Cortex XSOAR and Cortex XDR Integration - Fetch Incident

yildiraykaratas — Tue, 16 Jul 2024 08:03:21 GMT

Hello,

I want to automatically import incidents that occur in XDR as incidents into XSOAR.

The integration is successful, but I cannot view the occurring incidents in xsoar and I get the following error.

Error: Script failed to run:
Error: [Traceback (most recent call last):

File "<string>", line 6067, in <module>
File "<string>", line 6063, in main
File "<string>", line 7631, in return_error
Exception: Error in API call [500] - Internal Server Error
{"reply": {"err_code": 500, "err_msg": "An unexpected error occurred while processing XDR public API - incident management", "err_extra": null}}
] (2604) (2603)

!xdr-get-incidents status=new , !xdr-get-alerts alert_id=11 , !xdr-update-incident incident_id=3 add_comment=for-testing

I run commands like these successfully via CLI.
I am sharing screenshots and logs. What might I have missed?

The API was created according to the document. Instance admin authority was granted. XDR and XSOAR region and time settings were checked. Palo Alto Networks Cortex XDR - Investigation and Response was deleted and reinstalled, other versions were tried.
An attempt was made on another XSOAR server, but it was not successful.

Thanks everyone

Re: Cortex XSOAR and Cortex XDR Integration - Fetch Incident

avi_wales — Thu, 18 Jul 2024 10:03:20 GMT

I had the same issue. the best way is to open a ticket to XDR support

topic Re: Cortex XSOAR and Cortex XDR Integration - Fetch Incident in Cortex XSOAR Discussions

Cortex XSOAR and Cortex XDR Integration - Fetch Incident

Re: Cortex XSOAR and Cortex XDR Integration - Fetch Incident