Unable to create manual case via SOAR API without setting data access scope for relevant environment

Question

I have a workflow that requires a case be created in an environment if certain conditions are met. I was able to create a custom action to do this fine a few weeks ago, but since a new scope (also the first scope) was added in our SIEM settings, I notice the action is failing.

Error: {"errorCode":2000,"errorMessage":"DataAccessScope is required.","innerException":null,"innerExceptionType":null,

This new scope has nothing to do with the environment I am trying to create the case for. The environment itself does not have any scopes applied to it at all, it is ‘Global’.

The Swagger docs for the CreateManualCase endpoint specify dataAccessScope should be a string, I’ve tried a selection of strings such as “*”, “Global”, “<ENVIRONMENT_NAME” etc but have had no luck. I’ve also tried not settings it obviously.

Is there a specific string I should be using here? Or should I create a new scope with access to all data?

Thanks

matt-amastra · Answer

I don’t have an immediate solution for you, but I can provide some troubleshooting steps/questions whose answers might help us to identify the root cause.

You mentioned you are using the CreateManualCase endpoint. This is the same endpoint the “Add a Case > Create Manual Case” flow uses in the UI. Are you able to successfully create a case this way through the UI?
- If yes, how does the request in your browser’s DevTools Network tab compare to the request you are sending via your custom action? You should be able to add a log/print statement around the request in your action and run a test in the IDE to print the contents of your request to compare.
- If no, what is returned in the response (code and message) and are there any errors logged in the console?
Do you get the same behavior with CreateCase or createSimulatedCustomCase?
What is the scope-to-environment mapping you have configured in SOAR Setting > Environments? Which environment are you trying to create the case in? Which RBAC scope are you (your user) assigned? Please sanitize if anything sensitive here.
Which integration is your custom action defined in? Which environment is the integration instance used by this action configured in? For the cases where the action runs on them and gives you the 2000 error you describe, which environment are those cases in?
For the cases where the action runs on them and gives you the 2000 error you describe, what data RBAC scope(s) do the underlying events belong in? Are the same scopes or combination of scopes always giving you this issue? What combinations of scope and environment have you tried and what was the outcome of each?

The docs for these endpoints do specify that providing a dataAccessScope value in the request is optional but I would not be surprised if some combination of conditions makes it required, but the docs lack that detail. The questions above should hopefully help us to narrow down what those combinations might be.

Sign up

Login with SSO

Login to the community

Login with SSO