Cortex XDR integration with XSOAR - Module facing error Script failed to run: Error

[cV V]

Hi Everyone,

we are integrating the XDR with XSOAR we are facing script error.

Kindly find below attached error message of advanced test full report  and screenshot of kindly guide us.

Executed: test-module
Instance Cortex XDR - IR_instance_1b262b3c8-5968-43c8-8c7b-c94d9a62a249
Arguments {}
Start time 2024-06-13T11:27:29.47131302Z

Exception message is [Traceback (most recent call last):
File "/tmp/pyrunner/_script_docker_python_loop.py", line 735, in <module>
exec(code, sub_globals, sub_globals)
File "<string>", line 352, in <module>
File "/usr/local/lib/python3.10/base64.py", line 11, in <module>
import binascii
ImportError: Error loading shared library libz.so.1: Exec format error (needed by /usr/local/lib/python3.10/lib-dynload/binascii.cpython-310-x86_64-linux-gnu.so)
]

End time 2024-06-13T11:27:29.710080701Z

[ysato]

Has XDR integration ever worked for you?
I would verify that you have the most updated XDR integration content pack from the marketplace.

Looking at the screenshot that you shared, API key ID and API key values looked a bit odd.

If this integration has not worked for you, I would verify that you entered the values correctly.

[cV V]

Hi Ysato,

I have reinstalled the XDR module updated one from marketplace and regenerated the API keys and ID tried even same Error "Script Failed to run"

attached screenshot for reference.

[ysato]

Thank you for confirming.

The error message suggests that the issue is related to libz.so.1 which is a part of zlib library.

Could you reinstall zlib and make sure it is linked to libz.so.1 for the correct architecture?

To Reinstall

sudo apt-get update
sudo apt-get install --reinstall zlib1g

 Ensure Proper Linking

ldd /usr/local/lib/python3.10/lib-dynload/binascii.cpython-310-x86_64-linux-gnu.so

Check for Architecture Compatibility

file /lib/x86_64-linux-gnu/libz.so.1  

[cV V · Accepted solution]

Hi Ysato San,

The issue was solved it was in instance once i downgrade the instance version it was working but anyhow it was fixed in below version of cortex xdr - IR

6.1.50 - 1140435 (24-07-02)

Update to 6.1.50

Integrations

Palo Alto Networks Cortex XDR - Investigation and Response

• Updated the descriptions for the lte_creation_time and gte_creation_time arguments in the xdr-get-incidents command to specify that they must be in UTC.
• Updated the Docker image to: demisto/python3:3.10.14.99865.