Xsoar - XDR Public API Unauthorised

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Xsoar - XDR Public API Unauthorised

L3 Networker

I am having difficulty integrating the XDR Integration. I have followed the instructions and have generated an "Advanced Key", copied the Key and the Key ID + URL. I have inserted the relevant details on the Instance Settings. When I perform "Test" I receive "401 Public API Unauthorised". I have tested multiple different roles of API including the Public API "edit" but the system does not budge. Connecting two Cortex Products should be quite straight forward yet I am encountering this error. There is no custom API Request or any custom configuration just a simple instance. I have attempted to configure both the IOC and XQL integration but to no avail. Anyone have an idea on how to fix this ?

 

Cortex XSOAR 

Cortex XDR 

 

1 accepted solution

Accepted Solutions

Many thanks Rahul,

this error was resolved through the support channel. Initially they recommended a few Permissions on the API Role in XDR. The issue was directly resolved by ensuring that the Time on the Xsoar was up to date and synchronised.   

View solution in original post

5 REPLIES 5

L3 Networker

@michaelsysec242 Do you have access to the PaloAltoNetworks support portal? We will need to look at logs, and possibly get on a call to troubleshoot this further. 

Many thanks Rahul,

this error was resolved through the support channel. Initially they recommended a few Permissions on the API Role in XDR. The issue was directly resolved by ensuring that the Time on the Xsoar was up to date and synchronised.   

L3 Networker

Perfect! Glad you got it resolved.

Hello Michael,

I've the same problem. How did you update and synchronised the XSOAR to solve the problem?

Could be enough to reset the integration? or just clicking on "Reset the "last run" timestamp? 

BCC_Automatizacion_Josep_0-1664260245414.png

 

No, creating a new integration helped. It appears that the previous one was not allowing the API requests to be authenticated. 

  • 1 accepted solution
  • 3335 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!