Sentine Playbooks and Darktrace

KubaTom 

@KubaTom

Thanks for the reply. Yeah all the headers are sent through accordingly and if we run this in python works absolutely fine. I agree that sending the payload as parameters AND as a body is redundant but...*shrug*

import requests
from datetime import datetime
import hmac
import hashlib
import json

#ssl verification disabled
requests.packages.urllib3.disable_warnings()

def post_api(url, args):

    server = 'https://' # appliance URL
    public = '' # public token
    private = '' # private token
    date = datetime.utcnow().strftime('%Y%m%dT%H%M%S')
    sig = hmac.new(private.encode('ASCII'),(url +'\n'+ public +'\n'+ date).encode('ASCII'), hashlib.sha1).hexdigest()
    headers = {'DTAPI-Token': public, 'DTAPI-Date': date, 'DTAPI-Signature': sig, 'Accept': '*/*'}

    r = requests.post(server + url, data=args, headers=headers, verify=False)
    try:
        resp = json.loads(r.text)
        return resp
    except:
        try:
            resp = json.load(r)
            return resp
        except:
            return "INVALID API RESPONSE"

result = post_api('/tags/entities?tag=TestTag&did=131105', {'tag': 'TestTag', 'did': 131105})

print(result)

In the Python code we send the {'tag': 'TestTag', 'did': 131105} as a function arg which is submitted as a body but trying this in LogicApps just fails.

{
    "uri": "https://[redacted]/tags/entities?tag=TestTag&did=131105",
    "method": "POST",
    "headers": {
        "Accept": "*/*",
        "DTAPI-Date": "[redacted]",
        "DTAPI-Signature": "[redacted]",
        "DTAPI-Token": "[redacted]"
    },
    "body": "{'tag': 'TestTag', 'did': 131105}"
}

I had to do some fudging to get the body in the same format as the HTTP connector fails to valid the body as valid JSON (which is accurate). Putting it in proper JSON format escapes the string to something like {\"tag\": \"TestTag\",\"did\":131105} and is unsuccessful.

I suspect the HTTP connector is mangling something somewhere so it's likely a case of finding the combination of body format, content-types, etc to send to the API endpoint. I also suspect I've spent too long looking at this and missing something obvious.