an issue with Forcepoint web Security with Cortex XSOAR Integration

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

an issue with Forcepoint web Security with Cortex XSOAR Integration

L0 Member

fp web_Copy.png

Hello Dears,

I have an issue with Forcepoint web Security with Cortex XSOAR Integration.

 

kindly find the logs:
2024-03-26 10:36:37.6939 error Unable to do Http req to url : https://                 :15873/api/web/v1/categories/start [error 'Post "https://10.200.30.242:15873/api/web/v1/categories/start": tls: server selected unsupported protocol version 302'] (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/util/jshttp/jshttp.go:219)
2024-03-26 10:36:37.6940 error JS error: error - request failed. error number -1 at startTransaction (script:81:17(48)) (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/services/automation/jsrunner.go:255)
2024-03-26 10:36:37.6940 error Failed to run script: Forcepoint__instance_14f8bc695-258d-4096-890f-7be45dcdd833_Forcepoint_test-module with image: [error 'error - request failed. error number -1 at startTransaction (script:81:17(48))'] (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/services/automation/runner.go:68)
2024-03-26 10:36:37.6941 debug No entries were found for the [InternalTestModuleInstance] command run (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/services/telemetry/realtime_metrics.go:547)
2024-03-26 10:36:37.6942 error Instance test failed: Forcepoint Web Security | Forcepoint_instance_14f8bc695-258d-4096-890f-7be45dcdd833 [error 'Script failed to run: error - request failed. error number -1 at startTransaction (script:81:17(48)) (2603)'] (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/services/integrations.go:1197)
2024-03-26 10:36:37.6943 info [POST] "/settings/integration/test" 200 32.609737351s (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/web/middleware.go:82)

4 REPLIES 4

L1 Bithead

Hi @ALabeb -- Given the nature of troubleshooting these kinds of issues, I recommend reaching out to your Customer Success team or the Support team for assistance.

L0 Member

I believe this issue is due to ForcePoint's API not supporting anything past TLS 1.0, which was removed in XSOAR 6.11 or 6.12. 

You mostlikely either need to roll back your XSOAR upgrade or Proxy ForcePoint's API endpoint with something that can talk using legacy TLS versions. 

Hi Team,

My customer is looking for some sample python code that calls the API with the latest TLS standards to solve the issue?

Any suggestions please.

Thanks

Since the integration is written in Javascript, you would have to rewrite it to use Python, but that would then let you use a legacy version of Python with TLS 1.0 support. 
You can reverse proxy the ForcePoint API endpoint with another Technology (nginx, F5, IIS, etc) which can allow you to talk without code changes, at the cost of an infrastructure change. 

  • 1212 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!