Failing to query ICDx from ICA

Products

• Information Centric Analytics

Issue/Introduction

While trying to pull data from ICDx to Information Centric Analytics (ICA) using the query example provided in the Integration and Solution Accelerator Guide, the following error is logged in the RiskFabric ActivityLog table:

-- Request/response -- url:/api/LinkedServer/TestLinkedServerQuery?_dc=1643667712000 api:null params:undefined extraParams:null Status: 0 StatusText:  responseText:  -- portalConfig -- _PortalUserId :76052068-dc82-ec11-b331-000c298dd1ac _Administrator :true _CanViewMetrics :true _CanViewDIMRemediation :true _CanRemediateDIM :true _CanViewComplianceRemediation :true _CanRemediateCompliance :true _ExceptionAdministrator :true _CanViewScanExclusionS3 :false _CanViewScanExclusionAdmin :null _ScanExclusionAdministrator :true _CanViewPII :true -- S3 -- User.SelectedUser :1 User.TopUser :1 

{"sourceClass":"Ext.JSON","sourceMethod":"decode","msg":"You're trying to decode an invalid JSON String: "}

Cause

In the example query provided in the Integration and Solution Accelerator Guide, the string @2: is included in error. This is how the queries are formatted in the guide:

@2:product_name="Symantec Integrated Cyber Defense Manager" 
@2:collector_name="Symantec- SESC Cloud collector"

Environment

Release : 6.5.4

Component : ICDx Integration

Resolution

The corrected syntax for the sample query provided in the Integration and Solution Accelerator Guide is this:

product_name="Symantec Integrated Cyber Defense Manager" 
collector_name="Symantec- SESC Cloud collector"

Note that this is a sample query only; users will need to compose a query that pulls the data you wish to integrate with ICA.