To anyone who is stumbling on this same error, I was able to resolve the issue: Cause: ServiceNow Security Operations Addon Version 1.23.4 is stated to work with Python3 but this is not the case. There needs to be an edit that will allow it to work for Python3. Because new versions of Splunk(8.1 and newer) does not come with Python2.7 interpreter, this script will not work. My assumption is that this app was tested with a 8.0.x Splunk instance that has both python 2.7 and 3 Interpreters. Issue: When the alert tried to invoke the alert sn_sec_multi_incident_alert.py, there wan an error. The main clue is the following event: 08-18-2021 18:42:04.947 -0400 ERROR sendmodalert - action=sn_sec_multi_incident_alert STDERR - _csv.Error: iterator should return strings, not bytes (did you open the file in text mode?) The issue is that the CSV in the script is improperly opened in Python3. By default, gzip will open it as bytes not a string. Once the mode is put to read as string the script will be able to run without error. Solution: Change the csvReader to open the gzip file in "rt" mode Old : New: DISCLAIMER: This was only done for SN Multi Incident Alert Action. To use any of the other SN alerts, their corresponding scripts might have to be edited as well.
... View more
