IBM Security QRadar SOAR

Hi Luqman,

Your workflow code is perfect, it looks like the response result of VirusToatal that you send for scan sometimes cannot be converted into a list format but an integer which results in result['response_code'] cannot be found. Following is the test code to reproduce this issue. You may add another exception to handle this case.

-> % cat test.py

RC_NOT_FOUND = 0
RC_READY = 1
RC_IN_QUEUE = -2

results = int(100)

if results['response_code'] == RC_NOT_FOUND:
print(results['response_code'])

-> % python test.py
Traceback (most recent call last):
File "test.py", line 8, in <module>
if results['response_code'] == RC_NOT_FOUND:
TypeError: 'int' object has no attribute '__getitem__'

Hi Luqman,

Your workflow code is perfect, it looks like the response result of VirusToatal that you send for scan sometimes cannot be converted into a list format but an integer which results in result['response_code'] cannot be found. Following is the test code to reproduce this issue. You may add another exception to handle this case.

-> % cat test.py

RC_NOT_FOUND = 0
RC_READY = 1
RC_IN_QUEUE = -2

results = int(100)

if results['response_code'] == RC_NOT_FOUND:
print(results['response_code'])

-> % python test.py
Traceback (most recent call last):
File "test.py", line 8, in <module>
if results['response_code'] == RC_NOT_FOUND:
TypeError: 'int' object has no attribute '__getitem__'

Hi Luqman, 

It's inevitable that playbook would be terminated once function error occurred. It can be addressed only to modify fn_virustotal code. 

I'm not sure you are linking to Quay.io AppHost or your local AppHost. If you have your local AppHost you are able to modify the code and rebuild app docker image then push to AppHost to reinstall virustotal app. Otherwise, I can escalate this issue to our app dev team to fix it. Could you share what artifacts you encountered this issue while sending for the VT scan? 

Hi Luqman,

Your workflow code is perfect, it looks like the response result of VirusToatal that you send for scan sometimes cannot be converted into a list format but an integer which results in result['response_code'] cannot be found. Following is the test code to reproduce this issue. You may add another exception to handle this case.

-> % cat test.py

RC_NOT_FOUND = 0
RC_READY = 1
RC_IN_QUEUE = -2

results = int(100)

if results['response_code'] == RC_NOT_FOUND:
print(results['response_code'])

-> % python test.py
Traceback (most recent call last):
File "test.py", line 8, in <module>
if results['response_code'] == RC_NOT_FOUND:
TypeError: 'int' object has no attribute '__getitem__'

Hi Luqman, 

It's inevitable that playbook would be terminated once function error occurred. It can be addressed only to modify fn_virustotal code. 

I'm not sure you are linking to Quay.io AppHost or your local AppHost. If you have your local AppHost you are able to modify the code and rebuild app docker image then push to AppHost to reinstall virustotal app. Otherwise, I can escalate this issue to our app dev team to fix it. Could you share what artifacts you encountered this issue while sending for the VT scan? 

------------------------------
Sam Wang
IBM QRadar SOAR

Original Message:
Sent: Wed January 04, 2023 04:32 AM
From: Luqman Nur
Subject: Issue with virus total API lookup functionality

Hi Sam Wang,

Thanks for the reply, from what I understand from your reply is that I should wrapped the virus total API lookup in the function part such that it will not trigger the IBM playbook error in the case of the function encountered the specific bug. Also, this might seem like a temporary fix to the bug, is there any way that I could tamper with the virus total code and make a quick lasting fix and use it ( i.e. without publishing it, because it is a minor change)


Again thanks for the help.

Best regards,

------------------------------
Luqman Nur
Techlab

Original Message:
Sent: Wed January 04, 2023 04:09 AM
From: Sam Wang
Subject: Issue with virus total API lookup functionality

Hi Luqman,

Your workflow code is perfect, it looks like the response result of VirusToatal that you send for scan sometimes cannot be converted into a list format but an integer which results in result['response_code'] cannot be found. Following is the test code to reproduce this issue. You may add another exception to handle this case.

-> % cat test.py

RC_NOT_FOUND = 0
RC_READY = 1
RC_IN_QUEUE = -2

results = int(100)

if results['response_code'] == RC_NOT_FOUND:
print(results['response_code'])

-> % python test.py
Traceback (most recent call last):
File "test.py", line 8, in <module>
if results['response_code'] == RC_NOT_FOUND:
TypeError: 'int' object has no attribute '__getitem__'

Hi Luqman, 

If you're using the local AppHost, after you changed the function locally, you can build & push a new docker image with the command below:

-> Copy the dockerfile and entrypoint.sh to the directory (remove the dockerfile's extension name)

-> commands
$ python setup.py sdist
$ docker build . -t  <AppRegistryName>/<Repository>/<packagename:version>     #ex: docker build . -t localhost:5000/ibmresilient/fn_virustotal:1.0.7
$ docker push <AppRegistry>/<Repository>/<fn_name:1.0.0>                          #ex: docker push localhost:5000/ibmresilient/fn_virustotal:1.0.7

Hi Luqman, 

It's inevitable that playbook would be terminated once function error occurred. It can be addressed only to modify fn_virustotal code. 

I'm not sure you are linking to Quay.io AppHost or your local AppHost. If you have your local AppHost you are able to modify the code and rebuild app docker image then push to AppHost to reinstall virustotal app. Otherwise, I can escalate this issue to our app dev team to fix it. Could you share what artifacts you encountered this issue while sending for the VT scan? 

------------------------------
Sam Wang
IBM QRadar SOAR

Original Message:
Sent: Wed January 04, 2023 04:32 AM
From: Luqman Nur
Subject: Issue with virus total API lookup functionality

Hi Sam Wang,

Thanks for the reply, from what I understand from your reply is that I should wrapped the virus total API lookup in the function part such that it will not trigger the IBM playbook error in the case of the function encountered the specific bug. Also, this might seem like a temporary fix to the bug, is there any way that I could tamper with the virus total code and make a quick lasting fix and use it ( i.e. without publishing it, because it is a minor change)


Again thanks for the help.

Best regards,

------------------------------
Luqman Nur
Techlab

Original Message:
Sent: Wed January 04, 2023 04:09 AM
From: Sam Wang
Subject: Issue with virus total API lookup functionality

Hi Luqman,

Your workflow code is perfect, it looks like the response result of VirusToatal that you send for scan sometimes cannot be converted into a list format but an integer which results in result['response_code'] cannot be found. Following is the test code to reproduce this issue. You may add another exception to handle this case.

-> % cat test.py

RC_NOT_FOUND = 0
RC_READY = 1
RC_IN_QUEUE = -2

results = int(100)

if results['response_code'] == RC_NOT_FOUND:
print(results['response_code'])

-> % python test.py
Traceback (most recent call last):
File "test.py", line 8, in <module>
if results['response_code'] == RC_NOT_FOUND:
TypeError: 'int' object has no attribute '__getitem__'

Hi Luqman, 

It's inevitable that playbook would be terminated once function error occurred. It can be addressed only to modify fn_virustotal code. 

I'm not sure you are linking to Quay.io AppHost or your local AppHost. If you have your local AppHost you are able to modify the code and rebuild app docker image then push to AppHost to reinstall virustotal app. Otherwise, I can escalate this issue to our app dev team to fix it. Could you share what artifacts you encountered this issue while sending for the VT scan? 

Hi Luqman,

Your workflow code is perfect, it looks like the response result of VirusToatal that you send for scan sometimes cannot be converted into a list format but an integer which results in result['response_code'] cannot be found. Following is the test code to reproduce this issue. You may add another exception to handle this case.

-> % cat test.py

RC_NOT_FOUND = 0
RC_READY = 1
RC_IN_QUEUE = -2

results = int(100)

if results['response_code'] == RC_NOT_FOUND:
print(results['response_code'])

-> % python test.py
Traceback (most recent call last):
File "test.py", line 8, in <module>
if results['response_code'] == RC_NOT_FOUND:
TypeError: 'int' object has no attribute '__getitem__'

Hi Luqman, 

It's inevitable that playbook would be terminated once function error occurred. It can be addressed only to modify fn_virustotal code. 

I'm not sure you are linking to Quay.io AppHost or your local AppHost. If you have your local AppHost you are able to modify the code and rebuild app docker image then push to AppHost to reinstall virustotal app. Otherwise, I can escalate this issue to our app dev team to fix it. Could you share what artifacts you encountered this issue while sending for the VT scan? 

Hi Luqman,

Your workflow code is perfect, it looks like the response result of VirusToatal that you send for scan sometimes cannot be converted into a list format but an integer which results in result['response_code'] cannot be found. Following is the test code to reproduce this issue. You may add another exception to handle this case.

-> % cat test.py

RC_NOT_FOUND = 0
RC_READY = 1
RC_IN_QUEUE = -2

results = int(100)

if results['response_code'] == RC_NOT_FOUND:
print(results['response_code'])

-> % python test.py
Traceback (most recent call last):
File "test.py", line 8, in <module>
if results['response_code'] == RC_NOT_FOUND:
TypeError: 'int' object has no attribute '__getitem__'

result['response_code'] == RC_NOT_FOUND:

Hi Luqman, 

It's inevitable that playbook would be terminated once function error occurred. It can be addressed only to modify fn_virustotal code. 

I'm not sure you are linking to Quay.io AppHost or your local AppHost. If you have your local AppHost you are able to modify the code and rebuild app docker image then push to AppHost to reinstall virustotal app. Otherwise, I can escalate this issue to our app dev team to fix it. Could you share what artifacts you encountered this issue while sending for the VT scan? 

Hi Luqman,

Your workflow code is perfect, it looks like the response result of VirusToatal that you send for scan sometimes cannot be converted into a list format but an integer which results in result['response_code'] cannot be found. Following is the test code to reproduce this issue. You may add another exception to handle this case.

-> % cat test.py

RC_NOT_FOUND = 0
RC_READY = 1
RC_IN_QUEUE = -2

results = int(100)

if results['response_code'] == RC_NOT_FOUND:
print(results['response_code'])

-> % python test.py
Traceback (most recent call last):
File "test.py", line 8, in <module>
if results['response_code'] == RC_NOT_FOUND:
TypeError: 'int' object has no attribute '__getitem__'

result['response_code'] == RC_NOT_FOUND:

Hi Luqman, 

It's inevitable that playbook would be terminated once function error occurred. It can be addressed only to modify fn_virustotal code. 

I'm not sure you are linking to Quay.io AppHost or your local AppHost. If you have your local AppHost you are able to modify the code and rebuild app docker image then push to AppHost to reinstall virustotal app. Otherwise, I can escalate this issue to our app dev team to fix it. Could you share what artifacts you encountered this issue while sending for the VT scan? 

Hi Luqman,

Your workflow code is perfect, it looks like the response result of VirusToatal that you send for scan sometimes cannot be converted into a list format but an integer which results in result['response_code'] cannot be found. Following is the test code to reproduce this issue. You may add another exception to handle this case.

-> % cat test.py

RC_NOT_FOUND = 0
RC_READY = 1
RC_IN_QUEUE = -2

results = int(100)

if results['response_code'] == RC_NOT_FOUND:
print(results['response_code'])

-> % python test.py
Traceback (most recent call last):
File "test.py", line 8, in <module>
if results['response_code'] == RC_NOT_FOUND:
TypeError: 'int' object has no attribute '__getitem__'