I've actually had that same problem over the last few weeks and have gone through the same troubleshooting steps as you. I started having issues with another app's ingestion a couple of weeks ago and also mentioned CrowdStrike in the support case, however, when it came time to jump on a call with support the CrowdStrike app was ingesting fine and has been since. Like you said it is very odd and not very consistent on when it does or doesn't work.
... View more
I'm trying to create a playbook that uses the Windows Remote Management app to take a file saved locally on a server and move it to a location on a network share. I've tried using different command and Powershell options and the WRM app's built-in action 'copy-item' and none of them work. I can run these commands and scripts locally on the server logged-in as the user that would be performing these actions through SOAR and everything works fine. I can also have SOAR move the file from a local folder to another local folder and everything works fine. It's only when I ask SOAR to move it to a network share it will not work. Examples of what I'm doing: Move-Item -Path C:\folder\file.txt -Destination \\servername\sharename This script will work fine locally, but will not through SOAR. Move-Item -Path C:\folder\file.txt -Destination C:\differentfolder\file.txt This script will work fine both locally and through SOAR. I've tried mapping the drive so I can use M:\file.txt and it still fails. I've asked SOAR to run the commands directly and also have tried letting SOAR run a script that uses these commands and it will not work. It doesn't seem to be a permission issue since I'm able to do all of this locally. I'm lost at what else I can try or what else to look for as possible issues. Thanks for any help.
... View more
I'm configuring the SOAR/Phantom app - Splunk HTTP. I've set it up to use OAuth, provided the authentication URL and the clientID & secret. When I test connectivity it says the action failed with: "1 action failed Error fetching token from https://api.domain/oauth2/token. Server returned 201". The thing is the API is supposed to return a 201 when the authentication succeeds. Is there a place to edit the app to allow a 201 response as a successful request?
... View more