You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I am seeing this behaviour on: (please complete the following information):
OS: Windows
Carbon Black Product: CB EDR (Response)
Python Version: 2.7
Describe the bug
Alert objects of type watchlist.hit.query.process and watchlist.hit.query.binary from the "My Watchlists" feed (custom watchlists) are missing the "description" data member. This field should be available and contain a value matching the description of the watchlist.
Steps to Reproduce
Steps to reproduce the behavior (Provide a log message if relevant):
cb=CbResponseAPI()
process_watchlist_alert=cb.select(Alert).where('alert_type:watchlist.hit.query.process AND feed_name:"My Watchlists"').first()
binary_watchlist_alert=cb.select(Alert).where('alert_type:watchlist.hit.query.binary AND feed_name:"My Watchlists"').first()
print(str(process_watchlist_alert)) # Prints entire Alert object for viewingprint(str(binary_watchlist_alert)) # Prints entire Alert object for viewingprint(str(process_watchlist_alert.description)) # Throws cbapi.errors.ObjectNotFoundError# print(str(binary_watchlist_alert.description)) # Also throws cbapi.errors.ObjectNotFoundError
Expected behavior
Both watchlist.hit.query.process and watchlist.hit.query.binary from "My Watchlists" will have a description data member.
print(str(process_watchlist_alert.description)) # Returns description of watchlist from watchlist_id / watchlist_nameprint(str(binary_watchlist_alert.description)) # Returns description of watchlist from watchlist_id / watchlist_name
Screenshots
N/A
Additional context
A workaround could be to query the Watchlist and pull it's description like so:
try:
watchlist=cb.select(Watchlist).where("id:"+str(process_watchlist_alert.watchlist_id)).first()
watchlist_description=watchlist.descriptionexcept:
watchlist_description="N/A"# Reason this would occur is explained below...
This could be used to pull the description manually, but this would add unnecessary overhead. Additionally, the biggest problem with this workaround stems from deleted watchlists where the ID no longer exists. A better solution would be to provide access to it directly within the Alert API, like other alert types have.
The text was updated successfully, but these errors were encountered:
jjfallete
changed the title
[BUG] Alerts of type watchlist.hit.query.* Missing description Data Member
[BUG] Alerts of type watchlist.hit.query.* from My Watchlists Feed Missing description Data Member
Jul 27, 2020
Updated bug report: this is only an issue where the feed_name is "My Watchlists" - since all alerts are technically of the watchlist.hit type, it might have been confusing to look at a watchlist.hit.query.* type not from the "My Watchlists" feed, which would have the description data member.
I am seeing this behaviour on: (please complete the following information):
Describe the bug
Alert objects of type watchlist.hit.query.process and watchlist.hit.query.binary from the "My Watchlists" feed (custom watchlists) are missing the "description" data member. This field should be available and contain a value matching the description of the watchlist.
Steps to Reproduce
Steps to reproduce the behavior (Provide a log message if relevant):
Expected behavior
Both watchlist.hit.query.process and watchlist.hit.query.binary from "My Watchlists" will have a description data member.
Screenshots
N/A
Additional context
A workaround could be to query the Watchlist and pull it's description like so:
This could be used to pull the description manually, but this would add unnecessary overhead. Additionally, the biggest problem with this workaround stems from deleted watchlists where the ID no longer exists. A better solution would be to provide access to it directly within the Alert API, like other alert types have.
The text was updated successfully, but these errors were encountered: