Re: INFOBLOX & RAPID 7 NEXPOSE/INSIGHTVM INTEGRATION UPDATE 12/13/18
[ Edited ]
Member
Posts: 4
Registered: ‎08-16-2019
Member
Posts: 4

I'm having issues with these templates.  Specifically, in these elements pulling null values:

 

{
"name": "skip object modification",
"operation": "CONDITION",
"condition": {
"statements": [
{
"left": "${E:A: operation_type}",
"op": "==",
"right": "MODIFY"
},
{
"left": "${E:A: operation_type}",
"op": "==",
"right": "DELETE"
}
],
"condition_type": "OR",
"stop": true
}
},

 

{
"name": "skip if Site is not defined or sync not requested",
"operation": "CONDITION",
"condition": {
"statements": [
{
"left": "${E:A:values{extattrs}{R7_Site}{value}}",
"op": "==",
"right": ""
},
{
"left": "${E:A:values{extattrs}{R7_Sync}{value}}",
"op": "==",
"right": ""
},
{
"left": "${E:A:values{extattrs}{R7_Sync}{value}}",
"op": "==",
"right": "false"
}
],
"condition_type": "OR",
"stop": true
}
},

 

It would appear that "operation_type" isn't a valid value in the E name space, but "event_type" is.

 

Also, the E:A:values{extattrs}{R7_Sync}{value}} doesn't look like it references a valid listindex.  If I replace this with ${E:A:ip.extattrs{R7_Site}}, it pulls the data I expect.  However, I have looked at other integrations templates like Qualys and the former format is used throughout, so I'm nervous that I'm missing something as to why the former format is being used, even though it appears broken.  Can you shed some light into this?

 

-Drew