Failing to query ICDx from ICA

Products

• Information Centric Analytics

Issue/Introduction

While trying to pull data from ICDx to Information Centric Analytics (ICA) using the query example provided in the Integration and Solution Accelerator Guide, the following error is logged in the RiskFabric ActivityLog table:

{"sourceClass":"Ext.JSON","sourceMethod":"decode","msg":"You're trying to decode an invalid JSON String: "}

Environment

Release : 6.5.4

Component : ICDx Integration

Cause

In the example query provided in the Integration and Solution Accelerator Guide, the string @2: is included in error. This is how the queries are formatted in the guide:

@2:product_name="Symantec Integrated Cyber Defense Manager" 
@2:collector_name="Symantec- SESC Cloud collector"

Resolution

The corrected syntax for the sample query provided in the Integration and Solution Accelerator Guide is this:

product_name="Symantec Integrated Cyber Defense Manager" 
collector_name="Symantec- SESC Cloud collector"

Note that this is a sample query only; you will need to compose a query that pulls the data you wish to integrate with ICA.