Skip to content

Timeout error in HTTP app #428

@Kagetana

Description

@Kagetana

HTTP app version 1.4.0

When I'm trying to GET alerts from DFIR IRIS with http app or "custom action" in IRIS app i get an error/
IRIS endpoint: /alerts/filter
this endpoint by default return 10 alerts and total number of pages, and in this case everything works fine,
But when i'm adding query params like this per_page=100&creation_start_date=$exec.start_date&creation_end_date=$exec.end_date i get an error because of timeout (more than 10 alerts takes time to process by IRIS and return response)

shuffle_action_logs (sanitized):

2025-06-17 09:38:35,304 - HTTP - INFO - [INFO][a1269c43-3993-45eb-bba7-24b04cdf2fcd] Action name: GET, Params: 9, Has Body: False
2025-06-17 09:38:35,318 - HTTP - INFO - [INFO][a1269c43-3993-45eb-bba7-24b04cdf2fcd] Running function 'GET' with timeout 30
2025-06-17 09:38:35,323 - HTTP - INFO - ['Accept: application/json', 'Authorization: Bearer correct_IRIS_API_token']
2025-06-17 09:38:40,365 - HTTP - INFO - [ERROR] Something is wrong with the input for this function. Are lists and JSON data handled parsed properly (1)? err: HTTPSConnectionPool(host='myirisdomain.org', port=443): Read timed out. (read timeout=5)
2025-06-17 09:38:40,365 - HTTP - INFO - [DEBUG][a1269c43-3993-45eb-bba7-24b04cdf2fcd] Sending result to https://myshuffledomain.org/api/v1/streams

My idea to fetch all alerts for some period of time, like per_page=10000 and process them all in my workflow, so i wanna set timeout like 10-30mins for this action
if i read code of http app properly timeout=5 is hardcoded, my suggestion to add possibility to change this value

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions