Unable to create/escalate to new case system : Code 400

[0nnyx]

After upgrading to 2.3.100 from 2.3.91 (initial install was from Centos ISO 2.3.30), I'm unable to create cases and escalate alerts to new cases. Systematically getting Request failed with status code 400
Log from /opt/so/log/soc:
timestamp=2022-02-02T19:19:57.310532386Z level=info message="Handled request" contentLength=115 elapsedMs=441 impl=*server.CaseHandler method=POST path=/api/case/ remoteAddr=172.17.0.1:59892 requestId=9a547090-791c-44ad-bbf9-8ed442ac9b63 requestor=a7e42c01-dcdc-46d2-afc4-19cccd847d45 sourceIp=192.168.1.2 statusCode=400

Note: I faced the soup error during the upgrade to 2.3.100 described at #7046

[dougburks]

Have you tried shift-reload in your browser to make sure it's not a caching issue?

[0nnyx]

My SO installation is almost like the original. Only added Wes otx and misp zeek intel downloaders several months ago. Tried to have netflow filebeat but it never worked on my SO while working fine on a new test install of 2.3.91.
That said, the upgrade from 2.3.91 to 2.3.100 is the 1st time I've encountered soup errors. Could it be that soup didn't implement the new case system completely because of these errors ? Note I removed the soup log as it was > 1.5GB after all the upgrades from 2.3.30.

[dougburks]

You could try performing a fresh install of 2.3.100 in a VM and then comparing the two systems side by side looking for any differences.

One thing in particular you might check is the status of the case indices:

so-elasticsearch-indices-list |grep case

[0nnyx]

Indices look fine:

green open  so-casehistory                  om_6DQGFTbO-vYhLC3IBDg 1 0       35      0  44.8kb  44.8kb
green open  so-case                         Ss2dsbFWQ7SGY47lhAUEDw 1 0       35      0  42.5kb  42.5kb

I'll probably plan a full reinstallation in the near future.

[dougburks]

Yep, that seems like the quickest and easiest solution.

[jertel]

Also check /opt/so/log/soc/senseroni-server.log for errors after clicking Escalate.

[brazorfajeje]

In my case i receive the same error, the event is created, but SO fails to acknowledge the alert and returns an error 400

Here a snippets of my logs:

timestamp=2022-02-28T15:13:34.079368912Z level=info message="Handled request" contentLength=1356 elapsedMs=771 impl=*server.CaseHandler method=POST path=/api/case/events remoteAddr=172.17.0.1:46428 requestId=7a6019fb-8836-4c37-8377-3c3f8160d1e7 requestor=784f2481-308c-4d8c-bcc8-232779d37640 sourceIp= <client-ip> statusCode=200
timestamp=2022-02-28T15:13:34.117728492Z level=info message="HTTP request finished" contentLength=712 method=GET status="200 OK" statusCode=200 url=http://<server-ip>:4434/identities/784f2481-308c-4d8c-bcc8-232779d37640
timestamp=2022-02-28T15:13:34.118041003Z level=info message="Acknowledging event" acknowledge=true escalate=true requestId=cc6567db-b9f1-4796-aca4-be4088e9e7f0 searchFilter="event.dataset:alert AND  NOT event.acknowledged:true AND  NOT event.escalated:true AND * AND rule.name:\"Successful sudo to ROOT executed.\""
timestamp=2022-02-28T15:13:34.125893008Z level=warn message="Request did not complete successfully" error="No eligible events available to acknowledge" requestId=cc6567db-b9f1-4796-aca4-be4088e9e7f0 requestor=784f2481-308c-4d8c-bcc8-232779d37640
timestamp=2022-02-28T15:13:34.125993176Z level=info message="Handled request" contentLength=115 elapsedMs=11 impl=*server.EventHandler method=POST path=/api/events/ack remoteAddr=172.17.0.1:46448 requestId=cc6567db-b9f1-4796-aca4-be4088e9e7f0 requestor=784f2481-308c-4d8c-bcc8-232779d37640 sourceIp= <client-ip> statusCode=400

[thegreekman]

I am getting this also, any solution?

[0nnyx]

Seems you're having a problem at a later stage than me. Only solution for me was to do a fresh install. Best to open a new thread for that.

[0nnyx]

No solution except doing a fresh installation of 2.3.100 or above