an issue with Forcepoint web Security with Cortex XSOAR Integration

[ALabeb]

Hello Dears,

I have an issue with Forcepoint web Security with Cortex XSOAR Integration.

kindly find the logs:
2024-03-26 10:36:37.6939 error Unable to do Http req to url : https://                 :15873/api/web/v1/categories/start [error 'Post "https://10.200.30.242:15873/api/web/v1/categories/start": tls: server selected unsupported protocol version 302'] (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/util/jshttp/jshttp.go:219)
2024-03-26 10:36:37.6940 error JS error: error - request failed. error number -1 at startTransaction (script:81:17(48)) (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/services/automation/jsrunner.go:255)
2024-03-26 10:36:37.6940 error Failed to run script: Forcepoint__instance_14f8bc695-258d-4096-890f-7be45dcdd833_Forcepoint_test-module with image: [error 'error - request failed. error number -1 at startTransaction (script:81:17(48))'] (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/services/automation/runner.go:68)
2024-03-26 10:36:37.6941 debug No entries were found for the [InternalTestModuleInstance] command run (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/services/telemetry/realtime_metrics.go:547)
2024-03-26 10:36:37.6942 error Instance test failed: Forcepoint Web Security | Forcepoint_instance_14f8bc695-258d-4096-890f-7be45dcdd833 [error 'Script failed to run: error - request failed. error number -1 at startTransaction (script:81:17(48)) (2603)'] (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/services/integrations.go:1197)
2024-03-26 10:36:37.6943 info [POST] "/settings/integration/test" 200 32.609737351s (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/web/middleware.go:82)

[bwebb]

Hi @ALabeb -- Given the nature of troubleshooting these kinds of issues, I recommend reaching out to your Customer Success team or the Support team for assistance.

[mcvicarr]

I believe this issue is due to ForcePoint's API not supporting anything past TLS 1.0, which was removed in XSOAR 6.11 or 6.12. 

You mostlikely either need to roll back your XSOAR upgrade or Proxy ForcePoint's API endpoint with something that can talk using legacy TLS versions.