topic CIRCL hashlookup (hashlookup.circl.lu) 1.0.0 3167802 returns error when no results in Cortex XSOAR Discussions

CIRCL hashlookup (hashlookup.circl.lu) 1.0.0 3167802 returns error when no results

Blazej_Gomoluch — Wed, 29 Jun 2022 05:51:17 GMT

When the integration is used on non-existent hash:

!file file=2795b688bb5918e092e0ee33cd25aa98

Then it end with error:

Reason

Failed to execute file command. Error: Error in API call [404] - NOT FOUND {"message": "Non existing MD5", "query": "2795b688bb5918e092e0ee33cd25aa98"}

Usually all other !file just return info that the hash was not found:

URLhaus:

MD5	2795b688bb5918e092e0ee33cd25aa98
Result	Not found

Could you please modify the integration so when no hash found it does not fail with error but rather just informs that no hash was found.

CIRCL hashlookup (hashlookup.circl.lu) 1.0.0 3167802

Re: CIRCL hashlookup (hashlookup.circl.lu) 1.0.0 3167802 returns error when no results

jfernandes1 — Thu, 30 Jun 2022 00:34:06 GMT

Hi @Blazej_Gomoluch, Seeing that the response is 404, not sure if they will change it. If you're using this command inside a playbook, I have some a workaround for you.

You can ignore error and continue.

If not using 6.8, you should see a toggle at the bottom of the task window called "Stop on Error". You can then check for an error like below.

Re: CIRCL hashlookup (hashlookup.circl.lu) 1.0.0 3167802 returns error when no results

Blazej_Gomoluch — Mon, 18 Jul 2022 10:19:19 GMT

The !file command is using all the integrations at once. So doing it like this is not really a solution for me. I would like to bail on error if such occurs. But if there are no results I would like that all the integrations behave the same way (no error on 404).

I think I will modify the integration in my environment myself for now.

Re: CIRCL hashlookup (hashlookup.circl.lu) 1.0.0 3167802 returns error when no results

jfernandes1 — Tue, 19 Jul 2022 01:47:21 GMT

Hi @Blazej_Gomoluch, You can call the !File command against a single instance or integration with the "using" parameter. In the playbook task its located in the "Advanced" tab.

You can also handle the error via an automation using the above "using" parameter. Modifying an integration should be a last resort since you will no longer receive updates.