CyberArk EPM - Log Pulling problem with Universal Cloud REST API

[alisabrikim]

When i try to pulling log on Qradar i got a error. I checked parameters is corret. annd logged in the "https://eu.epm.cyberark.com/login" with api users but i got this error: " ERROR: /get_access_token/body/ManagerURL is not valid"

Here is the cli outputs:

[root@xxx CyberArk EPM - RestAPI]# /opt/qradar/bin/test-workflow.sh -w workflow.xml -wp parameters.xml

2024-08-14 12:56:23 [INFO ][UniversalCloudRESTAPITest] Status cleared.

2024-08-14 12:56:23,545 [QRADAR] [main] com.q1labs.semsources.sources.universalcloudrestapi.v1.workflow.action.LogAction: [INFO] [NOT:0000006000][-/- -] [-/- -]EPM::AdminAudit - The EPM Bookmark value was 1723542983509 : 2024-08-13T09:56:23.509Z

2024-08-14 12:56:24,605 [QRADAR] [main] com.q1labs.semsources.sources.universalcloudrestapi.v1.workflow.action.LogAction: [INFO] [NOT:0000006000][-/- -] [-/- -]EPM::AdminAudit - 200 : OK.

2024-08-14 12:56:24 [INFO ][UniversalCloudRESTAPITest] Status changed to ERROR: /get_access_token/body/ManagerURL is not valid

[ChrisCollinsIBM]

@compostCY was the developer on these workflows, and there are also 3 workflows so I'm not sure which one specifically you're using from the workflow.xml filename shown.

This looks to be one of the lines you could be hitting:

IBM-QRadar-Universal-Cloud-REST-API/Community Developed/CyberArk EPM/CyberArk-EPM-AdminAudits-Workflow.xml

Line 49 in e5d9520

<Set path="/epm_url" value="${/get_access_token/body/ManagerURL}" />

Or here:

IBM-QRadar-Universal-Cloud-REST-API/Community Developed/CyberArk EPM/CyberArk-EPM-AggregatedEvents-Workflow.xml

Line 54 in e5d9520

<Set path="/epm_url" value="${/get_access_token/body/ManagerURL}" />

Or here:

IBM-QRadar-Universal-Cloud-REST-API/Community Developed/CyberArk EPM/CyberArk-EPM-AggregatedPolicy-Workflow.xml

Line 54 in e5d9520

<Set path="/epm_url" value="${/get_access_token/body/ManagerURL}" />

Those references all look well-formed though, so maybe the response from the API has changed and ManagerURL is no longer a root element in the returned JSON?

If you have a look at your /store/ec/universalcloudrestapi/XXXX/state.json file you can look at the JSON data in there and find the /get_access_token/body/ path and look at what's in there.

[ChrisCollinsIBM]

Closing due to inactivity - please re-open if needed.