IBM Security QRadar SOAR

 View Only
  • 1.  REST API to integrate SOAR with BMC Remedy

    Posted 28 days ago

    We've been trying for weeks to integrate IBM SOAR with BMC Remedy to no avail. We keep getting an error 500.

    This is the playbook in IBM SOAR:

    The problem is on the second "Call REST API" node, the one that's supposed to create a Service Request on BMC Remedy. This is the code inside that node:

    import json
    # Extract token
    token = str(playbook.functions.results.bmc_integration['content']['text'])
    
    # REST API details
    inputs.rest_api_verify = False
    inputs.rest_api_method = "POST"
    inputs.rest_api_url = "http://<url-hidden-for-this-post>:8008/api/arsys/v1/entry/SRM:RequestInterface_Create"
    
    # Correct the headers dictionary
    inputs.rest_api_headers = json.dumps({
        "Content-Type": "application/json",
        "Authorization": "AR-JWT {}".format(token)
    })
    
    # REST API body using the json module for proper formatting
    inputs.rest_api_body = json.dumps({
        "values": {
            "z1D Action": "CREATE",
            "Source Keyword": "IM",
            "TitleInstanceID": "SRGAA5V0FEF9IARVAJLFRUA3EETALB",
            "First Name": "<hidden-for-this-post>",
            "Last Name": "<hidden-for-this-post>",
            "Customer First Name": "<hidden-for-this-post>",
            "Customer Last Name": "<hidden-for-this-post>",
            "OfferingTitle": "REST API TEST SRM Request 1",
            "Short Description": "REST API TEST SRM Request 1",
            "Status": "Submitted",
            "Company": "<hidden-for-this-post>",
            "Customer Company": "<hidden-for-this-post>",
            "Location Company": "<hidden-for-this-post>"
        }})

    This is the resulting error code when I try to run the playbook:

    For reference, this is the document I used for the integration: How to create a Service Request through REST API

    Kindly advise,

    Thanks.



    ------------------------------
    Makram Aoun
    ------------------------------


  • 2.  RE: REST API to integrate SOAR with BMC Remedy

    Posted 27 days ago

    (Full disclosure, not an expert but somewhat proficient) It looks to me you are using the wrong authentication method and the wrong format of the body.  Can you try doing it this way. You can download the pdf with the documentation here btw

    I wasn't able to test it on a live system but if it does not work, I suggest you read the pdf with the documentation carefully.

    Re, EF

    import json
    # Extract token
    # this will create the needed jwt headers from the provided token
    inputs.jwt_token = str(playbook.functions.results.bmc_integration['content']['text'])
    # token = str(playbook.functions.results.bmc_integration['content']['text'])
    
    # REST API details
    inputs.rest_api_verify = False
    inputs.rest_api_method = "POST"
    inputs.rest_api_url = "http://<url-hidden-for-this-post>:8008/api/arsys/v1/entry/SRM:RequestInterface_Create"
    # headers not needed when using jwt_token authentication, that method creates the required headers itself
    # Correct the headers dictionary
    #header = json.dumps({
    #    "Content-Type": "application/json"})
    #    "Authorization": "AR-JWT {}".format(token) 
    
    # REST API body using the json module for proper formatting
    
    body = {
            "z1D Action": "CREATE",
            "Source Keyword": "IM",
            "TitleInstanceID": "SRGAA5V0FEF9IARVAJLFRUA3EETALB",
            "First Name": "<hidden-for-this-post>",
            "Last Name": "<hidden-for-this-post>",
            "Customer First Name": "<hidden-for-this-post>",
            "Customer Last Name": "<hidden-for-this-post>",
            "OfferingTitle": "REST API TEST SRM Request 1",
            "Short Description": "REST API TEST SRM Request 1",
            "Status": "Submitted",
            "Company": "<hidden-for-this-post>",
            "Customer Company": "<hidden-for-this-post>",
            "Location Company": "<hidden-for-this-post>"
        }
    
    inputs.rest_api_body = json.dumps(body) # this converts the dict to a json string and sets the body


    ------------------------------
    Erwin
    ------------------------------



  • 3.  RE: REST API to integrate SOAR with BMC Remedy

    Posted 27 days ago

    Hi,

    That didn't work. It produces an error 415:



    ------------------------------
    Makram Aoun
    ------------------------------



  • 4.  RE: REST API to integrate SOAR with BMC Remedy

    Posted 25 days ago

    error 415 means the server doesn't understand the payload of the post/request.  Probably the headers parts needs still to be set and and jwt_token function should update it with the correct authorization settings

    So try this:

    import json
    # Extract token
    # this will create the needed jwt headers from the provided token
    inputs.jwt_token = str(playbook.functions.results.bmc_integration['content']['text'])
    # token = str(playbook.functions.results.bmc_integration['content']['text'])
    
    # REST API details
    inputs.rest_api_verify = False
    inputs.rest_api_method = "POST"
    inputs.rest_api_url = "http://<url-hidden-for-this-post>:8008/api/arsys/v1/entry/SRM:RequestInterface_Create"
    
    # Correct the headers dictionary
    header = json.dumps({ "Content-Type": "application/json"})
    
    # REST API body using the json module for proper formatting
    
    body = {
            "z1D Action": "CREATE",
            "Source Keyword": "IM",
            "TitleInstanceID": "SRGAA5V0FEF9IARVAJLFRUA3EETALB",
            "First Name": "<hidden-for-this-post>",
            "Last Name": "<hidden-for-this-post>",
            "Customer First Name": "<hidden-for-this-post>",
            "Customer Last Name": "<hidden-for-this-post>",
            "OfferingTitle": "REST API TEST SRM Request 1",
            "Short Description": "REST API TEST SRM Request 1",
            "Status": "Submitted",
            "Company": "<hidden-for-this-post>",
            "Customer Company": "<hidden-for-this-post>",
            "Location Company": "<hidden-for-this-post>"
        }
    
    inputs.rest_api_body = json.dumps(body) # this converts the dict to a json string and sets the body


    ------------------------------
    Erwin
    ------------------------------