required": [
        "name",
        "id"
}'''
params = {'input_data': input_data}
response = requests.get(url,headers=headers,params=params,verify=False)
print(response.text)

    Trying to adopt it in IBM SOAR I wrote this code : 

    import json
import re

try:
  
  input_data = ''' "list_info": {
        "search_fields": {
            "email_id": "myemail@xxx.xx"
        } '''
        
  input_data = json.dumps(input_data)
  
  params = f''' "input_data" :  {input_data} '''

  inputs.rest_api_method  = 'GET' 
    
  headers = { 
    'authtoken':'{{apiauthtoken}}' }
  
  inputs.rest_api_headers  = json.dumps(headers)
  
  inputs.rest_api_query_parameters = json.dumps(params)
  
  inputs.rest_api_url     = 'https://10.49.x.x:8086/api/v3/users'
  
  # Indicates whether to verify SSL certificates (boolean).
  inputs.rest_api_verify  = False

except:
  incident.addNote('Failed the request')

    I'm confused so that every time I get 400 ERROR code like this : 
    "'400 Client Error: for url: https://10.49x.x:8086/api/v3/users?%20%22input_data%22%20:%20%22%20%5C%22list_info%5C%22:%20%7B%..........

    I appreciate any help regarding this matter.

    Thank you,



    ------------------------------
    Sha Ben
    Cybersecurity engineer
    ------------------------------


  • 2.  RE: IBM SOAR encoded params request so that I got 400 error code using REST API functions (app)

    Posted 04/11/24 01:29 AM

    Error 400 means bad request (read more about it here) I suggest you download the rest api app logs and check what it's sending. It could be a missed comma that's messing it up.

    This may be an issue only I'm experiencing, but if you get an error when trying to download app logs don't put in a start date then it works.



    ------------------------------
    Maria Czapkowska
    ------------------------------



  • 3.  RE: IBM SOAR encoded params request so that I got 400 error code using REST API functions (app)

    Posted 04/11/24 04:56 AM

    Thank you for your reply Maria,



    It seems that the params got encoded automatically, that's what makes the error code 400 shows up.

    From the first Python code I provided it works perfectly fine with 200 response but when I use the REST API functions app it seems that it's not interpreting the JSON params correctly.



    ------------------------------
    Sha Ben
    Cybersecurity engineer
    ------------------------------

    Original Message


  • 4.  RE: IBM SOAR encoded params request so that I got 400 error code using REST API functions (app)

    Posted 04/11/24 08:45 AM

    Hi Sha -

    Please simply remove the ''' around your input params variable's value. When you later set 

    inputs.rest_api_query_parameters = json.dumps(params)

    you are assuming that params is a dict. You, however, are making it a string of strings. You're doing more than you need. Please try this modified code:

    import json
import re

try:
  
  input_data = ''' "list_info": {
        "search_fields": {
            "email_id": "myemail@xxx.xx"
        }} '''
        
  input_data = json.dumps(input_data)
  
  params = {"input_data" :  {input_data}}

  inputs.rest_api_method  = 'GET' 
    
  headers = { 
    'authtoken':'{{apiauthtoken}}' }
  
  inputs.rest_api_headers  = json.dumps(headers)
  
  inputs.rest_api_query_parameters = json.dumps(params)
  
  inputs.rest_api_url     = 'https://10.49.x.x:8086/api/v3/users'
  
  # Indicates whether to verify SSL certificates (boolean).
  inputs.rest_api_verify  = False

except:
  incident.addNote('Failed the request')

    you also have a lot of unclosed { and [ in your data. Please ensure that this is all properly formatted. And be sure that you match the same input data that you're using in your python script. I think you've omitted some details, which the endpoint may require.

    In general, simply use basic Python objects (lists, dicts) until you finally set the inputs.<variable_name> at which point it is time to use json.dumps().

    Please spend some time trying to clean up your code and come back to me if you have any further questions.



    ------------------------------
    Bo Bleckel
    ------------------------------

    Original Message


  • 5.  RE: IBM SOAR encoded params request so that I got 400 error code using REST API functions (app)

    Posted 04/12/24 06:20 AM

    Hello Bo,

    Thank you for your message,

    After 2 weeks of stagnation, I was so confused of the reason that makes the script not running properly, today, I realized it's as simple as I thought (I just reformatted the code and now it works ).



    But I would like to mention for the sake of improvement that it would be nice to think about a built-in logging functionality (figuring out the problem without having the proper logging mechanisms might be frustrating for some); I hope the upcoming versions will have improvement of debugging scripts naturally without hard coding logs.

    Thank you,



    ------------------------------
    Sha Ben
    Cybersecurity engineer
    ------------------------------

    Original Message


Related Content