Running into an issue using the Get Agent Details Action in the Sophos Central plugin. The Action accepts the following as lookup options:
- IPv4 address
- IPv6 address
- MAC address
- hostname
- device ID
The error I receive is:
Connect: Connecting…
rapid7/Sophos Central:4.4.0. Step name: get_agent_details
An error occurred during plugin execution!
Invalid or unreachable endpoint provided. Verify the endpoint/URL/hostname configured in your plugin connection is correct.
Traceback (most recent call last):
File “/usr/local/lib/python3.8/site-packages/insightconnect_plugin_runtime-4.10.1-py3.8.egg/insightconnect_plugin_runtime/plugin.py”, line 385, in handle_step
output = self.start_step(
File “/usr/local/lib/python3.8/site-packages/insightconnect_plugin_runtime-4.10.1-py3.8.egg/insightconnect_plugin_runtime/plugin.py”, line 575, in start_step
output = func(params)
File “/usr/local/lib/python3.8/site-packages/sophos_central_rapid7_plugin-4.4.0-py3.8.egg/icon_sophos_central/actions/get_agent_details/action.py”, line 43, in run
raise PluginException(preset=PluginException.Preset.NOT_FOUND)
insightconnect_plugin_runtime.exceptions.PluginException: An error occurred during plugin execution!
Invalid or unreachable endpoint provided. Verify the endpoint/URL/hostname configured in your plugin connection is correct.
After testing further, I stumbled on what might be the issue. If I use the action Get Endpoints which retrieves all devices “based on last seen,” only 50 devices are returned. This is due to pagination in the API and the plugin probably doesn’t support it. BUT, if I query any of the 50 returned devices with the Get Agent Details action, it works… Is it possible that the Get Agent Details is really retrieving the first page of endpoints and then iterating through it for the query criteria?