IBM Security QRadar

Hello ,

In order to collect event Oodrive.

I try to transform a script Python to an XML Script. Find here the script Python with tree steps Session cookies negociation, identification and finally authentication steps.

but when I try with for firt steps :

Normally I need to get 4 value for Cookies : XSRF-TOKEN , SNC-auth and TS01759197, TS013be7c9 I have already tested yby Postman for example.

But I get only the last value for Cookies : "xxxxx Cookie":"TS013be7c9=01c xxxxxxxxxxxxxxxxxx". Qradar overwrites others previous values.

to get the session token , I need these values as paramaeters for the next steps.

Do you have any ideas how to get all details for value using XML Workflows ? there is any others parameters to be add in the request to have these details ?

If I stored the response on a file on Qradar. Do you think can store all details with also first Session value ?

Thank you in advance for your assistance or ideas ?

import requests

#Resource owner (enduser) credentials

RO_username='xxxxxxxxxxxx'

RO_password='xxxxxxxxxxxx'

#Environment infos

server = 'smxcxxpp.snc.oodrive.com'

workspace= 'ClientXX'

#Session cookie negociation

URL = "https://"+server+"/auth/ws/"+workspace+"/?service=user-home"

login_url = "https://"+server+"/auth/steps/?service=user-home"

client = requests.session()

Hi,

Please check out this github repository.

https://github.com/IBM/IBM-QRadar-Universal-Cloud-REST-API

There is a lot of sample XML file under "IBM Proof Of Concept" folder which you can refer to build your own XML file.

https://github.com/IBM/IBM-QRadar-Universal-Cloud-REST-API/tree/master/IBM%20Proof%20Of%20Concept

Hope it helps.

Hi I thank for your answer, but I have already consulted this site and I have opened an issue on this site.

I really don't know where to find the answer for this problem, because this is really important for us EDF France and I know that there are other companies that use Universale REST API have the same problem.

I have contacted the manufacturer Oodrive, that is company where we have to retrieve the logs, they tell me that they can't help me with this problem, for them it works with Postman so everything is fine.

Would you have other solutions or websites, discussion group that could give me the solution.

Thanks for your help

Best regards

Hi I thank for your answer, but I have already consulted this site and I have opened an issue on this site.

I really don't know where to find the answer for this problem, because this is really important for us EDF France and I know that there are other companies that use Universale REST API have the same problem.

I have contacted the manufacturer Oodrive, that is company where we have to retrieve the logs, they tell me that they can't help me with this problem, for them it works with Postman so everything is fine.

Would you have other solutions or websites, discussion group that could give me the solution.

Thanks for your help

Best regards