WCF Duplex communication with InterSystems - wcf

Can someone point me to a sample of how to call a WCF service using wsDualHttpBinding? I created the classes using the SOAP Client Wizard and everything compiles. When I run the objectscript code, it hangs on the web service call for a while (it's hitting a timeout) and returns an exception:
| oref value: 4
| class name: %Exception.SystemException
| OID: ""
| reference count: 2 (system)
+----------------- attribute values ------------------
| Code = 64
| Data = ""
| InnerException = ""
| Location = "zInvokeClient+349^Service.WSDualHttpBindingIService.1"
| Name = ""
and %objlasterror gives:
0 3"%zRead+31^%Net.HttpRequest.1:SAMPLES
LOCATION is set to "http://localhost:8733/Design_Time_Addresses/PNServices/Service1/"
Any idea/clues?

Just a slight advice: Try using w ##class(%SYSTEM.Status).GetErrorText(status) where status is for example %objlasterror or sc. It is somewhat human readable unlike the status itself.

Related

Defender KQL to show blocked Bluetooth Devices with all relevant fields

I'm trying to write a query to report on BlueToothPolicyTriggered events, that will return all the details to show when a device was blocked by policy AND the details of that device.
Our BT policy basically should allow everything but block file transfer over BT. That seems to be working as expected, but before rolling out wider, want a quick way to 'see' if any other devices are being blocked incorrectly or be able to refer to it if a user reports an issue so we can get all the details of the device blocked to add an exception etc.
However (and I'm new to kql) it seems once I filter a table using an 'ActionType' the columns available to report on are restricted, and in this case we lose details of the BT device that has been blocked
This shows all events that have triggered the policy and whether it was 'accepted' or 'blocked' but not the details of the device
search in (DeviceEvents) ActionType == "BluetoothPolicyTriggered"
| extend parsed=parse_json(AdditionalFields)
| extend Result = tostring(parsed.Accepted)
| extend BluetoothMACAddress = tostring(parsed.BluetoothMacAddress)
| extend PolicyName = tostring(parsed.PolicyName)
| extend PolicyPath = tostring(parsed.PolicyPath)
| summarize arg_max(Timestamp, *) by DeviceName, BluetoothMACAddress
| sort by Timestamp desc
| project Timestamp, DeviceName, DeviceId, Result, ActionType, BluetoothMACAddress, PolicyPath, PolicyName, ReportId
Then I have this which will show every BT connection, the device details im looking for, but not whether it was blocked or accepted
DeviceEvents
| extend parsed=parse_json(AdditionalFields)
| extend MediaClass = tostring(parsed.ClassName)
| extend MediaDeviceId = tostring(parsed.DeviceId)
| extend MediaDescription = tostring(parsed.DeviceDescription)
| extend MediaSerialNumber = tostring(parsed.SerialNumber)
| where MediaClass == "Bluetooth"
| project Timestamp, DeviceId, DeviceName, MediaClass, MediaDeviceId, MediaDescription, parsed
| order by Timestamp desc
Ive been trying to somehow join these together (despite being the same DeviceEvents table) with not much success. I don't trust the output as im seeing entries saying a device was blocked when I know it wasnt.
DeviceEvents
| where ActionType == "BluetoothPolicyTriggered"
| extend parsed=parse_json(AdditionalFields)
| extend Result = tostring(parsed.Accepted)
| extend BluetoothMACAddress = tostring(parsed.BluetoothMacAddress)
| extend PolicyName = tostring(parsed.PolicyName)
| extend PolicyPath = tostring(parsed.PolicyPath)
| project Timestamp, DeviceName, DeviceId, Result, ActionType, BluetoothMACAddress, PolicyPath, PolicyName, ReportId
| join kind =inner (DeviceEvents
| extend parsed=parse_json(AdditionalFields)
| extend MediaClass = tostring(parsed.ClassName)
| extend MediaDeviceId = tostring(parsed.DeviceId)
| extend MediaDescription = tostring(parsed.DeviceDescription)
| extend MediaSerialNumber = tostring(parsed.SerialNumber)
) on DeviceName
| where MediaClass == "Bluetooth"
| project Timestamp, DeviceName, Result, ActionType, MediaClass, MediaDeviceId, MediaDescription,BluetoothMACAddress
| sort by Timestamp desc
Am i going about this completely wrong ?

I want to run Scenario Outline in loop for one of the variable configurable

I have use case in which I am making server name configurable using Scenario outline for get call. But I also want to make another variable like ID configurable. I want using that id it should run for all server name mentioned in Scenario Outline. How can we achieve that?
Example
Scenario Outline: Test one get call
Given url: 'https://' + server+ 'v1/share/12345/profit'
When method get
Then status 200
Examples:
|server|
|server1|
|server2|
|server3|
|server4|
In above example server name, I made it configurable using scenario outline, but I want to make number entered in URL configurable & want that to run for all servers. How I will achieve that?
Just use another variable.
Examples:
| server | id |
| foo | 1 |
| foo | 2 |
| bar | 1 |
| bar | 2 |
And if you want to dynamically generate data using a function, all that is possible. Refer: https://github.com/karatelabs/karate#json-function-data-source

KQL - return entries not matching IP from watchlist (query optimization)

I want to receive a high severity alert in Sentinel when a user is added to a defined "high severity" group (via watchlist), however, I want to omit any users that are connected to a Zscaler IP address. The query below is working, however, I'm not sure this is the neatest/most optimized logic. Is there a shorter/better way to write this?
I'm only concerned about the lines beginning with asterisks (which are only added for clarity).
watchlist "aadgroups"
Group
Severity
Prod Owners
High
Prod Contributors
High
watchlist "ZSIPs"
zscaler_ip
location
165.225.0.0/23
Chicago
165.225.60.0/22
Chicago
165.225.56.0/22
Chicago
let HighSeverityGroups = (_GetWatchlist('aadgroups') | where severity == "High" | project group_name, severity);
let ZSIPs = (_GetWatchlist('zscaler_ip') | project zscaler_ip);
AuditLogs
| where ActivityDisplayName == "Add member to group"
| where parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[1].newValue)) has_any (HighSeverityGroups)
| extend InitiatedByActor = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
| extend GroupName = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[1].newValue)))
| extend Actor_ipv4 = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)
| extend TargetUser = tostring(TargetResources[0].userPrincipalName)
| project-reorder TimeGenerated,SourceSystem,InitiatedBy,ActivityDisplayName,TargetUser,GroupName,InitiatedByActor,Actor_ipv4,Result
| where TargetUser <> ""
** | evaluate ipv4_lookup(ZSIPs, Actor_ipv4, zscaler_ip, return_unmatched = true)
** | where isempty(zscaler_ip)
A couple of things you can try to optimize the query:
This filter is quite costly: | where parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[1].newValue)) has_any (HighSeverityGroups) - if TargetResources will rarely have strings from HighSeverityGroups, then before this filter, you can add a much more efficient filter, that will filter out most of the records: | where TargetResources has_any (HighSeverityGroups) - this way, the heavy parsing will be done only on a small amount of records
You're parsing some of the data more than once, for example tostring(parse_json(tostring(InitiatedBy.user)) - instead, you need to use the extend operator to parse them only once, and then use later on in the query

Renault Zoe doesn't send SDP Request After SLAC Matching Process

We are trying to communicate with Renault Zoe according to DIN SPEC 70121.
We are successfully communciating with the Hyundai Kona and BMW i3 but fail to receive the SPD Request with Renault Zoe. We are passing the SLAC process with Renault Zoe but we don't recieve any UDP messages afterwards. We are sending the CM_SLAC_MATCH_CNF message as an ethernet unicast message according to DIN SPEC 70121:2014-12, 8.3.3.3.2, Table 2 (noted in Design Guide Combined Charging System V5 - Failures during SLAC - Interruption at SLAC match sequence).
Why can it be that we receive the SDP Request with Kona and i3 but fail to do so with Zoe? Has anyone experienced this behaviour before?
Sniffed SLAC messages with scapy:
(= '' means the field is filled with zeroes)
Received from Zoe:
###[ CM_SLAC_MATCH_REQ ]###
ApplicationType= 0
SecurityType= 0
MatchVariableFieldLen= 15872
\VariableField\
|###[ SLAC_varfield ]###
| EVID = ''
| EVMAC = 7c:bc:84:41:03:3b
| EVSEID = ''
| EVSEMAC = 3e:7e:f1:10:ab:3e
| RunID = '\xd3\xac;\x0f\x17-\xb7+'
| RSVD = ''
Send to Zoe:
###[ CM_SLAC_MATCH_CNF ]###
ApplicationType= 0
SecurityType= 0
MatchVariableFieldLen= 86
\VariableField\
|###[ SLAC_varfield ]###
| EVID = ''
| EVMAC = 7c:bc:84:41:03:3b
| EVSEID = ''
| EVSEMAC = 3e:7e:f1:10:ab:3e
| RunID = '\xd3\xac;\x0f\x17-\xb7+'
| RSVD = ''
| NetworkID = '$\x94\xc1\x0c\xbcO\xb5'
| Reserved = 0
| NMK = ''
The solution was to send the 2 byte field MatchVariableFieldLen in the CM_SLAC_MATCH_CNF message in little-endian byte order.
From the message that was send by the Renault Zoe, we can see that Zoe sends the CM_SLAC_MATCH_REQ with the MatchVariableFieldLen as 0x3e 0x00 (15872 == 0x3e00). Since this field should be 0x3e according to DIN SPEC 2014-12, we can see the byte order of this field is little-endian. So a reasonable guess was that it expects this field in little-endian in the response message.
Result: We received the SDP request and the messages after that.
The HomePlug GP Specification does not specify the endianness of this field in clause 11.5.58. But looking at the example in Table 11-316, one would say its big-endian.
It's clear that Zoe interpret this field as little-endian and doesn't accept 0x00 0x56 but accepts 0x56 0x00.
Kona and i3 either don't complain about this field and accept the message or Zoe's intepreting is false. Either way the cause of the problem has been identified.

Use random var in behat tests to produce unique usernames

Right now I am creating users using something like the following
Given users:
| name | status | roles |
| kyle | 1 | authenticated user |
| cartman | 1 | admin |
Is there a possibility to add random strings in these names?
If I didn't misunderstand, you can do this instead.
Gherkin
Scenario: Create random users
Given I create "3" users
FeatureContext
var $str = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
var $status = [0, 1];
var $roles = ['authenticated user', 'admin', 'superman'];
/**
* #Given /^I create "([^"]*)" users$/
*/
public function createDummyUsers($count)
{
for ($i = 0; $i < $count; $i++) {
$name = substr(str_shuffle($this->str), 0, 8);
$status = $this->status[array_rand($this->status, 1)];
$role = $this->roles[array_rand($this->roles, 1)];
echo "You've just created $name - $status -$role" . PHP_EOL;
}
}
Prints
You've just created mqBWAQJK - 1 - superman
You've just created WYuAZSco - 0 - admin
You've just created HCNWvVth - 1 - admin
You've just created EmLkVRpO - 1 -superman
You've just created pxWcsuPl - 1 -authenticated user
You've just created mLYrlKdz - 0 -superman
The RandomContext functionality from drupal/drupal-extension allows for usage like this:
Given I fill in "E-mail address" with "<?username>#example.org"
or
Given users:
| name | email | status | roles |
| <?standard> | <?standard>#example.org | 1 | authenticated |
| <?admin> | <?admin>#example.org | 1 | admin |
Each token (eg <?username>, <?firstname>) used in a feature will be randomly transformed with a (random string) value for that feature execution. This is implemented with the use of Behat's #Transform functionality, meaning that your tokens will be substituted before execution of that step - so it works to generate random inputs anywhere you might need to use random input as part of your feature.
You can reference the same token later in your feature, eg to verify that the random value input earlier has been returned correctly, and the randomly generated value will be recalled. So, the first and second usages of <?admin> in the example above will both be replaced by the same generated value.
If you are using drupal/drupal-extension then this can be enabled by adding Drupal\DrupalExtension\Context\RandomContext to the enabled contexts in your behat.yml.
If you aren't using Drupal, then the source linked above will demonstrate how you could implement the same for your own usage.
I've created a solution on that you can try.
https://github.com/JordiGiros/MinkFieldRandomizer
MinkFieldRandomizer is a random (with sense) information generator for filling browser form fields in Behat Mink Selenium tests. It brings the option to run your tests in a more realistic way changing the information you use to fill in the forms in every test you run.
You can easily add it to your project by Composer.
One example:
Then Fills in form fields with provided table
| "f_outbound_accommodation_name" | "{RandomName(10)}" |
| "f_outbound_accommodation_phone_number" | "{RandomPhone(9)}" |
| "f_outbound_accommodation_address_1" | "{RandomText(10)}" |
I hope you try it!
And you're welcome to add new functionalities or fork it or do wathever you want.
Cheers