Assistance with workflow

[ChrisCollinsIBM]

Originally asked by @theka69 but moving here as it was a comment on an announcement post.

---

Hi all,

We have a DMARC solution called DMARCLY (DMARCLY | Email Security, Authentication, Anti-Phishing, SPF, DKIM, DMARC Monitoring, and DMARC Analyzer) we're trying to pull logs from into QRadar SIEM using the Universal Cloud REST API protocol.

When I run the test (from QRadar CLI) on my workflow and workflow parameters, I get the error shown below in the capture.

However, when I test by directly querying the API endpoint using the "curl" command, it works as shown in the screenshot below.

I've been struggling with that for months. I'm stuck and completely clueless. I'm a total newbie in this API workflow matter, having never touched it before.

Can anybody please help me figure this out?

I pasted below the workflow and the workflow parameters I'm running.

Thanks,

---workflow---

    <CallEndpoint url="https://dmarcly.com/api/aggregate_by_unaligned" method="GET">

                <SSLConfiguration allowUntrustedServerCertificate="true" />
                    <BearerAuthentication token="${/access_token}" />

    </CallEndpoint>

</Actions>

---parameters---

Thanks,

[ChrisCollinsIBM]

At a glance I can see that the URL in your CallEndPoint (/api/aggregate_by_unaligned) is different from the URL you used in the CURL test (/api/aggregate_by_domain), so that could be a difference. You're also not passing the start/stop parameters in the workflow either which may yield unexpected results depending on what the API endpoint is getting. "Not Found" might be HTTP 404

I'd run it again with the -v option enabled for more output and that will likely give you some more details.

/opt/qradar/bin/test-workflow.sh -h
usage: test-workflow
Test a Universal Cloud REST API protocol workflow.
 -h,--help                 Displays the usage and exits.
 -p <[user@]server:port>   Specifies the proxy to use.
 -r <seconds>              Runs the workflow continuously (every 5 seconds
                           by default).
 -s <file>                 Specifies the file for state persistence.
 -u                        Specifies that untrusted server certificates
                           are allowed.
 -v                        Displays more logging.
 -w <file>                 Specifies the workflow to load.
 -wp <file>                Specifies the workflow parameter values to
                           load.
Visit IBM Knowledge Center for more information about this protocol.

[ghost]

Hi Chris,

Thanks so much for responding.
When I enter the same URL ("https://dmarcly.com/api/aggregate_by_domain?start=1738461891&end=1738980291") as in the "curl" command above, I get this error below.

I added the ";" delimiter at the end of the URL, as suggested by the error message, but it does not work.
So, I removed the delimiter and the last portion ("?start=1738461891&end=1738980291") of the URL. It suppressed the previous error, but I got a new one: HTTP "Forbidden" error below. Also I made sure to run the commands with the "-v" option as you recommended.

Below it's how my workflow looks like at the moment, I'm using the exact same API endpoint (https://dmarcly.com/api/aggregate_by_domain)

    <CallEndpoint url="https://dmarcly.com/api/aggregate_by_domain" method="GET">

                <SSLConfiguration allowUntrustedServerCertificate="true" />
                    <BearerAuthentication token="${/access_token}" />

    </CallEndpoint>

</Actions>