IBM Security QRadar SOAR

 View Only
  • 1.  Error while calling Zscaler API from Resilient

    Posted Sun December 18, 2022 04:24 AM
    Hi All, 

    We are using Utility Function REST API to call the Zscaler API from Resilient but we are getting 400 Authentication error. 

    Credentials are working correctly when we are calling API from Postman. Please let us know how to fix this issue. Attached is the code inside playbook task and error we are facing. 

    Thanks.


    #####Code
    import json
    import time

    def obfuscateApiKey():
    seed = 'XXXXXXXXXXX'
    now = int(time.time() * 1000)
    n = str(now)[-6:]
    r = str(int(n) >> 1).zfill(6)
    key = ""
    for i in range(0, len(str(n)), 1):
    key += seed[int(str(n)[i])]
    for j in range(0, len(str(r)), 1):
    key += seed[int(str(r)[j])+2]
    return now,key


    now , key = obfuscateApiKey()

    content = json.dumps({'username':'admin@example.com','password':'password1234567','apiKey': key ,'timestamp':now})

    inputs.rest_method = "POST"
    inputs.rest_url = "https://zsapi.zscaler.net/api/v1/authenticatedSession"
    inputs.rest_headers = '''
    Content-Type:application/json,
    Cache-Control:no-cache,
    X-Frooble:Baz
    '''

    inputs.rest_body = content
    inputs.rest_verify = True






    ####Error status

    The playbook was terminated by the system due to a function error.

    Traceback (most recent call last):
    File "/opt/app-root/lib/python3.6/site-packages/resilient_lib/components/requests_common.py", line 197, in execute
    response.raise_for_status()
    File "/opt/app-root/lib/python3.6/site-packages/requests/models.py", line 960, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
    requests.exceptions.HTTPError: 400 Client Error: for url: https://zsapi.zscaler.net/api/v1/authenticatedSession

    During handling of the above exception, another exception occurred:

    Traceback (most recent call last):
    File "/opt/app-root/lib/python3.6/site-packages/fn_utilities/components/utilities_call_rest_api.py", line 58, in _call_rest_api_function
    headers_dict, cookies_dict, rest_body, rest_verify, rest_timeout)
    File "/opt/app-root/lib/python3.6/site-packages/fn_utilities/components/utilities_call_rest_api.py", line 116, in make_rest_call
    timeout=rest_timeout)
    File "/opt/app-root/lib/python3.6/site-packages/resilient_lib/components/requests_common.py", line 205, in execute
    raise IntegrationError(msg)
    resilient_lib.components.integration_errors.IntegrationError: '400 Client Error: for url: https://zsapi.zscaler.net/api/v1/authenticatedSession

    ​​

    ------------------------------
    Shubham Agarwal
    ------------------------------


  • 2.  RE: Error while calling Zscaler API from Resilient

    Posted Tue December 20, 2022 09:41 PM
    Hi All, 

    Can someone help me on the below query. I am able to hit this API using Postman and curl from Resilient CLI but not able to implement using Utility function. 

    Thanks

    ------------------------------
    Shubham Agarwal
    ------------------------------



  • 3.  RE: Error while calling Zscaler API from Resilient

    Posted Tue December 27, 2022 09:44 AM
    Hi Shubham,

    Are you using an Integration server or App Host? You may want to try using curl from either of those environments to see if you have clear line of sight to zscalar.

    Regards,
    Mark


    ------------------------------
    Mark Scherfling
    ------------------------------