This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About gkindley
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About gkindley
10-03-2022
4Posts
0Likes
1Solution
Oct 03, 2022Last Visited
User
Activity
User
Profile
Latest posts by gkindley
| Subject | Views | Posted |
|---|---|---|
| 949 | 10-03-2022 11:17 AM | |
| 1033 | 09-30-2022 10:45 AM | |
| 1718 | 09-08-2022 02:55 PM | |
| 1742 | 09-08-2022 01:51 PM |
User Badges
Community Statistics
| Member Since | 02-22-2022 05:42 AM |
| Date Last Visited | 10-03-2022 03:03 PM |
| Posts | 4 |
10-03-2022
11:17 AM
I realize that the problem is a bug fixed in a new version of Common Scripts from marketplace:
... View more
09-30-2022
10:45 AM
Hi everyone,
I'm trying to use the GenericPolling playbook to wait for the "COMPLETED" status of a query in a QRadarv3 Integration. I use the following configuration: Ids: ${QRadar.Search.ID} PollingCommandName: qradar-search-status-get PollingCommandArgName: search_id Interval: 1 Timeout: 30 dt: QRadar.Search(val.Status!== 'COMPLETED' || val.Status!== 'CANCELED').ID
But when I try to use it, throws the following error:
Failed to execute qradar-search-status-get command. Error: Error in API call [404] - 404 Query b'300ff143-6a8b-4765-bb8c-a1498ccf959c' does not exist Traceback (most recent call last): File "<QRadar v3>", line 3704, in main File "<QRadar v3>", line 2445, in qradar_search_status_get_command File "<QRadar v3>", line 542, in search_status_get File "<QRadar v3>", line 369, in http_request File "<CommonServerPython>", line 8528, in _http_request File "<QRadar v3>", line 411, in qradar_error_handler DemistoException: Error in API call [404] - 404 Query b'300ff143-6a8b-4765-bb8c-a1498ccf959c' does not exist
I'd already used each command (qradar-search-create, then qradar-search-status-get and wait for the COMPLETED STATUS, then qradar-search-results-get) without any error. Do you see anything wrong in the GenericPolling inputs that can be made to fail the task? I suspect the problem is that the entire string b'300ff143-6a8b-4765-bb8c-a1498ccf959c' is passed as argument in the qradar-search-status-get command including the b' '. If it's the case, there is any way to avoid that?
I really appreciate any suggestion.
Regards.
... View more
09-08-2022
02:55 PM
putting ` characters around filepath work well in cli, but how can I use that in Playbook tasks? thanks for your help.
... View more
09-08-2022
01:51 PM
When I try to put a filepath that has white spaces as an input in the command "cs-falcon-rtr-remove-file", I receive the following error:
CrowdStrike Falcon The command was failed with the errors: {'d5716ded5d214d61a23884dd9ef64078': 'Max args is 1. 5 were provided'}
The complete command used and retrieved from the warrom looks like this:
!cs-falcon-rtr-remove-file host_ids="<numeric host id>" file_path="\\Path\\To\\The\\File\\A\\Directory with whitespaces\\Directory\\Directory2with whitespaces \\File.exe" os="Windows"
(I replace the original path with some placeholder). I notice that taking into consideration the whitespaces, the filepath is split into 5 pieces, getting the mentioned error.
How can I escape the whitespaces? I tried with \ before the spaces, but it's not considered when the command is running, and \s is escaped as \\s, making a bad filepath.
The command comes from Crowdstrike Falcon Content Pack, and is implemented in the "CrowdStrike Falcon - True Positive Incident Handling" Playbook.
I really appreciate any help, regards.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-03-2022
03:03 PM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks