Cortex XDR Integration error

Forum|Forum|1 year ago
October 8, 2024
6 replies
3685 views

Hello Community,

We are facing an issue in cortex XDR integration error. (Screenshot attached). API has admin rights assigned. Does anyone face same error.

cortex.PNG

Best answer by RenuAndh

Can you try running above curl command removing -d '{}' and check. And also from connector actions try running action "Fetch Incidents" if this runs successful.

Also check this curl command works:
curl -k -X POST https://api-yourfqdn/public_api/v1/incidents/get_incidents -H "x-xdr-auth-id:{API_KEY_ID}" -H "Authorization:{API_KEY}" -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"request_data": {}}'

RenuAndh

Staff

HI @khanchand,

Can you specify Which authentication type you are selecting ?

khanchandAuthor

Explorer II

Hi Renu,

Its Standard Key. And same is selected in Cortex while creating the key.

RenuAndh

Staff

Can you try running this curl command to check with valid credentials:
curl -X POST https://api-{fqdn}/public_api/v1/distributions/get_versions/ -H "x-xdr-auth-id:{API_KEY_ID}" -H "Authorization:{API_KEY}" -H "Content-Type:application/json" -d '{}'

khanchandAuthor

Explorer II

attaching the output screenshot

curl output.PNG

RenuAndhAnswer

Staff

Can you try running above curl command removing -d '{}' and check. And also from connector actions try running action "Fetch Incidents" if this runs successful.

Also check this curl command works:
curl -k -X POST https://api-yourfqdn/public_api/v1/incidents/get_incidents -H "x-xdr-auth-id:{API_KEY_ID}" -H "Authorization:{API_KEY}" -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"request_data": {}}'

khanchandAuthor

Explorer II

Hi Renu,

Its working now by generating another API account.

Sign up

Login with SSO

Login to the community

Login with SSO