Skip to content

Trend Micro XDR Connector broken - urllib3.request.urlencode() does not exist #13329

@hexcon

Description

@hexcon

Describe the bug

The Trend Micro Vision One XDR connector Azure Function fails with AttributeError: 'function' object has no attribute 'urlencode' when attempting to poll workbench events. The timer trigger function crashes every execution cycle due to an incorrect import usage in workbench_service.py.

To Reproduce

Steps to reproduce the behavior:

  1. Deploy the Trend Micro Vision One Data Connector Azure Function from the latest master branch (commit d8b7978 or later)
  2. Configure with valid API tokens and Azure Sentinel workspace
  3. Wait for the timer trigger to execute (runs every 20 minutes by default)
  4. Observe the function execution fails with AttributeError

Expected behavior

The function should successfully query the Trend Micro Vision One API for workbench events, URL-encode the query parameters, and forward events to Azure Sentinel workspace without errors.

Error Log

AttributeError: 'function' object has no attribute 'urlencode'
Traceback (most recent call last):
  File "/home/site/wwwroot/timer_trigger/__init__.py", line 106, in main
    workbench_records = get_workbench_list_v3(
  File "/home/site/wwwroot/shared_code/services/workbench_service.py", line 115, in get_workbench_list_v3
    encoded_params = urllib3.request.urlencode(query_params)
                     ^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'function' object has no attribute 'urlencode'

Root Cause

Commit d8b7978 introduced incorrect usage of urllib3.request.urlencode(). The urllib3 library does not have a urlencode() method. The correct approach is to use Python's standard library: urllib.parse.urlencode().

Affected File

Solutions/Trend Micro Vision One/Data Connectors/AzureFunctionTrendMicroXDR/shared_code/services/workbench_service.py - Line 115

Proposed Fix

# Current (BROKEN):
encoded_params = urllib3.request.urlencode(query_params)

# Should be:
from urllib.parse import urlencode
encoded_params = urlencode(query_params)

Additional context

  • Bug introduced in commit: d8b7978
  • Last working version: edb92f3
  • Affects all users who deployed or auto-updated to the latest version
  • The connector is completely non-functional since this commit
  • Version: TMXDRSentinelAddon/1.2.7
  • Severity: Critical - Complete functionality loss for all Trend Micro XDR connector users

Metadata

Metadata

Labels

ConnectorConnector specialty review needed

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions