Problem using GenericPolling with Qradar v3 command

gkindley — Fri, 30 Sep 2022 17:45:07 GMT

Hi everyone,

I'm trying to use the GenericPolling playbook to wait for the "COMPLETED" status of a query in a QRadarv3 Integration. I use the following configuration:

Ids: ${QRadar.Search.ID}
PollingCommandName: qradar-search-status-get
PollingCommandArgName: search_id
Interval: 1
Timeout: 30
dt: QRadar.Search(val.Status!== 'COMPLETED' || val.Status!== 'CANCELED').ID

But when I try to use it, throws the following error:

Failed to execute qradar-search-status-get command. Error: Error in API call [404] - 404 Query b'300ff143-6a8b-4765-bb8c-a1498ccf959c' does not exist Traceback (most recent call last): File "<QRadar v3>", line 3704, in main File "<QRadar v3>", line 2445, in qradar_search_status_get_command File "<QRadar v3>", line 542, in search_status_get File "<QRadar v3>", line 369, in http_request File "<CommonServerPython>", line 8528, in _http_request File "<QRadar v3>", line 411, in qradar_error_handler DemistoException: Error in API call [404] - 404 Query b'300ff143-6a8b-4765-bb8c-a1498ccf959c' does not exist

I'd already used each command (qradar-search-create, then qradar-search-status-get and wait for the COMPLETED STATUS, then qradar-search-results-get) without any error. Do you see anything wrong in the GenericPolling inputs that can be made to fail the task? I suspect the problem is that the entire string b'300ff143-6a8b-4765-bb8c-a1498ccf959c' is passed as argument in the qradar-search-status-get command including the b' '. If it's the case, there is any way to avoid that?

I really appreciate any suggestion.

Regards.

Re: Problem using GenericPolling with Qradar v3 command

gkindley — Mon, 03 Oct 2022 18:17:55 GMT

I realize that the problem is a bug fixed in a new version of Common Scripts from marketplace:

topic Re: Problem using GenericPolling with Qradar v3 command in Cortex XSOAR Discussions

Problem using GenericPolling with Qradar v3 command

Re: Problem using GenericPolling with Qradar v3 command