Skip to main content
Solved

Custom Action - Get package SAS URI API

  • April 17, 2025
  • 5 replies
  • 63 views
vanitharaj1208
Forum|alt.badge.img+15

HI All,

I'm building this custom action - https://learn.microsoft.com/en-us/defender-endpoint/api/get-package-sas-uri 

I need some guidance to Handle rate limit since it is 2 calls per minute

"Rate limitations for this API are 2 calls per minute and 120 calls per hour."

What will be the best approach to handle this?

and i have one question - if we got 10 alerts and at same time playbook which got attached had this action - then this action will fail rest 8 alerts and 2 alerts had successful playbook run?

 

Best answer by ylandovskyy

Hey @vanitharaj1208 ,

The best practice would be to implement the action with retry mechanism. Meaning that, if you've encountered status code 429, the action will wait until it will receive status code 200. In that way, over time the action will finish for all 10 alerts.

Retry mechanism will need to be done in async way. We have a lot of actions that work like that, you can look into action "Wait For Custom Fields" in Siemplify for inspiration.  

chica

5 replies

ylandovskyy
Staff
Forum|alt.badge.img+16
  • ylandovskyy
  • Staff
  • Answer
  • April 18, 2025

Hey @vanitharaj1208 ,

The best practice would be to implement the action with retry mechanism. Meaning that, if you've encountered status code 429, the action will wait until it will receive status code 200. In that way, over time the action will finish for all 10 alerts.

Retry mechanism will need to be done in async way. We have a lot of actions that work like that, you can look into action "Wait For Custom Fields" in Siemplify for inspiration.  

vanitharaj1208
Forum|alt.badge.img+15

Hi @ylandovskyy ,

Can i get some info on modules which starts with TIPCommon and where can i find the code?

I have implemented with retry mechanism in sync action , its working but i'm not sure ... is this right way?

and  in this action "Wait For Custom Fields"  where is Retry mechanism is implemented i didn't find it?

 

chica
_K_O
Forum|alt.badge.img+12
  • _K_OBronze 5
  • Bronze 5
  • April 21, 2025

Hi @ylandovskyy ,

Can i get some info on modules which starts with TIPCommon and where can i find the code?

I have implemented with retry mechanism in sync action , its working but i'm not sure ... is this right way?

and  in this action "Wait For Custom Fields"  where is Retry mechanism is implemented i didn't find it?

 


@vanitharaj1208 

In terms of TIP Common, you can find the code base in the "Script Dependencies" section of the integration.

To review the code, you can export the integration itself and review the code locally in the "Dependencies" folder. If you wanted to include TIP common in your own integrations, Google had a post a few weeks ago on how to perform that action: https://www.googlecloudcommunity.com/gc/SecOps-SOAR/Retrieving-latest-version-of-TIPCommon-and-its-dependencies/m-p/891759#M3822 

    Chica
    Forum|alt.badge.img+3
    • ChicaBronze 4
    • Bronze 4
    • April 30, 2025

    Hey @vanitharaj1208 ,

    The best practice would be to implement the action with retry mechanism. Meaning that, if you've encountered status code 429, the action will wait until it will receive status code 200. In that way, over time the action will finish for all 10 alerts.

    Retry mechanism will need to be done in async way. We have a lot of actions that work like that, you can look into action "Wait For Custom Fields" in Siemplify for inspiration.  


    hi @ylandovskyy , are you sure that we should go with async action ? 

    SoarAndy
    Staff
    Forum|alt.badge.img+12
    • SoarAndy
    • Staff
    • May 2, 2025

    hi @ylandovskyy , are you sure that we should go with async action ? 


    It sounds best to me too.

    There is a roadmap item for x retries, however that will be a little more limited in retry count compared to Async that can try for hours/days.

      Terms & ConditionsCookie settingsAccessibility statement
      Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

      © 2025 Google. All rights reserved.