GoQR.me QR Code Reader misbehaving

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

GoQR.me QR Code Reader misbehaving

L0 Member

I have an XSOAR 8.5 instance with a playbook which makes use of the GoQR.me QR Code Reader integration.

It had been working nicely in the playbook for months, but has begun to misbehave.

 

In the playbook, images are extracted from a phishing email and stored in XSOAR, and the IDs of the images are fed through

 
Reason
Error from QR Code Reader - goqr.me is : Script failed to run: Error: [Traceback (most recent call last): File "<string>", line 76, in <module> File "<string>", line 63, in main File "<string>", line 21, in read_qr_code File "<string>", line 93, in getFilePath File "<string>", line 289, in __do ValueError: timeout while waiting for answer: request 968af3ca-046f-48c3-82df-4e3a10613969. Wait time:2m0s (1515) ] (2604) (2603)
 
If I run ! with a single EntryID, I get a sensible response.
If I submit two IDs, I get the script error above.
 
Is anyone else having this issue, and can anyone shed any light on what's going wrong?

2 REPLIES 2

L0 Member

I have an update on this.

After reconfiguring the integration to run on an engine, and setting up tcpdump to monitor all connections to the four publicly listed IP addresses of api.qrserver.com, I can see traffic between the engine and the API server if I submit a single Entry_ID

 

If I submit more than one Entry_ID, the engine server doesn't even try to connect to the API server.

 

So something in the Integration has broken such that it does not attempt to contact the API server in the event that more than one Entry_ID is supplied. But this worked perfectly earlier in the year.

Hi @Mattern

Thanks for reaching out to us about this topic. Can you please answer the following questions?

- Have you recently applied an update/fix to your XSOAR environment?

- Which is the current version of XSOAR and GoQR.me QR Code Reader integration? (can you please refer us to the version/scenario where the integration ran as expected?)

- If you submit more than one Entry_ID and it stops working as expected, it is probable that the automation code will require some update to process other IDs again. As a workaround (if any update was installed for the integration), you should try rolling back to the version that was working previously.

 

  • 331 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!