Hi Team,

I am trying to modify an existing custom function developed for IBM SOAR. The custom package is named:

On the Integration Server, I found Python component files in two different locations:

and:

The first location appears to be the original source package generated using the IBM SOAR SDK. However, the files under .resilient/components appear to contain the complete function logic currently used by the integration.

I modified the function logic, but the changes are not reflected when I trigger the function from IBM SOAR. I am therefore unsure which copy is loaded by the running resilient-circuits process.

Could someone please clarify the following?

1. Which of these two directories is used at runtime by resilient-circuits?
2. In which directory should the function code be modified?
3. After modifying the Python file, how should the updated code be deployed?
4. Do I need to rebuild and reinstall sentinelone_block_hash, or is restarting resilient-circuits sufficient?
5. What is the correct command to restart or reload the integration?
6. How can I verify from the logs which Python component file is being executed?
7. Is there any configuration in app.config that controls loading components from:

Any guidance on the correct development, deployment, restart, and validation process would be helpful.

Thanks,
Sreekanth

Dear Sreekanth ,

I suggest you go in other path and use the REST API app to call "https://managedr.sentinelone.net/web/api/v2.1/restrictions" to block the hash , we have been using the same.

example body is below : 

Hi Sreenkanth ,

I don't have much experiences in that , hopefully some one else will help you.

one thing to keep in mind if you are using apphost , modification an application is not easy , as even when you modify the code and reupload the app , it still pull the app from IBM servers , so any changes you made are not saved (at least that was my expirense)

Hello @Sreekanth Bille

The important distinction is between the development/source directory and the Python package actually installed in the environment used by resilient-circuits. Editing the SDK project under /home/integration/sentinel_block_hash/... won't necessarily affect the running integration, which explains why your changes aren't appearing.

I would avoid directly modifying /home/integration/.resilient/components/ as the normal deployment method. Instead, make the changes in the original sentinelone_block_hash source project, rebuild the package, reinstall/upgrade it into the same Python environment used by resilient-circuits, and then restart the service/process.

You can first verify exactly what Python is loading with something similar to:

python -c "import sentinel_block_hash; print(sentinel_block_hash.__file__)"

For the specific component module, you can similarly import it and print its __file__. This is a reliable way to determine whether the running environment is using the installed package or another copy.

Also verify that you're building/reinstalling with the same Python/virtual environment used to launch resilient-circuits; otherwise, you can successfully install the updated package into one environment while the service continues using the old package from another.

app.config normally controls the integration configuration rather than selecting arbitrary Python source directories. Since your thread shows two copies of the component, confirming the active Python module path should be the first step before changing anything else.

Hope this helps narrow down which copy is actually executing.