Skip to content
This repository has been archived by the owner on Dec 14, 2024. It is now read-only.

panContentPack.py fails on "threats" with error "Error parsing app: ###" #94

Closed
crumpetcrusher opened this issue Sep 26, 2019 · 1 comment

Comments

@crumpetcrusher
Copy link

crumpetcrusher commented Sep 26, 2019

Receiving the error mentioned in the title on the immediate first entry it tries to parse.

Looking at the XML returned from a manual REST query, there's no fields available aside from the name and the ID of the threat object. So, when it tries to fill out the dictionary for, say, the "threat:cve" key, it doesn't exist in the XML response, so an exception is thrown.

2019-09-26 10:00:23,214 -0400 INFO	panContentPack:187 - Getting threats from content pack on Palo Alto Networks device at ...
2019-09-26 10:00:25,902 -0400 ERROR	panContentPack:162 - Error parsing app: 18250
<sw-version>8.1.10</sw-version>
<app-version>8194-5675</app-version>
<app-release-date>2019/09/24 16:46:37 EDT</app-release-date>
<av-version>3113-3624</av-version>
<av-release-date>2019/09/26 07:02:17 EDT</av-release-date>
<threat-version>8194-5675</threat-version>
<threat-release-date>2019/09/24 16:46:37 EDT</threat-release-date>

Thank you.

@crumpetcrusher crumpetcrusher changed the title panContentPack.py fails on "threats" with error "Unable to parse: ###" panContentPack.py fails on "threats" with error "Error parsing app: ###" Sep 26, 2019
@crumpetcrusher
Copy link
Author

Okay identified the issue and resolved. A while back (maybe November 2018) we were getting an error from panContentPack.py when line 203 device.refresh_system_info() was executed, and it was commented out (may have been due to the version we were on at the time.) This appears to be how device is instantiated with the proper version information. Line 211 if device._version_info >= (8, 0, 0): was evaluating to False, causing it to query the older XAPI interface.

I reverted our changes and this is working again, both apps and threats.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant