FortiAnalyzer 7.4.6 Playbooks and auto generated variables for API (Webhook)

[nmavroud]

Hi all,

We are facing issue where seems that the FortiAnalyzer does to use properly the variable which creates during the workflow of a playbook. 

So, I am gonna brake it down so it can be clear. The initial goal is to use the playbooks so can send API calls to a target point in order to automate the creation of customer tickets. The playbook has 3 components.

   1. Event trigger

   2. Get token from the target point

   3. Post the actual payload along with the token which was received from the above task.

Event trigger: We use handlers to monitor the status of the devices' interfaces and the actual status of the device (online, offline).  That works fine.

Get token: Using get method, FortiAnalyzer (API client) requests a token from the target point. Along with that, in the header we using a x-client-id which is the Client identification. FortiAnalyzer has been registered to the API IBM portal and a key has been associated with it. The full header looks like that "X-IBM-Client-Id": "XXXXXX" where the Xs is the key. That works fine as well. Analyzer receives the key. At least in the playbook monitor that tasks is marked as success.

Post the actual payload: Now here we have the problem. We use post method to send the API call to the target point. In the header we include again the client-id along with a variable that Analyzer creates and nest the token which was received from the previous step/task. The header looks like that  {"X-IBM-Client-Id": "XXXXXXX","Authorization": "Bearer ${placeholder_5dfff6dc_ff61_415a_88ea_ed1f4dc44870.response}"} .

The above variable is auto generated by analyzer can we can not really do anything with that, edit/view etc.

That final step does not work and we receive the ERROR - {'status_code': 500, 'message': 'Invalid-JWT-Validate'}. So the other side does not accept the token for some reason. We tried to do it manually and instead of using the variable, we used a valid token. That worked fine!!. So, looks that the Fortianalyzer does not use the variable properly or something is missing. 

Is it any way to see what the fortianalyzer sends in the last task. Just to verify what it sends a token or what ever. Any debug commands to check it from cli? Cos digging the internet didn't find anything useful.

Have anyone else faces similar issue?

Much appreciated for any help so I am getting a lot of pressure.

Many Thanks,

NM