an issue with Forcepoint web Security with Cortex XSOAR Integration

[ALabeb]

Hello Dears,

I have an issue with Forcepoint web Security with Cortex XSOAR Integration.

kindly find the logs:
2024-03-26 10:36:37.6939 error Unable to do Http req to url : https://                 :15873/api/web/v1/categories/start [error 'Post "https://10.200.30.242:15873/api/web/v1/categories/start": tls: server selected unsupported protocol version 302'] (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/util/jshttp/jshttp.go:219)
2024-03-26 10:36:37.6940 error JS error: error - request failed. error number -1 at startTransaction (script:81:17(48)) (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/services/automation/jsrunner.go:255)
2024-03-26 10:36:37.6940 error Failed to run script: Forcepoint__instance_14f8bc695-258d-4096-890f-7be45dcdd833_Forcepoint_test-module with image: [error 'error - request failed. error number -1 at startTransaction (script:81:17(48))'] (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/services/automation/runner.go:68)
2024-03-26 10:36:37.6941 debug No entries were found for the [InternalTestModuleInstance] command run (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/services/telemetry/realtime_metrics.go:547)
2024-03-26 10:36:37.6942 error Instance test failed: Forcepoint Web Security | Forcepoint_instance_14f8bc695-258d-4096-890f-7be45dcdd833 [error 'Script failed to run: error - request failed. error number -1 at startTransaction (script:81:17(48)) (2603)'] (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/services/integrations.go:1197)
2024-03-26 10:36:37.6943 info [POST] "/settings/integration/test" 200 32.609737351s (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/web/middleware.go:82)

[bwebb]

Hi @ALabeb -- Given the nature of troubleshooting these kinds of issues, I recommend reaching out to your Customer Success team or the Support team for assistance.

[mcvicarr]

I believe this issue is due to ForcePoint's API not supporting anything past TLS 1.0, which was removed in XSOAR 6.11 or 6.12. 

You mostlikely either need to roll back your XSOAR upgrade or Proxy ForcePoint's API endpoint with something that can talk using legacy TLS versions. 

[assubramania]

Hi Team,

My customer is looking for some sample python code that calls the API with the latest TLS standards to solve the issue?

Any suggestions please.

Thanks

[mcvicarr]

Since the integration is written in Javascript, you would have to rewrite it to use Python, but that would then let you use a legacy version of Python with TLS 1.0 support. 
You can reverse proxy the ForcePoint API endpoint with another Technology (nginx, F5, IIS, etc) which can allow you to talk without code changes, at the cost of an infrastructure change.