Catch Error 403

[ve6mad]

Hello all,

Getting this error when trying to run inventory of all our clients to a json export:

12/01/2021 07:07:28 PM - INFO - Attempting to get inventory information
12/01/2021 07:07:29 PM - ERROR - Response Code: 403
12/01/2021 07:07:29 PM - ERROR - Error Details: b'{\n "error": "forbidden",\n "correlationId": "5867cac9-997a-43fe-bb6c-e5fd9f994503",\n "requestId": "d0ba43f0-4b54-4075-86fb-c4abdadd7ea8",\n "createdAt": "2021-01-13T02:07:29.234Z",\n "message": "Forbidden"\n}'
Traceback (most recent call last):
File "sophos_central_main.py", line 565, in
main(args)
File "sophos_central_main.py", line 483, in main
get_inventory(tenant_info, output, page_size, splunk_creds, tenant)
File "sophos_central_main.py", line 135, in get_inventory
json_data = get_api.get_data(tenant_url_data, page_size, tenant_id, api)
File "C:\Users\administrator.CORP\Documents\sophos_test\sophos_test\lib\site-packages\sophos_central_api_connector\sophos_central_api_get_data.py", line 30, in get_data
ep_item_data = ep_data['items']
TypeError: 'NoneType' object is not subscriptable

When looking at the list of tenants and where it errors out, this tenant in particular is not managed by us but shows pu in our portal. Is there a way to skip this tenant when building the list, maybe catch the error 403 and move on? I've tried adding an if-else for the tenant ID, but not sure that's sustainable long term as we get more clients in the portal that aren't managed.

Running Python 3.8.3 on Windows 10.

Thanks!

[moledaemon]

Hi,

Thanks for raising this, the repo has just been updated and will skip on a 403. Can you verify if this now resolves the issue that you saw?

Thanks

[ve6mad]

Hi Mark,

Unfortunately looks like it's still erroring out, not showing the 403 error, but still breaking at the same tenantID. Here is the new traceback:

16/03/2021 07:47:27 PM - INFO - Attempting to get inventory information Traceback (most recent call last): File "sophos_central_main.py", line 565, in <module> main(args) File "sophos_central_main.py", line 483, in main get_inventory(tenant_info, output, page_size, splunk_creds, tenant) File "sophos_central_main.py", line 135, in get_inventory json_data = get_api.get_data(tenant_url_data, page_size, tenant_id, api) File "C:\Users\administrator.CORP\Documents\sophos_mar2021\lib\site-packages\sophos_central_api_connector\sophos_central_api_get_data.py", line 20, in get_data pg_total = pg_data['pages']['total'] KeyError: 'pages'

My hack for now (with rusty python skills) is to add an:

if ten_id != 'problematic-tenant-id-here':

to line 131 and that gets around skipping that tenant and finishing up the query fine. Hope that helps, let me know if you'd like me to do some more testing.

Thanks,
Max

[moledaemon]

Hi Max,

Thanks for the further detail, I will take a look and get a fix in place.

Thanks