IBM Security QRadar SOAR

 View Only

  • 1.  API output not in valid json format and unable to get value from json dictionary

    Posted 30 days ago

    I am testing the Rest API app to make a query to lookup the geo location of an IP address using ipinfo.io. 
    I was able to get the result but I never able to pull any data from the json dictionary to add to the Notes.   

    I tried to load the json result to an python interpreter on another system but got an error when perform the json.loads due to invalid json format.
    I wonder if anyone experienced with similar issue and if there is a way we can make the output in valid json format? 

    In the SOAR output script, I tried to return any value but it always returned an error:

    An error occurred while processing the action acknowledgement. Additional information: Script 'Process REST Response' from Playbook 'CALL REST API (Tenable.io - Vulns) 2' was unable to complete because: TypeError: string indices must be integers

    Function:

    import json
    headers = {
        'Content-Type': 'application/json'
    }
    inputs.rest_api_method = 'GET'
    inputs.rest_api_headers = json.dumps(headers)
    inputs.rest_api_url = 'https://ipinfo.io/{}/geo'.format(artifact.value)
    inputs.rest_api_verify = True

    API Result:

    {'version': 2.0, 'success': True, 'reason': None, 'content': {'ok': True, 'url': 'https://ipinfo.io/8.8.8.8/geo', 'status_code': 200, 'reason': 'OK', 'cookies': {}, 'headers': {'server': 'nginx/1.24.0', 'date': 'Fri, 29 Mar 2024 02:35:08 GMT', 'content-type': 'application/json; charset=utf-8', 'Content-Length': '304', 'access-control-allow-origin': '*', 'x-frame-options': 'SAMEORIGIN', 'x-xss-protection': '1; mode=block', 'x-content-type-options': 'nosniff', 'referrer-policy': 'strict-origin-when-cross-origin', 'x-envoy-upstream-service-time': '2', 'via': '1.1 google', 'strict-transport-security': 'max-age=2592000; includeSubDomains', 'Alt-Svc': 'h3=":443"; ma=2592000,h3-29=":443"; ma=2592000'}, 'elapsed': 249, 'apparent_encoding': 'ascii', 'text': '{\n "ip": "8.8.8.8",\n "hostname": "dns.google",\n "anycast": true,\n "city": "Mountain View",\n "region": "California",\n "country": "US",\n "loc": "37.4056,-122.0775",\n "org": "AS15169 Google LLC",\n "postal": "94043",\n "timezone": "America/Los_Angeles",\n "readme": "https://ipinfo.io/missingauth"\n}', 'json': {'ip': '8.8.8.8', 'hostname': 'dns.google', 'anycast': True, 'city': 'Mountain View', 'region': 'California', 'country': 'US', 'loc': '37.4056,-122.0775', 'org': 'AS15169 Google LLC', 'postal': '94043', 'timezone': 'America/Los_Angeles', 'readme': 'https://ipinfo.io/missingauth'}, 'links': {}}, 'raw': None, 'inputs': {'rest_api_cookies': {'format': 'text', 'content': None}, 'rest_api_headers': '{"Content-Type": "application/json"}', 'rest_api_method': 'GET', 'rest_api_verify': True, 'rest_api_allowed_status_codes': '', 'rest_api_url': 'https://ipinfo.io/8.8.8.8/geo', 'rest_api_body': {'format': 'text', 'content': None}, 'rest_api_timeout': None}, 'metrics': {'version': '1.0', 'package': 'fn-rest-api', 'package_version': '1.2.0', 'host': '2113c932-3251-4142-8c58-7d7f73b440aa-6cd9bb5d5c-999vd', 'execution_time_ms': 785, 'timestamp': '2024-03-29 02:35:08'}}



    ------------------------------
    Ray Tam
    ------------------------------


  • 2.  RE: API output not in valid json format and unable to get value from json dictionary

    Posted 29 days ago

    it looks like your result is a string instead of json and the json.loads function doesn't like that all the keys are in single quote marks.

    Try this:

    parsed = json.dumps(api_results, indent=4)
    incident.addNote(json.loads(parsed))



    ------------------------------
    Maria Czapkowska
    ------------------------------

    Original Message


  • 3.  RE: API output not in valid json format and unable to get value from json dictionary

    Posted 26 days ago

    Hi Maria,

    Thanks for the tips and explanation.  I tried the suggestion but got the error below.  I think it still doesn't like it is a string in your explanation but I was able to test it using Yohji's suggestion.  Thank you again.  You help me on my other questions before.

    parsed = json.dumps(api_results, indent=4)
    incident.addNote(json.loads(parsed))

    An error occurred while processing the action acknowledgement.  Additional information: Script 'Process REST Response' from Playbook 'CALL REST API (ipinfo.io) ' was unable to complete because: TypeError: addNote() expects one parameter of type str or TextObject, not dict



    ------------------------------
    Ray Tam
    ------------------------------

    Original Message


  • 4.  RE: API output not in valid json format and unable to get value from json dictionary

    Posted 29 days ago

    The output is in json format but specifically in a python dictionary. The signature of all output is:

    {
    version: xx,
    success: True/False,
    reason: "failure message",
    content: <api json result>
    }

    If you prettify the result above, you'll see the API result under "content" and "json". Abbreviated, your post-processing script would look like this, if using playbooks:


    results = playbook.function.results.<your restapi output>

    if not results.success:
    incident.addNote(f"RestAPI failure: {results.reason}")
    else:
    content = results.content.json
      geo_loc = content.loc

    Hope this helps.



    ------------------------------
    Mark Scherfling
    ------------------------------

    Original Message


  • 5.  RE: API output not in valid json format and unable to get value from json dictionary

    Posted 26 days ago

    Hi Mark,

    Thanks! That works great!  I am able to output the field value.  I will learn from this example and use it on my other use cases.  Thank you!



    ------------------------------
    Ray Tam
    ------------------------------

    Original Message


  • 6.  RE: API output not in valid json format and unable to get value from json dictionary
    Best Answer

    Posted 27 days ago

    Hi Ray

    I suppose you're working with output returned by "Call REST API" function.

    When I access to SOAR rest API via "Call REST API" function, I did the following ways:

    ---
    import json
    outputs = playbook.functions.results.output
    text_data = outputs["content"]["text"]
    json_data = json.loads(text_data)

    # to view on web
    incident.addNote(str(json_data))

    # to view on terminal 
    log.info(str(json_data))    # output goes to /var/log/resilient-scripting/resilient-scripting.log
                    # To view the loggs, sudo grep LoggerContext /var/log/resilient-scripting/resilient-scripting.log

    ---



    ------------------------------
    Yohji Amano
    ------------------------------

    Original Message


  • 7.  RE: API output not in valid json format and unable to get value from json dictionary

    Posted 26 days ago

    HI Yohji,

    Thank you.  It did the trick.  Good to learn how to output all the contents under the "text" section.

    The log.info tips to the resilient-scripting.log is cool.  I didn't know about this option.



    ------------------------------
    Ray Tam
    ------------------------------

    Original Message