I would like to call a query using rest api where I have to pass the body section. I do it as described in the documentation for the REST API Call function:

inputs.rest_api_body = """
{
    "data": {
        "type": "realTimeSearches",
        "attributes": {
            "query": "HostInfo platform where HostInfo hostname contains PB"
        }
    }
}
"""

or for example:

import json

inputs.rest_api_body  = {
    "data": {
    "type": "realTimeSearches",
        "attributes": {
            "query": "HostInfo hostname and Processes name, parentname where Processes cmdline contains font"
        }
    }
}

every time I call the function I get the information below:

'400 Client Error: Bad Request for url: https://api.manage.trellix.com/edr/v2/searches/realtime' 

Hello Przemyslaw.

I'm afraid that you may encounter the problem due to  confusing 'dict' object with 'str' object.

When passing an input json to the request, it should be a string. (json is a string type object)

So  how about coding the following way? 

import json

body  = {
    "data": {
    "type": "realTimeSearches",
        "attributes": {
            "query": "HostInfo hostname and Processes name, parentname where Processes cmdline contains font"
        }
    }
}
inputs.rest_api_body  = json.dumps(body)

json.dumps(<dict>) returns the <str> for <dict> object.

Further you can check the type by encapsulating with  type(<object>).

Hello Yohji,

I tried to do it your way:

import json

.....

body  = {
    "data": {
    "type": "realTimeSearches",
        "attributes": {
            "query": "HostInfo hostname and Processes name, parentname where Processes cmdline contains font"
        }
    }
}

inputs.rest_api_body  = json.dumps(body)

but it's not working:

ERROR: "'400 Client Error: Bad Request for url: https://api.manage.trellix.com/edr/v2/searches/realtime'" 

import jsonbody  = {    "data": {    "type": "realTimeSearches",        "attributes": {            "query": "HostInfo hostname and Processes name, parentname where Processes cmdline contains font"        }    }}inputs.rest_api_body  = json.dumps(body)

Hi Przemyslaw

Apologies to not resolving your situation.

For REST API call from SOAR side, I have no further idea.

I guess that 400 Bad request may come from client request including post data.

If I were your situation, I may try curl with same post data. (<user>:<password> might be <api-key>:<api-secret>).

curl -X POST -sik -u '<user>:<password>' -d@<post_data_as_file_name> -H  'Content-Type application/json'  https://api.manage.trellix.com/edr/v2/searches/realtime 

I th400 Bad requests originally com

import jsonbody  = {    "data": {    "type": "realTimeSearches",        "attributes": {            "query": "HostInfo hostname and Processes name, parentname where Processes cmdline contains font"        }    }}inputs.rest_api_body  = json.dumps(body)