topic Re: XSOAR 6.11 Content Bundle Update via API in Cortex XSOAR Discussions

XSOAR 6.11 Content Bundle Update via API

JBoehm — Tue, 02 Jul 2024 08:16:33 GMT

Hello

We have build a CICD Pipeline to manage Lists in a external Git-Repository. The reason for that is we want to have the option to let our analyst create message templates and config files in a versioned way. Also we don't want that our analyst have to handle the deployment of that files.

Until now the external repo was relativly small and we could use the "/list/save" endpoint. However this repo is rapidly growing and doing for each file an request is overwhleming the application (talking about 120-150 requests per tenant). We could implement a delay, however even without a delay we have the issue that it takes more then 2 hours to update all our tenants.

My Idea was to use the endpoint "/content/bundle" and upload all files as a zip file. Sofar so good, only issue is that we get a error message :

since the endpoint is not documented its a bit hard to guess what the reall issue is.
What i already have seen is that this name "content-bundle...." isn't the name of the tar.gz files i was sending. The original name was
ABC_pre-prod_1719224927.tar.gz. Also the Folder inside the tar file is called like that. To mimic the bundle structure you can download.

Does anybody has done this already?

Greetings.

Re: XSOAR 6.11 Content Bundle Update via API

AbelSantamarina — Wed, 03 Jul 2024 14:59:01 GMT

@JBoehm, have you tried zipping the files as a zip file instead of tar.gz and uploading your lists as custom content using /content/bundle endpoint? I'm a bit confused, as you are mentioning you're already doing this, but also mentioning you're using tar.gz in your comments:

"What i already have seen is that this name "content-bundle...." isn't the name of the tar.gz files i was sending."

Thanks

Re: XSOAR 6.11 Content Bundle Update via API

JBoehm — Thu, 04 Jul 2024 06:17:24 GMT

Hi @AbelSantamarina

Yes i was start to implementing the conten bundle upload but didn't got it to work since this error message.

Since the endpoint has no documentation i basically watched my network tab in the browser, whats happening if i manually upload a content bundle through the settings, and recreated that behavior in our cicd pipeline.

I didn't tried zip, since if you download a conten bundle its a tar.gz file and if you uploade that same file its working with no issue. So i would assume that if i create a tar.gz file that shouldn't be an issue aswell.

Did you have implemented something like this?