Update poll_incidents.py - Bug Fix for 0 value "serialNum" field from API

[nterl0k]

Description

At some point past 7/29/2022 changes made to Palo Prisma Cloud Compute API have caused the "serialNum" field to be blank in the API. This is on a Cloud Compute v22.06.xxx instance.

The poll_incidents.py ingest script will no longer read existing or read new events. I've altered ingest method to rely on the last event date seen as well as added some minor debugging lines.

Motivation and Context

Required to continue event ingest, unknown if the underlying cause is intentional at Palo/Prisma.

How Has This Been Tested?

Tested in a production environment after noticing a lack of events in Splunk from Prisma and troubleshooting issue.

You may test for the presence of the "serialNum" dield by using curl/powershell as follows

CURL
curl -v -k -u (user:password) -H 'Content-Type: application/json' -X GET "https://(YOUR CONSOLE ADDRESS)/api/v1/audits/incidents?protect=central%20console&acknowledged=false&limit=1&offset=0"

POWERSHELL
$creds = [System.Convert]::toBase64String([System.Text.Encoding]::ASCII.GetBytes("USERNAME:PASSWORD"));
Invoke-RestMethod -uri "(YOUR CONSOLE ADDRESS)/api/v1/audits/incidents?protect=central%20console&acknowledged=false&limit=1&offset=0" -Method Get -ContentType "application/json" -Headers @{Authorization="Basic $creds"}

Screenshots (if appropriate)

Types of changes

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have added tests to cover my changes if appropriate.
• [X ] All new and existing tests passed.