-
-
Notifications
You must be signed in to change notification settings - Fork 119
Description
HTTP app version 1.4.0
When I'm trying to GET alerts from DFIR IRIS with http app or "custom action" in IRIS app i get an error/
IRIS endpoint: /alerts/filter
this endpoint by default return 10 alerts and total number of pages, and in this case everything works fine,
But when i'm adding query params like this per_page=100&creation_start_date=$exec.start_date&creation_end_date=$exec.end_date i get an error because of timeout (more than 10 alerts takes time to process by IRIS and return response)
shuffle_action_logs (sanitized):
2025-06-17 09:38:35,304 - HTTP - INFO - [INFO][a1269c43-3993-45eb-bba7-24b04cdf2fcd] Action name: GET, Params: 9, Has Body: False
2025-06-17 09:38:35,318 - HTTP - INFO - [INFO][a1269c43-3993-45eb-bba7-24b04cdf2fcd] Running function 'GET' with timeout 30
2025-06-17 09:38:35,323 - HTTP - INFO - ['Accept: application/json', 'Authorization: Bearer correct_IRIS_API_token']
2025-06-17 09:38:40,365 - HTTP - INFO - [ERROR] Something is wrong with the input for this function. Are lists and JSON data handled parsed properly (1)? err: HTTPSConnectionPool(host='myirisdomain.org', port=443): Read timed out. (read timeout=5)
2025-06-17 09:38:40,365 - HTTP - INFO - [DEBUG][a1269c43-3993-45eb-bba7-24b04cdf2fcd] Sending result to https://myshuffledomain.org/api/v1/streams
My idea to fetch all alerts for some period of time, like per_page=10000 and process them all in my workflow, so i wanna set timeout like 10-30mins for this action
if i read code of http app properly timeout=5 is hardcoded, my suggestion to add possibility to change this value