IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Updating incident - Description patch conflict

    Posted 06/02/20 09:46 AM
    Hi everyone

    I am using IBM Resilient 35.0 and I am trying to update an incident through the REST API.

    I create an incident as:

    curl --location --request POST 'https://192.168.1.5/rest/orgs/201/incidents' \
    --header 'Authorization: Basic <token>' \
    --header 'Content-Type: application/json' \
    --header 'Cookie: JSESSIONID=<sessionId>' \
    --data-raw '{
    "name": "title",
    "description": "desc",
    "discovered_date": 1589391874472
    }'

    I update the incident as:

    curl --location --request PATCH 'https://192.168.1.5/rest/orgs/201/incidents/2104/?text_content_output_format=objects_convert' \
    --header 'Authorization: Basic <token>' \
    --header 'Content-Type: application/json' \
    --header 'Cookie: JSESSIONID=<sessionID>' \
    --data-raw '{
    "changes": [
    {
    "field": {
    "name": "name"
    },
    "old_value": {
    "text": "title"
    },
    "new_value": {
    "text": "titleupdate"
    }
    },
    {
    "field": {
    "name": "description"
    },
    "old_value": {
    "text": "desc"
    },
    "new_value": {
    "text": "desc2"
    }
    }
    ]
    }'

    I get this response:

    {
        "success": false,
        "title": "Patch Failure",
        "message": "One or more edits to an object (Type=Incident, ID 2,104) could not be applied due to a conflicting edit by another user. The following fields were in conflict:  description",
        "hints": [
            "patch_conflict_detected"
        ],
        "error_code": "generic",
        "field_failures": [
            {
                "field": 15,
                "your_original_value": {
                    "format": "html",
                    "content": "desc"
                },
                "actual_current_value": {
                    "format": "html",
                    "content": "desc"
                }
            }
        ]
    }

    The problem only occurs with the description. If I try to update only the title everything is working fine. Any ideas?

    I tried to change old_value and new_value with  { format: "html", content: "desc" } but I get this error: 
    "Unable to process the supplied JSON. The field 'format' is not recognized. The error occurred at line #22 and column #28.",

    Thanks for your time!


    ------------------------------
    Christos Nasikas
    ------------------------------


  • 2.  RE: Updating incident - Description patch conflict

    Posted 06/03/20 08:49 AM
    Try using this type of data for changing the description: 
    {
      "changes": [
        {
          "field": "description",
          "old_value": {
            "textarea": {
              "format": "html",
              "content": "<div class=\"rte\"><div>This is the new description</div></div>"
            }
          },
          "new_value": {
            "textarea": {
              "format": "html",
              "content": "<div class=\"rte\"><div>updated</div></div>"
            }
          }
        }
      ]
    }

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



Related Content