IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

resilient-lib close_incident Bad Request

  • 1.  resilient-lib close_incident Bad Request

    Posted Mon August 22, 2022 10:33 AM
    Getting Bad Request: {"success":false,"title":null,"message":"Bad Request","hints":[],"error_code":"generic"} when trying Close an incident in SOAR using resilient-lib , see below (incident_id is str)

    res = close_incident(
                res_client=res_client,
                incident_id=incident_id,
                kwargs={"resolution_id""Not an Issue""resolution_summary""Lookup table updated",
                        "remediation_plan":"No Action Required""business_unit":"IT - Information Security"
                        "escalation":"None""location":"Corp"}, 
                handle_names=True
            )

    How do I troubleshoot for what is missing ?


    ------------------------------
    Irek Romaniuk
    ------------------------------


  • 2.  RE: resilient-lib close_incident Bad Request

    Posted Wed September 07, 2022 09:43 AM
    Hi Irek,

    More then likely you are missing a Required On Close field

    You can monitor the client.log to see more details about the error: https://www.ibm.com/docs/en/sqsp/46?topic=guide-log-file-configuration

    ------------------------------
    Shane Curtin
    Apps Engineer - IBM Security SOAR
    ------------------------------