View Only

CB ThreatHunter: cbapi scripts generating 400 errors

By CB_Support posted Sep 10, 2020 01:41 AM

Recommend

Environment

CB ThreatHunter: All versions between May 5th to May 18th, 2020
CB cbapi: All versions

Symptoms

This error occurs in some python scripts:

File "C:\Users\vnc876\AppData\Local\Programs\Python\Python38-32\lib\site-packages\cbapi\connection.py", line 192, in http_request
raise ServerError(error_code=r.status_code, message=r.text)
cbapi.errors.ServerError: Received error code 400 from API:

{"message":"Error parsing \"q\" from query string","translation_key":"threathunter_search_parsing_error","translation_format_values":["q"]}

Cause

CBTH added more stringent validation around May 5th. Cbapi was not using the api correctly so the 400s started occurring at that time.

Resolution

ThreatHunter change on May 18th occurred to make it so the API automatically adds in a process_guid query so the user doesn't have to in the v1 events route.

Knowledge Base