CIRCL hashlookup (hashlookup.circl.lu) 1.0.0 3167802 returns error when no results

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

CIRCL hashlookup (hashlookup.circl.lu) 1.0.0 3167802 returns error when no results

L1 Bithead

When the integration is used on non-existent hash:

!file file=2795b688bb5918e092e0ee33cd25aa98

Then it end with error:

Reason

Failed to execute file command. Error: Error in API call [404] - NOT FOUND {"message": "Non existing MD5", "query": "2795b688bb5918e092e0ee33cd25aa98"}
 
Usually all other !file just return info that the hash was not found:

URLhaus:

MD52795b688bb5918e092e0ee33cd25aa98
ResultNot found
 
Could you please modify the integration so when no hash found it does not fail with error but rather just informs that no hash was found.
 
CIRCL hashlookup (hashlookup.circl.lu) 1.0.0 3167802
 
3 REPLIES 3

L4 Transporter

Hi @Blazej_Gomoluch, Seeing that the response is 404, not sure if they will change it. If you're using this command inside a playbook, I have some a workaround for you. 

 

You can ignore error and continue.

Screen Shot 2022-06-30 at 10.17.35 am.png

If not using 6.8, you should see a toggle at the bottom of the task window called "Stop on Error". You can then check for an error like below.

Screen Shot 2022-06-30 at 10.30.12 am.png 

L1 Bithead

The !file command is using all the integrations at once. So doing it like this is not really a solution for me. I would like to bail on error if such occurs. But if there are no results I would like that all the integrations behave the same way (no error on 404). 

I think I will modify the integration in my environment myself for now.

Hi @Blazej_Gomoluch, You can call the !File command against a single instance or integration with the "using" parameter. In the playbook task its located in the "Advanced" tab.

 

You can also handle the error via an automation using the above "using" parameter. Modifying an integration should be a last resort since you will no longer receive updates.

  • 1456 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!