IBM Security QRadar SOAR

 View Only

Copying properties json dictionary REST API

  • 1.  Copying properties json dictionary REST API

    Posted Tue November 12, 2019 11:12 PM
    Hi all,

    I'm trying to copy the properties from an existing incident to a newly created child incident using the following script :-

    new_incident = {"name": inc_name,
    "description": inc_desc,
    "incident_type_ids": inc_types,
    "discovered_date": time_now,
    "properties": {}
    }
    uri = '/incidents'
    parent_incident = resilient_client.get("/incidents/{}?handle_format=names".format(parent_incident_id))

    # Create the incident
    new_incident["properties"]["parent_incident_id"] = parent_incident_id
    incident = resilient_client.post(uri, new_incident)
    child_incident_id = incident["id"]


    print("Created incident {}".format(child_incident_id))


    results = {
    "success": True,
    }

    yield StatusMessage("Child Creation Complete")

    parent_incident = resilient_client.get("/incidents/{}?handle_format=names".format(parent_incident_id))
    child_incident = resilient_client.get("/incidents/{}?handle_format=names".format(child_incident_id))

    print("Testing printing statement")

    incident_put_uri = '/incidents/fields'
    parent_properties_dict = parent_incident.get("properties")
    if parent_properties_dict is not None:
    for key, value in parent_properties_dict.items():
    if value == "null":
    parent_properties_dict[key] = None
    print(json.dumps(parent_properties_dict, indent=2))
    child_incident.get('vers'), "name": child_incident.get('name'), "discovered_date": child_incident.get('discovered_date')}

    parent_properties_json = json.dumps(parent_properties_dict)
    parent_properties_dict['vers'] = child_incident.get('vers')
    parent_properties_dict['name'] = child_incident.get('name')
    parent_properties_dict['discovered_date'] = child_incident.get('discovered_date')

    incident_put_response = resilient_client.post(incident_put_uri + "/" + str(child_incident_id), parent_properties_dict)
    handle_format=names".format(child_incident_id), parent_properties_json)
    print(incident_put_response)

    However, on running the above I'm getting internal server error

    packages/fn_child_incident/fn_child_incident/components/child_incident_create.py", line 77, in _fn_child_incident_function
    incident_put_response = resilient_client.post(incident_put_uri + "/" + str(child_incident_id), parent_properties_dict)
    File "/app/localstorage/jaiswarj/CS7/homes/cs7_integration/.git/resilient-integrations/share/python/lib/python2.7/site-packages/resilient/co3.py", line 300, in post
    _raise_if_error(ex.get_response())
    File "/app/localstorage/jaiswarj/CS7/homes/cs7_integration/.git/resilient-integrations/share/python/lib/python2.7/site-packages/resilient/co3.py", line 163, in _raise_if_error
    raise SimpleHTTPException(response)
    SimpleHTTPException: Internal Server Error: {"success":false,"title":null,"message":"Internal Server Error","hints":[],"error_code":"generic"}
    >

    Can anyone please suggest what do I need to do. I think it might be something to do with posting the json.


    ------------------------------
    Arjun Jaiswal
    ------------------------------