Forum Discussion
Haim Goldshtein
Mar 16, 2019Microsoft
Palo Alto Networks and WDATP ad-hoc integration
Integrate your Palo Alto Networks firewall alerts directly into WDATP machine timeline and alert queue
5 Minutes
Low complexity
Firewall and IPS/IDS are common tools in every or...
Jacques van Zijl
Microsoft
Haim Goldshtein is there a document for fortinet firewall to do the same?
gsoriano
Aug 07, 2019Copper Contributor
Hi Everyone, first all, thanks for share this document. I did all steps as described, however when I ran the script to push events from Palo Alto to WDATP I received below error, note that malware test already were performed. ERROR: Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Corresponding WDATP event was not found Invoke-WebRequest : {"error":{"code":"429","message":"API calls quota exceeded! maximum allowed 15 per 00:01:00"}} At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:203 char:17 + $response = Invoke-WebRequest -Method Post -Uri $url -Body ($body | ConvertT ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand ConvertFrom-Json : Cannot bind argument to parameter 'InputObject' because it is null. At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:205 char:37 + $results = ($response.Content | ConvertFrom-Json).Results + ~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidData: (:) [ConvertFrom-Json], ParameterBindingValidationException + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.ConvertFromJsonCommand Corresponding WDATP event was not found Invoke-WebRequest : {"error":{"code":"429","message":"API calls quota exceeded! maximum allowed 15 per 00:01:00"}} At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:203 char:17 + $response = Invoke-WebRequest -Method Post -Uri $url -Body ($body | ConvertT ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand ConvertFrom-Json : Cannot bind argument to parameter 'InputObject' because it is null. At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:205 char:37 + $results = ($response.Content | ConvertFrom-Json).Results + ~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidData: (:) [ConvertFrom-Json], ParameterBindingValidationException + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.ConvertFromJsonCommand Corresponding WDATP event was not found Invoke-WebRequest : {"error":{"code":"429","message":"API calls quota exceeded! maximum allowed 15 per 00:01:00"}} At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:203 char:17 + $response = Invoke-WebRequest -Method Post -Uri $url -Body ($body | ConvertT ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand ConvertFrom-Json : Cannot bind argument to parameter 'InputObject' because it is null. At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:205 char:37 + $results = ($response.Content | ConvertFrom-Json).Results + ~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidData: (:) [ConvertFrom-Json], ParameterBindingValidationException + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.ConvertFromJsonCommand Corresponding WDATP event was not found Invoke-WebRequest : {"error":{"code":"429","message":"API calls quota exceeded! maximum allowed 15 per 00:01:00"}} At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:203 char:17 + $response = Invoke-WebRequest -Method Post -Uri $url -Body ($body | ConvertT ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand ConvertFrom-Json : Cannot bind argument to parameter 'InputObject' because it is null. At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:205 char:37 + $results = ($response.Content | ConvertFrom-Json).Results + ~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidData: (:) [ConvertFrom-Json], ParameterBindingValidationException + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.ConvertFromJsonCommand Corresponding WDATP event was not found Invoke-WebRequest : {"error":{"code":"429","message":"API calls quota exceeded! maximum allowed 15 per 00:01:00"}} At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:203 char:17 + $response = Invoke-WebRequest -Method Post -Uri $url -Body ($body | ConvertT ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand ConvertFrom-Json : Cannot bind argument to parameter 'InputObject' because it is null. At C:\WDAP-PA-integration\WDAP-PA-integration.ps1:205 char:37 + $results = ($response.Content | ConvertFrom-Json).Results + ~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidData: (:) [ConvertFrom-Json], ParameterBindingValidationException + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.ConvertFromJsonCommand Corresponding WDATP event was not found
- billyosheaSep 19, 2019Copper Contributor
I am getting the exact same error. Any suggestions? gsoriano