search

mfesiem / msiempy

McAfee SIEM API Python wrapper
https://mfesiem.github.io/docs/msiempy/msiempy.html
MIT License
23 stars 9 forks source link

ERROR - 404 Client Error: 404 for url: ipsAddAlertNote No such command. #27

Closed tristanlatr closed 5 years ago

tristanlatr commented 5 years ago

Is there an alternative to ipsAddAlertNote in the new v11.2.1 API ?

andywalden commented 5 years ago

Yes. I have this updated. Can you show me your use case code so I can test it the same way? e.g. Are you getting your event from events or from alarms? Thanks.

tristanlatr commented 5 years ago

It's only called when using Event.set_note(note) : https://github.com/mfesiem/msiempy/blob/master/msiempy/event.py#L432 The method only works when the Event have been instantiated with the qryExecuteDetail call because it's only using IPSIDAlertID key for now. So to test, you can do : 

#1/ Create Event object

#Use EventManager
event_list = EventManager(time_range='CURRENT_YEAR',
            filters=[('IPSIDAlertID',  '144128388087414784|747122896'  )],
            compute_time_range=False,
            limit=2).load_data()
my_test_event=event_list[0]

#Use Event
my_test_event=Event(adict=Event().data_from_id(id='144128388087414784|747122896',
    use_query=True))
#it's a bit ugly still, if you do use Event(id='...') it will use ipsGetAlertData call

#Use AlarmManager
alarm_list = AlarmManager(time_range='CURRENT_YEAR',
    page_size=2).load_data(use_query=True)
my_test_event=alarm_list[0]['events'][0]
#see https://mfesiem.github.io/docs/msiempy/alarm.html#msiempy.alarm.Alarm.load_events

#Set the event's note
my_test_event.set_note('a test note')
tristanlatr commented 5 years ago

This has been fixed at commit https://github.com/mfesiem/msiempy/commit/367843246b11edd8382cbd4366ca43039ecddd52 Thank you @andywalden !