topic Re: Xsoar - XDR Public API Unauthorised in Cortex XSOAR Discussions

Xsoar - XDR Public API Unauthorised

michaelsysec242 — Wed, 13 Apr 2022 11:12:35 GMT

I am having difficulty integrating the XDR Integration. I have followed the instructions and have generated an "Advanced Key", copied the Key and the Key ID + URL. I have inserted the relevant details on the Instance Settings. When I perform "Test" I receive "401 Public API Unauthorised". I have tested multiple different roles of API including the Public API "edit" but the system does not budge. Connecting two Cortex Products should be quite straight forward yet I am encountering this error. There is no custom API Request or any custom configuration just a simple instance. I have attempted to configure both the IOC and XQL integration but to no avail. Anyone have an idea on how to fix this ?

Re: Xsoar - XDR Public API Unauthorised

RahulVijaydev — Wed, 13 Apr 2022 17:13:51 GMT

@michaelsysec242 Do you have access to the PaloAltoNetworks support portal? We will need to look at logs, and possibly get on a call to troubleshoot this further.

Re: Xsoar - XDR Public API Unauthorised

michaelsysec242 — Thu, 14 Apr 2022 14:00:07 GMT

Many thanks Rahul,

this error was resolved through the support channel. Initially they recommended a few Permissions on the API Role in XDR. The issue was directly resolved by ensuring that the Time on the Xsoar was up to date and synchronised.

Re: Xsoar - XDR Public API Unauthorised

RahulVijaydev — Thu, 14 Apr 2022 22:54:00 GMT

Perfect! Glad you got it resolved.

Re: Xsoar - XDR Public API Unauthorised

Josep — Tue, 27 Sep 2022 06:31:06 GMT

Hello Michael,

I've the same problem. How did you update and synchronised the XSOAR to solve the problem?

Could be enough to reset the integration? or just clicking on "Reset the "last run" timestamp?

Re: Xsoar - XDR Public API Unauthorised

michaelsysec242 — Sun, 23 Oct 2022 07:27:04 GMT

No, creating a new integration helped. It appears that the previous one was not allowing the API requests to be authenticated.