Palo Alto Networks and WDATP ad-hoc integration

Jacques van Zijl This is now on our back log :)

---

 

Hi Everyone, first all, thanks for share this document. I did all steps as described, however when I ran the script to push events from Palo Alto to WDATP I received below error, note that malware test already were performed. ERROR: Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Invoke-WebRequest : {"error":{"code":"429","message":"API calls quota exceeded! maximum allowed 15 per 00:01:00"}} At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:203 char:17 + $response = Invoke-WebRequest -Method Post -Uri $url -Body ($body | ConvertT ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand ConvertFrom-Json : Cannot bind argument to parameter 'InputObject' because it is null. At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:205 char:37 + $results = ($response.Content | ConvertFrom-Json).Results + ~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidData: (:) [ConvertFrom-Json], ParameterBindingValidationException + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.ConvertFromJsonCommand Corresponding WDATP event was not found Invoke-WebRequest : {"error":{"code":"429","message":"API calls quota exceeded! maximum allowed 15 per 00:01:00"}} At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:203 char:17 + $response = Invoke-WebRequest -Method Post -Uri $url -Body ($body | ConvertT ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand ConvertFrom-Json : Cannot bind argument to parameter 'InputObject' because it is null. At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:205 char:37 + $results = ($response.Content | ConvertFrom-Json).Results + ~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidData: (:) [ConvertFrom-Json], ParameterBindingValidationException + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.ConvertFromJsonCommand Corresponding WDATP event was not found Invoke-WebRequest : {"error":{"code":"429","message":"API calls quota exceeded! maximum allowed 15 per 00:01:00"}} At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:203 char:17 + $response = Invoke-WebRequest -Method Post -Uri $url -Body ($body | ConvertT ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand ConvertFrom-Json : Cannot bind argument to parameter 'InputObject' because it is null. At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:205 char:37 + $results = ($response.Content | ConvertFrom-Json).Results + ~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidData: (:) [ConvertFrom-Json], ParameterBindingValidationException + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.ConvertFromJsonCommand Corresponding WDATP event was not found Invoke-WebRequest : {"error":{"code":"429","message":"API calls quota exceeded! maximum allowed 15 per 00:01:00"}} At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:203 char:17 + $response = Invoke-WebRequest -Method Post -Uri $url -Body ($body | ConvertT ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand ConvertFrom-Json : Cannot bind argument to parameter 'InputObject' because it is null. At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:205 char:37 + $results = ($response.Content | ConvertFrom-Json).Results + ~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidData: (:) [ConvertFrom-Json], ParameterBindingValidationException + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.ConvertFromJsonCommand Corresponding WDATP event was not found Invoke-WebRequest : {"error":{"code":"429","message":"API calls quota exceeded! maximum allowed 15 per 00:01:00"}} At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:203 char:17 + $response = Invoke-WebRequest -Method Post -Uri $url -Body ($body | ConvertT ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand ConvertFrom-Json : Cannot bind argument to parameter 'InputObject' because it is null. At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:205 char:37 + $results = ($response.Content | ConvertFrom-Json).Results + ~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidData: (:) [ConvertFrom-Json], ParameterBindingValidationException + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.ConvertFromJsonCommand Corresponding WDATP event was not found