topic Cortex XSOAR Fetch Incident In Exabeam Advanced Analytics in Cortex XSOAR Discussions

Cortex XSOAR Fetch Incident In Exabeam Advanced Analytics

E.LANGUIE — Thu, 10 Oct 2024 13:30:09 GMT

Hi Everyone,

I'd like to fetch incidents on Exabeam Advanced Analystics, however, when trying to create an instance I get the following error each time I specify the value Exabeam incident in the Fetch type:

Error in API call [400] - Bad Request {"message": "attempt to access uninitialized field", "stackTrace": [], "apiErrorCode": "INTERNAL_ERROR", "errorMessage": "\"Internal Error: attempt to access uninitialized field\"", "suppressed": []} (85)

But when only the value Exabeam Notable User is specified, I get no error and the instance works fine. Is there a workound I can use so that I can also fetch others incidents from Exabeam AA?

Re: Cortex XSOAR Fetch Incident In Exabeam Advanced Analytics

pagnihotri — Fri, 11 Oct 2024 11:45:51 GMT

Usually it doesn't throw an error.

Could you please share the screenshot for instance configuration masking the sensitive details.

Re: Cortex XSOAR Fetch Incident In Exabeam Advanced Analytics

E.LANGUIE — Mon, 14 Oct 2024 12:20:09 GMT

It seems it's throwing this error because the Incident Responder module isn't used for incident management on Exabeam itself. But instead, the Case Manager is used for incident management. Regarding the configurations, the username and the API key were provided in other to fetch incidents as required by the integration documentation.

Do you have any idea if there is a documentation regarding the case manager APIs?