cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1703
Views
0
Helpful
1
Replies

Getting error when we tried to create CTR & Threat responseV2 casebook

I am trying to run CTR & Threat responseV2 casebook, when we run workflows getting below error:

 

1.CTR Casebook:
action execution errored for type python3.script err:code:400 message::Error: raise JSONDecodeError("Expecting value", s, err.value) from None json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)


2.Threat Response V2:
id: 01Q8UDHXYY6J51uChrBq8OoxkuFHjz5CB8W, wf_instance_id: 01Q8UDHWUNPN62th0uSjYDn1x4FPsOGiFst, error: Failed to create new casebook
Status code: 200
Response body:


Please suggest how can we create workflows.

1 Accepted Solution

Accepted Solutions

Matt Vander Horst
Cisco Employee
Cisco Employee

It looks like the "Threat Response v2 - Create Casebook" atomic may have worked properly but failed because the API returned a 200 instead of a 201. When you create a casebook using the Threat Response API, we expect a 201/Created response. In this case, it looks like you may have gotten a 200/Success instead. Did you look in your SecureX ribbon to see if a casebook was actually created or not? We may need to adjust the atomic to also accept a 200/Success in addition to 201/Created.

View solution in original post

1 Reply 1

Matt Vander Horst
Cisco Employee
Cisco Employee

It looks like the "Threat Response v2 - Create Casebook" atomic may have worked properly but failed because the API returned a 200 instead of a 201. When you create a casebook using the Threat Response API, we expect a 201/Created response. In this case, it looks like you may have gotten a 200/Success instead. Did you look in your SecureX ribbon to see if a casebook was actually created or not? We may need to adjust the atomic to also accept a 200/Success in addition to 201/Created.