I would like to call a query using rest api where I have to pass the body section. I do it as described in the documentation for the REST API Call function:

inputs.rest_api_body = """
{
    "data": {
        "type": "realTimeSearches",
        "attributes": {
            "query": "HostInfo platform where HostInfo hostname contains PB"
        }
    }
}
"""

or for example:

import json

inputs.rest_api_body  = {
    "data": {
    "type": "realTimeSearches",
        "attributes": {
            "query": "HostInfo hostname and Processes name, parentname where Processes cmdline contains font"
        }
    }
}

every time I call the function I get the information below:

'400 Client Error: Bad Request for url: https://api.manage.trellix.com/edr/v2/searches/realtime' 

Hello Przemyslaw.

I'm afraid that you may encounter the problem due to  confusing 'dict' object with 'str' object.

When passing an input json to the request, it should be a string. (json is a string type object)

So  how about coding the following way? 

import jsonbody  = {    "data": {    "type": "realTimeSearches",        "attributes": {            "query": "HostInfo hostname and Processes name, parentname where Processes cmdline contains font"        }    }}inputs.rest_api_body  = json.dumps(body)

json.dumps(<dict>) returns the <str> for <dict> object.

Further you can check the type by encapsulating with  type(<object>).

I would like to call a query using rest api where I have to pass the body section. I do it as described in the documentation for the REST API Call function:

inputs.rest_api_body = """
{
    "data": {
        "type": "realTimeSearches",
        "attributes": {
            "query": "HostInfo platform where HostInfo hostname contains PB"
        }
    }
}
"""

or for example:

import json

inputs.rest_api_body  = {
    "data": {
    "type": "realTimeSearches",
        "attributes": {
            "query": "HostInfo hostname and Processes name, parentname where Processes cmdline contains font"
        }
    }
}

every time I call the function I get the information below:

'400 Client Error: Bad Request for url: https://api.manage.trellix.com/edr/v2/searches/realtime' 

Hello Yohji,

I tried to do it your way:

import json

.....

body  = {
    "data": {
    "type": "realTimeSearches",
        "attributes": {
            "query": "HostInfo hostname and Processes name, parentname where Processes cmdline contains font"
        }
    }
}

inputs.rest_api_body  = json.dumps(body)

but it's not working:

ERROR: "'400 Client Error: Bad Request for url: https://api.manage.trellix.com/edr/v2/searches/realtime'" 

Hello Przemyslaw.

I'm afraid that you may encounter the problem due to  confusing 'dict' object with 'str' object.

When passing an input json to the request, it should be a string. (json is a string type object)

So  how about coding the following way? 

import jsonbody  = {    "data": {    "type": "realTimeSearches",        "attributes": {            "query": "HostInfo hostname and Processes name, parentname where Processes cmdline contains font"        }    }}inputs.rest_api_body  = json.dumps(body)

json.dumps(<dict>) returns the <str> for <dict> object.

Further you can check the type by encapsulating with  type(<object>).

I would like to call a query using rest api where I have to pass the body section. I do it as described in the documentation for the REST API Call function:

inputs.rest_api_body = """
{
    "data": {
        "type": "realTimeSearches",
        "attributes": {
            "query": "HostInfo platform where HostInfo hostname contains PB"
        }
    }
}
"""

or for example:

import json

inputs.rest_api_body  = {
    "data": {
    "type": "realTimeSearches",
        "attributes": {
            "query": "HostInfo hostname and Processes name, parentname where Processes cmdline contains font"
        }
    }
}

every time I call the function I get the information below:

'400 Client Error: Bad Request for url: https://api.manage.trellix.com/edr/v2/searches/realtime'