topic Re: Cherwell Fetch Incident fails in Cortex XSOAR Discussions

Cherwell Fetch Incident fails

r_buchwalder — Tue, 20 Jul 2021 13:49:16 GMT

Hello

We use Demisto Version 6.2.0, Build 1271082

If I configure a Cherwell Instance to fetch incident but It fails with the following Error:

Failed to get samples from instance

Error details

Script failed to run: 
Error: [Traceback (most recent call last):
   
   File "<string>", line 1017, in <module>
 Exception: '<' not supported between instances of 'NoneType' and 'NoneType'
] (2604) (2603)

This error pops up in the Cherwell Instance and in Incidents Classification Editor

How do I solve it?

thanks

roger

Re: Cherwell Fetch Incident fails

jgomes — Tue, 20 Jul 2021 14:08:31 GMT

Are you using Cherwell Onprem or Cloud?

Re: Cherwell Fetch Incident fails

r_buchwalder — Tue, 20 Jul 2021 14:18:10 GMT

We use onprem

Re: Cherwell Fetch Incident fails

jgomes — Tue, 20 Jul 2021 21:01:24 GMT

As per our doc guide - we officially support and tested with the Cloud SaaS Version:

https://xsoar.pan.dev/docs/reference/integrations/cherwell

I am aware that for on-prem Cherwell, Authentication fails. We came up with a local Integration patch.

Apart from that, everything else with the integration appears to work fine.

Quick fix is you can clone the integration, and make the following changes:

def request_new_access_token(using_refresh): #PATCH for on-premise url = BASE_URL + "token?auth_mode=Windows" #url = BASE_URL + "token"

Vendor docs here:

https://help.cherwell.com/bundle/cherwell_rest_api_940_help_only/page/oxy_ex-1/content/system_administration/rest_api/csm_rest_oauth2_windows_ldap_entered_credentials_authentication.html#ObtainingApiClientIds

We already have internal GIT issue (32068) as feature enhancement for this.

Unfortunately, the customer with this issue didn't raise an AHA request to drive change / improvement to our OOTB content.

I recommend doing this here https://xsoar.ideas.aha.io/ideas/search?utf8=%E2%9C%93&query=Cherwell so other customers can upvote to support On-Premises Cherwell in our standard supported content.

Let us know if this works for you!

Cheers,

Jason

Re: Cherwell Fetch Incident fails

r_buchwalder — Wed, 21 Jul 2021 06:02:40 GMT

Hello Jason

Thanks for your quick and proper solution. Sadly it doesn't work on my side.

I still get the same error as above.

I've modified line 126, but didn't helped. The Check/Test of the new service was:

Unexpected error: '<' not supported between instances of 'NoneType' and 'NoneType', traceback: Traceback (most recent call last): File "<string>", line 9133, in <module> File "<string>", line 8840, in test_command File "<string>", line 8629, in fetch_incidents File "<string>", line 8549, in get_all_incidents TypeError: '<' not supported between instances of 'NoneType' and 'NoneType' (85)

First of all I've entered all the credentials we use to connect to Cherwell.

Without "Fetch incidents" and did a test: "Success"

Then I've enabled "Fetch Incidents" - Test - Error above in the spoiler.

If switch back to "Do not fetch" I do get a "Success" again.

Thank you

roger

Re: Cherwell Fetch Incident fails

jgomes — Wed, 21 Jul 2021 14:01:10 GMT

From playground, run fetch and test module in debug mode. This may provide more clarity on what fetch and test failure is doing:

!<instance name>-fetch debug-mode=true !<instance name>-test-module debug-mode=true

ref: https://xsoar.pan.dev/docs/reference/articles/troubleshooting-guide

Also on 6.2 you can select debug mode in instance settings (drop list) which saves the debug log to disk in:
/var/log/demisto/integration-instance.log

Also, you may want to check the API directly with POSTMAN or with basic REST Python script.
https://help.cherwell.com/bundle/cherwell_rest_api_940_help_only/page/oxy_ex-1/content/system_administration/rest_api/csm_opening_swagger.html#OpenSwagger

I also assume your were using Windows auth for SSO. There also appears other options like LDAP, SAML, and 'internal' - depending on your on-premise setup. ie. for getting a token successfully appending ?auth_mode=

https://help.cherwell.com/bundle/cherwell_rest_api_940_help_only/page/oxy_ex-1/content/system_administration/rest_api/csm_rest_about_authentication_modes.html

Re: Cherwell Fetch Incident fails

r_buchwalder — Thu, 22 Jul 2021 06:24:50 GMT

Hello Jgomes

Here the output of the debug mode:

2021-07-22 08:12:41.0349 debug Running <name>_instance_1_<name>_fetch-incidents. Timeout: 5m0s (source: /builds/gopath/src/github.com/demisto/server/services/automation/dockercoderunner.go:245) 2021-07-22 08:12:41.0351 debug Sending runner request for script [<name>_instance_1_<name>_fetch-incidents] (source: /builds/gopath/src/github.com/demisto/server/services/automation/dockercoderunner.go:292) 2021-07-22 08:12:41.0352 debug Waiting for runner request for unnested script [<name>_instance_1_<name>_fetch-incidents], with script timeout [5m0s] (source: /builds/gopath/src/github.com/demisto/server/services/automation/dockercoderunner.go:326) 2021-07-22 08:12:41.8051 debug Started docker code loop for <name>_instance_1_<name>_fetch-incidents (source: /builds/gopath/src/github.com/demisto/server/services/automation/dockercoderunner.go:685) 2021-07-22 08:12:51.8543 error Failed to run script: <name>_instance_1_<name>_fetch-incidents with image: demisto/python3:3.8.3.8715 [error ' Error: [Traceback (most recent call last): File "<string>", line 1019, in <module> Exception: '<' not supported between instances of 'NoneType' and 'NoneType' ] (2604)'] (source: /builds/gopath/src/github.com/demisto/server/services/automation/runner.go:68) 2021-07-22 08:13:41.0024 debug Running <name>_instance_1_<name>_fetch-incidents. Timeout: 5m0s (source: /builds/gopath/src/github.com/demisto/server/services/automation/dockercoderunner.go:245) 2021-07-22 08:13:41.0024 debug Sending runner request for script [<name>_instance_1_<name>_fetch-incidents] (source: /builds/gopath/src/github.com/demisto/server/services/automation/dockercoderunner.go:292) 2021-07-22 08:13:41.0024 debug Waiting for runner request for unnested script [<name>_instance_1_<name>_fetch-incidents], with script timeout [5m0s] (source: /builds/gopath/src/github.com/demisto/server/services/automation/dockercoderunner.go:326) 2021-07-22 08:13:41.7486 debug Started docker code loop for <name>_instance_1_<name>_fetch-incidents (source: /builds/gopath/src/github.com/demisto/server/services/automation/dockercoderunner.go:685) 2021-07-22 08:13:50.4965 error Failed to run script: <name>_instance_1_<name>_fetch-incidents with image: demisto/python3:3.8.3.8715 [error ' Error: [Traceback (most recent call last): File "<string>", line 1019, in <module> Exception: '<' not supported between instances of 'NoneType' and 'NoneType' ] (2604)'] (source: /builds/gopath/src/github.com/demisto/server/services/automation/runner.go:68)

(I've replaced instance name with <name>)

To be precise: I'm able to request Cherwell through API, no problem. Only those fetch incident does not work.

thanks

roger

Re: Cherwell Fetch Incident fails

jgomes — Fri, 23 Jul 2021 20:39:21 GMT

Debug appear not very useful in this case. I would imagine this still has to do with being on-premise, and our content tested for Cloud Cherwell. Please raise a support ticket and/or raise AHA request for content enhancement - in order to support on-premises version of Cherwell as well. Best of luck going forward.
https://xsoar.ideas.aha.io/ideas/search?utf8=%E2%9C%93&query=Cherwell

Re: Cherwell Fetch Incident fails

jgomes — Mon, 08 Nov 2021 17:16:00 GMT

How did you go with your support ticket?

If my posts have helped you resolve your issue, please kindly accept one of the solution answers.