How to remove Integration "cache" completely

pottapitot — Sun, 25 Dec 2022 07:41:39 GMT

Hi,

We are facing an issue where the integration ran into an error trying to pull an investigation from Secureworks, where an asset was not found, and the integration kept giving the same error continuously and would not pull the next investigation or further investigations after that.

Below is the error the integration gives

Error: Script failed to run: Error: [Traceback (most recent call last): File "<string>", line 1004, in <module> File "<string>", line 999, in main File "<string>", line 7826, in return_error Exception: Failed to execute fetch-incidents command. Error: Error when fetching investigations: asset with ID: 7164f57e-32432-5d45-9c7b--09d8sf0s86329 not found ] (2604) (2603)

So, I reset the last run timestamp, hoping to make the integration read the next set of investigation, since I closed the investigation in question (that Secureworks is checking as to why that happened). However, the integration instance still gives the same error.

I next created another instance with the default settings. Even that gave the same error.

Next I tried deleting the entire integration and installed it again. I created a new instance hoping that would work but unfortunately I got the same error.

However, when I run individual commands from the playbook of this integration, it works fine. I can pull investigations without any issues using the integration commands.

Is this issue from the XSOAR? If yes, how can reset or clear cache, if that is present to make the instance only pull the new investigations?

Thanks in advance.

Re: How to remove Integration "cache" completely

jfernandes1 — Wed, 28 Dec 2022 03:18:17 GMT

Hi @pottapitot, the SecureWorks integration is maintained by the vendor. Please contact support@secureworks.com for any issues.

Looks like the error is coming for the API response.

topic Re: How to remove Integration "cache" completely in Cortex XSOAR Discussions

How to remove Integration "cache" completely

Re: How to remove Integration "cache" completely