Error Messages Returned by Mandiant SecOps Integrations (MSI) Service
The HTTP Protocol states 427 as an error code with a title of "Undefined."
In MSI, this error indicate when an error has occurred, and is related to the upstream technology (the technology MSI is trying to reach out to; for example, Splunk, Elasticsearch, or Palo Alto) that is involved in this request. This message means that the error is related to the configuration sent to MSI, and not a code or functional error. If you receive a 427 error code, review the body of your request, update as necessary and send again.
When there are no errors, MSI returns a 200 - OK. This message means:
- MSI is able to reach the Upstream Technology.
- The Upstream Tech credentials are valid.
- The Upstream Tech could process the request.
- The Request was valid and the Upstream Tech responded as expected.
| Error Code | Description |
|---|---|
| 427 - Upstream Tech Timed Out | The Upstream Tech timed out when MSI Sent a Request. Check the Hostname/IP. |
| 427 - Upstream Tech Invalid Credentials | MSI is able to reach the Upstream Technology, but the Upstream Tech credentials were bad credentials/invalid. |
| 427 - Upstream Tech Query Invalid | MSI is able to reach the Upstream Technology and The Upstream Tech credentials are valid, but the Upstream Tech could not process the request (Bad Query, Incorrect values in parameters, and so on). |
| 422 - Unprocessable Entity | The Request to MSI is not a valid Request as expected by the API Spec. A parameter or request body value was either not provided, or was provided in an incorrect form. The error contains precise details about what caused the request to be invalid. |
| 500 - Internal Server Error | MSI Encountered an Internal Service Error. Contact Support if you're encountering this issue. |