SOAR - Artifact not being created when events are forwarded to SOAR

Applicability

Description

The Splunk App for SOAR Export Events Forwarding is configured to send alert every 5 minutes. In a few events, there is no artifact being created inside container in SOAR. 

Investigation

When manually sending those events using the SPL command, they were sent successfully to SOAR and artifacts were created with the SASE option "Split multivalue fields (default)".

index=notable "\[Test Alert\] Suspicious" | head 1 | table * | sendalert sendtophantom param.phantom_server="SOAR222" param.sensitivity="amber" param.severity="low" param.label="events"

However when using the Advanced option in SASE App under Configuration ““Send multivalue as lists” and the artifact was not being created.

The log file phantom_sendtophantom_modalert.log shows the following error: 

2024-03-18 20:33:44,289 ERROR pid=32784 tid=MainThread file=cim_actions.py:message:431 | sendmodaction - worker="www.example.com" signature="Error while creating artifacts: Traceback (most recent call last):
  File "/opt/splunk/etc/apps/phantom/bin/ta_addonphantom/modalert_phantom_forward_helper.py", line 442, in process_event
    resp.update(response.json())
  File "/opt/splunk/etc/apps/phantom/bin/phantom_requests/models.py", line 900, in json
    return complexjson.loads(self.text, **kwargs)
  File "/opt/splunk/lib/python3.7/json/__init__.py", line 348, in loads
    return _default_decoder.decode(s)
  File "/opt/splunk/lib/python3.7/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/opt/splunk/lib/python3.7/json/decoder.py", line 355, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
" action_name="sendtophantom" sid="1710794003.12268" orig_sid="scheduler_c3ZjLnVzLXAtLXNwbC1vYmo__SplunkEnterpriseSecuritySuite__RMD52b1e331f617170dc_at_1707409800_11948" rid="0" orig_rid="0" app="search" user="tester" digest_mode="1" action_mode="adhoc" action_status="failure"

Resolution

The default AWS WAF Generic rule "GenericLFI_BODY" was catching the events where the field was sending as a List and blocked it. The rule doesn’t apply when it was sent as a single value. If using option "“Send multivalue as lists” is preferred and some special characters in the list could trigger the rule, the AWS rule needs to be disabled.