Vaikora-SentinelOne v3.0.1 — omit empty agent_id query param - #14364
Conversation
|
The PlaybooksValidations failure on attempt #2 is a transient GitHub API rate-limit hit on the CI runner (unauthenticated Octokit, 60 req/hr cap), not a real validation issue. The job logs show: Cannot self-rerun (admin rights required for fork PRs). v-maheshbh (@v-maheshbh) v-shukore could you trigger a rerun once the rate-limit window has reset? Same pattern as the transient DataConnectorValidations failure on #13658. |
…ntId is empty Get_Vaikora_Actions built the URI by always concatenating 'agent_id=' to the query string. When VaikoraAgentId is empty (the documented use case for monitoring all agents), the request became /actions?agent_id=&per_page=100, which the Vaikora API rejects with HTTP 422 because Pydantic cannot parse '' as a UUID. Fix wraps the agent_id segment with an if(empty(...)) check so it is omitted entirely when blank. Verified end-to-end against api.vaikora.com on a real Sentinel workspace: Get_Vaikora_Actions now returns 200 OK and the rest of the playbook chain (Filter_High_Severity_Or_Anomaly, List_STAR_Rules, etc.) runs as designed. arm-ttk local: 49/49 pass on Package/3.0.1.zip. 3.0.0.zip retained per repo policy.
a9a7c5f to
0033ea9
Compare
|
Hi mazamizo21, arm-ttk is failing for below line please check once. Thanks! |
…fy arm-ttk URIs rule
Same fix as Vaikora-ASC: the agent_id-omit conditional used concat() inside the
HTTP poll uri, which arm-ttk 'URIs Should Be Properly Constructed' rejects
(concat/format disallowed in any uri/url property). Moved URL construction into
a Compose action and the poll now reads "uri": "@{outputs('Compose_Poll_Endpoint')}".
The action name avoids a uri/url suffix so arm-ttk's key match doesn't re-flag it.
Runtime behavior unchanged. Applied to package mainTemplate + standalone playbook;
repackaged 3.0.1.zip.
|
Hi v-shukore v-maheshbh (@v-maheshbh), pushed a proactive arm-ttk fix in commit While addressing the same issue on Vaikora-ASC (#14366), I found this PR has the identical latent problem: the agent_id-omit fix put a conditional Fix: moved the URL construction into a |
3 participants
Summary
The 3.0.0 playbook's `Get_Vaikora_Actions` HTTP action builds the URI by always concatenating `agent_id=` into the query string. When the operator leaves `VaikoraAgentId` blank (the documented "monitor all agents" mode), the request becomes:
```
GET https://api.vaikora.com/api/v1/actions?agent_id=&per_page=100
```
The Vaikora API's Pydantic validator rejects the empty string with HTTP 422:
```
{"type":"uuid_parsing","loc":["query","agent_id"],
"msg":"Input should be a valid UUID, invalid length: expected length 32 for simple format, found 0"}
```
Every downstream action skips with `ActionSkipped` and no IOCs are pushed to SentinelOne.
Fix
Wrap the `agent_id` segment with an `if(empty(...))` check so the param is omitted entirely when `VaikoraAgentId` is blank.
```
// before
@{concat(parameters('Vaikora_ApiBaseUrl'), '/actions?agent_id=', encodeUriComponent(parameters('VaikoraAgentId')), '&per_page=100')}
// after
@{concat(parameters('Vaikora_ApiBaseUrl'), '/actions?', if(empty(parameters('VaikoraAgentId')), '', concat('agent_id=', encodeUriComponent(parameters('VaikoraAgentId')), '&')), 'per_page=100')}
```
When an agent UUID is supplied the URL is unchanged: `...?agent_id=&per_page=100`. When empty: `...?per_page=100`.
Files changed
Test plan
cc v-maheshbh (@v-maheshbh) v-shukore