Hi everyone 👋. I'm new to the AI SOC space, but I'm trying to build a simple integration between Microsoft Copilot for Security and our OpenClaw instance for automated alert enrichment.
I'm running into a consistent 422 error when Copilot tries to call the OpenClaw `/api/v1/entities/search` endpoint. The request seems to be malformed. From my logs:
**Copilot's outgoing request (anonymized):**
```json
{
"query": "ip:192.0.2.1",
"maxResults": 5
}
```
**OpenClaw's response:**
```json
{
"error": "Validation failed: 'type' field is required."
}
```
Our OpenClaw API docs clearly state the `type` field (e.g., `ipv4`, `domain`) is mandatory. It seems Copilot isn't populating it.
Has anyone else hit this? My questions:
* Is there a way to configure the API call template in Copilot for Security?
* Are there known compatibility issues or a specific connector I should use?
* Should I just build a middleware proxy to reshape the request? Feels clunky.
I'm using the default "Custom API" setup in Copilot. Any pointers would be a huge help!