IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Circuits Feedback with Python 3.6

    Posted 10/19/18 12:33 PM
    Edited by Pascal Weber 10/19/18 12:39 PM
    Hello World,

    Just to share to the community, some feedback with Circuits on an independant RHEL/CEntOS  7.5, using Python 3.6 (RH) and functions from the Resilient .git repos  :

    • fn_splunk_integration : 1.0.0 (with Splunk SDK 1.6.5)
    • fn_utilities : 1.0.3
    • rc-cts-misp-29.1.1.dev24+g1c40c13

    Feedback :

    • Splunk functions (With SDK 1.6.5) : Works fine, calling with functions are OK on a Splunk enterprise.

    • Fn_utilities : Correction to do for hash calculation with attachment

      1) if you don't mention the algorithms, you will get an error in module 'hashlib' has no attribute 'algorithms'
      2) hashlib contains some hash functions that have dynamic length outputs. Specifically, shake_128 and shake_256. This is why you have to rewrite it.

      Info : /usr/local/lib/python3.6/site-packages/fn_utilities/components/utilities_attachment_hash.py
      You have to correct from line 56 :

      #BEFORE
      for algo in hashlib.algorithms:
          impl = hashlib.new(algo)
          impl.update(data)
          results[algo] = impl.hexdigest()

      #AFTER CORRECTION
      for algo in hashlib.algorithms_guaranteed:
          if algo.startswith('shake_'):
              continue
          impl = hashlib.new(algo)
          impl.update(data)
          results[algo] = impl.hexdigest()

    • Rc_cts_misp :
      With self signed certificate on Misp

      Error : INFO [threat_webservice] Lookup complete: <net.ip[cts_search.misp] (d1412576-484a-5a72-a84b-da4f69dc0149)>, (<class 'pymisp.exceptions.PyMISPError'>, PyMISPError('Unable to connect to MISP (https://misp.zoldax.local). Please make sure the API key and the URL are correct (http/https is required): Could not find a suitable TLS CA certificate bundle, invalid path: False',), <traceback object at 0x7f4d125f4708>)

      Info : /usr/local/lib/python3.6/site-packages/rc_cts_misp/components/searcher.py
      Line 160 : the self.misp_verifycert is not typed in False boolean
      Work around line 160 :
      misp_api = PyMISP(self.misp_url, self.misp_key, False, 'json')

    Everything works fine after these modifications.
    ​Just for sharing.

    ------------------------------
    Just to share.

    Regards,
    @zoldax
    ------------------------------


  • 2.  RE: Circuits Feedback with Python 3.6

    Posted 10/22/18 07:54 PM

    Hi Pascal,

    Thank you for your response and the suggested fixes. I understand the issues and we will be posting fixes as quickly as we can.

    Regards,



    ------------------------------
    Mark Scherfling
    Resilient Integrations Team
    ------------------------------