topic Re: Disable/Enable Integration via API/Playbook/Automation in Cortex XSOAR Discussions

Disable/Enable Integration via API/Playbook/Automation

BHalifa — Thu, 23 Nov 2023 14:21:03 GMT

Hi Guys,

I have list of integration instances that i need to disable/enable in one click.

I didn't see any function or command in the system that can do it.

There is any other way to do that?

Re: Disable/Enable Integration via API/Playbook/Automation

jfernandes1 — Fri, 24 Nov 2023 03:30:00 GMT

Hi @BHalifa, we do not recommend you do this and the below instructions may only apply for XSOAR 6.

You need to return the entire integration object to make changes, so you first need to get the integration object.

Use POST /settings/integration/search with payload {"query":"<search for integration>"} -> process result which might a huge list of integrations. You need to extract the object for the integration you want to modify.

In the above returned object, you need to change version and enabled before adding as a payload to the below API call.

PUT /settings/integration + Above payload

You can run the above calls using the Core REST API integration. If you are unsure about Cortex APIs and Python do not use this method.

Re: Disable/Enable Integration via API/Playbook/Automation

BHalifa — Fri, 24 Nov 2023 12:17:25 GMT

Hi, Thank you!

Why I need to change the version? the version was 4 so I just added 1 (now its 5)

Im getting:

{"id":"errOptimisticLock","status":400,"title":"Optimistic lock error","detail":"Optimistic lock error","error":"DB Version '4' and Insert version '5' do not match for id: 2bafa3b3-1fd7-48a9-85d3-145e1b12e323 on bucket [modules] [moduleInstances] (15)","encrypted":false,"multires":null}

Without changing the version it works perfect.

BTW this is my script:

import requests

import json

xsoar_instance = 'https://my-xsoar'

tenant_name='acc_TSOC'

url = f'{xsoar_instance}/{tenant_name}/settings/integration/search'

payload = {}

headers = {

'Content-Type': 'application/json',

'Authorization': 'mykey'

}

payload = {"query":"Migdalei"}

# Make the API request

response = requests.post(url, headers=headers, data=json.dumps(payload),verify=False)

instances=response.json()['instances']

newpayloads=[]

for i in instances:

if i['name'] == "My Desire Instance":

#i['version'] = i['version'] + 1

i['enabled'] = 'true'

newpayloads.append(i)

url = f'{xsoar_instance}/{tenant_name}/settings/integration'

for i in newpayloads:

response = requests.put(url, headers=headers, data=json.dumps(i),verify=False)

print (response.text)

Re: Disable/Enable Integration via API/Playbook/Automation

jfernandes1 — Mon, 27 Nov 2023 02:28:02 GMT

Hi @BHalifa, XSOAR maintains version control internally. You need to bump the version number up in order to commit the changes. The also help since content can be changed from multiple sources.

Re: Disable/Enable Integration via API/Playbook/Automation

BHalifa — Mon, 27 Nov 2023 06:07:26 GMT

Hi @jfernandes1 , thanks for the response.

I Understand what you say, but when I tried to change the version it's doesn't work.

Without changing it's work great.