References - Batch Module Error Guide
- Tianyi Chen
- John Hall (Unlicensed)
The ThreatConnect TcEx Framework provides the batch module to create, delete, and update both Groups and Indicators in the ThreatConnect platform. The App developer can dynamically build data objects, and the Batch module will write the data to the ThreatConnect API. When writing to the ThreatConnect API, errors can occur and this guide will help understand common batch errors.
All Batch Errors and Short Descriptions
Error Code | Short Description |
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Common Batch Error Explanations
Error Code 0x1002 - Permission Error
This error generally occurs when the user does not have the correct permissions to perform a certain action.
For example a user only has contributor permissions to a source. A contributor does not have permissions to delete indicators or groups. Editor permissions would be needed to delete.
Error (0x1002): You are not authorized to delete group attributes.Error Code 0x1003 - JsonSyntax Error
This error generally occurs when there is an error in the JSON syntax.
For example, the eventDate field incident group had a typo which caused it to not be formatted to the ISO 8601 standard.
Error (0x1003): Encountered an unexpected Exception while processing batch job. Last
known JSON path: '$.group[6]': Last processed group[6] '5c457dfb80f3b32aec1fbefbe89a
70a63fcfae45f7f5860d65fbc32216ee1515'. com.google.gson.JsonSyntaxException:
2020-04-19T16:0n;l0:00Z"Error Code 0x1005 - Invalid Indicator Error
This error occurs when the indicator itself has an issue.
For example, the following indicator m_lena.matroschka.pl did not conform to RFC952 + RFC1123 standards since _ is not a permitted character in a valid hostname.
"errorReason":"Error (0x1005): m_lena.matroschka.pl is not valid. The indicator
'm_lena.matroschka.pl' could not be processed as a valid Host due to missing or
invalid data (summary is invalid for the given type)."Error Code 0x1006 - Invalid Group Error
For example name field in the tag was incorrectly labeled incorrectly as na2me.
Error Code 0x1008 - Indicator Limit Error
For example, the batch module is submitting indicators belonging to a certain source/owner. However, the number of indicators allowed for that owner is 0.
Error Code 0x100A - Duplicate Item Error
The following code example shows how that might occur with a new indicator. Note that this will not produce a duplicate item error if the indicator already exists in the system. In this instance, the following would actually merge the attribute ‘Description’ with the ‘First Scene’ and ‘Last Scene’ attributes.
Error Code 0x2001 - Indicator Partial Loss Error
The following example shows how a malformed timestamp causes an indicator to have an invalid data. A missing Z at the end of the date timestamp '2020-11-09T19:26:18' causes a 0x2001 error.
Error Code 0x2002 - Group Partial Loss Error
For example, sda was used for the type field in the attribute section instead of “source”.