Insight Agent unable to search for asset

InsightConnect
1

We are having trouble with leveraging the agent search by hostname with the insight agent plugin.
The stack trace is below.: I removed the host name

Could not find agent matching [******] of type Host Name. Check the agent input value and try again. Response was: NA
    Traceback (most recent call last):
      File "/usr/local/lib/python3.8/site-packages/rapid7_insight_agent_rapid7_plugin-1.0.1-py3.8.egg/icon_rapid7_insight_agent/actions/get_agent_details/action.py", line 20, in run
        agent = self.connection.api.get_agent(agent_input)
      File "/usr/local/lib/python3.8/site-packages/rapid7_insight_agent_rapid7_plugin-1.0.1-py3.8.egg/icon_rapid7_insight_agent/util/graphql_api/api_connection.py", line 37, in get_agent
        agent = self._get_agent(agent_input, agent_type)
      File "/usr/local/lib/python3.8/site-packages/rapid7_insight_agent_rapid7_plugin-1.0.1-py3.8.egg/icon_rapid7_insight_agent/util/graphql_api/api_connection.py", line 269, in _get_agent
        raise APIException(cause=f"Could not find agent matching {agent_input} of type {agent_type}.",
    icon_rapid7_insight_agent.util.graphql_api.api_exception.APIException: 
    An error occurred with the Insight Agent API.
    Could not find agent matching tromerod10 of type Host Name.
    Check the agent input value and try again.
    Data: NA
2

The output there looks normal. It seems like it just didn’t find that that hostname.

I tried this on our side, and it looks OK. Are you a multi-org customer by chance? You’re not accidentally looking in the wrong org for this host are you?

3

We did have multiple orgs at one point, however we no longer do. It seems this is a private API so I have been unable to make test using postman. However I have a I have rerun the test, the same hostname can be found via the agent console. One item the console is showing two instances as the agent. This is been a randomly occurring pain point with duplicate assets showing up with a new agent ID. Is there a chance this api check fails when a duplicate is found? I otherwise can’t think of how this failing.

4

If you run the same query in the console against the same log, are you getting results back?

5

After the last comment I found a test system that does not have a duplicate entry in the agents tab under data collection management. This time the search was successful. This seems to confirm that if there is more than one matching host the search by hostname fails for the agent plugin.

6

@jose_cardona Thanks for testing this and reporting back. We can certainly fix it. What is the expected behavior for your use-case? for the plugin to return all matching duplicates?

7

In this case yes. Although the there should not any duplicates, the reality is that we have some duplicates that creep up for one reason or another.

1 Like