Custom Action - Get package SAS URI API

[vanitharaj1208]

HI All,

I'm building this custom action - https://learn.microsoft.com/en-us/defender-endpoint/api/get-package-sas-uri 

I need some guidance to Handle rate limit since it is 2 calls per minute

"Rate limitations for this API are 2 calls per minute and 120 calls per hour."

What will be the best approach to handle this?

and i have one question - if we got 10 alerts and at same time playbook which got attached had this action - then this action will fail rest 8 alerts and 2 alerts had successful playbook run?

[ylandovskyy · Accepted solution]

Hey @vanitharaj1208 ,

The best practice would be to implement the action with retry mechanism. Meaning that, if you've encountered status code 429, the action will wait until it will receive status code 200. In that way, over time the action will finish for all 10 alerts.

Retry mechanism will need to be done in async way. We have a lot of actions that work like that, you can look into action "Wait For Custom Fields" in Siemplify for inspiration.  

[Chica]

hi @ylandovskyy , are you sure that we should go with async action ? 

[SoarAndy]

It sounds best to me too.

There is a roadmap item for x retries, however that will be a little more limited in retry count compared to Async that can try for hours/days.

[vanitharaj1208]

Hi @ylandovskyy ,

Can i get some info on modules which starts with TIPCommon and where can i find the code?

I have implemented with retry mechanism in sync action , its working but i'm not sure ... is this right way?

and  in this action "Wait For Custom Fields"  where is Retry mechanism is implemented i didn't find it?

[_K_O]

@vanitharaj1208 

In terms of TIP Common, you can find the code base in the "Script Dependencies" section of the integration.

To review the code, you can export the integration itself and review the code locally in the "Dependencies" folder. If you wanted to include TIP common in your own integrations, Google had a post a few weeks ago on how to perform that action: https://www.googlecloudcommunity.com/gc/SecOps-SOAR/Retrieving-latest-version-of-TIPCommon-and-its-d...