IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  data feeder error

    Posted 06/22/21 04:07 PM

    Hello,

    Because of an unrelated Resilient issue I had, I reinstalled our data feeder app.
    This had been working find in the past, but now it is getting the error below.
    It appears to be configured correctly too.

    [feeds]
    # comma separated section names. ex. sqlserver_feed,file_feed
    #feed_names=mysql_feed
    feed_names=splunk_hec_feed
    .
    .
    ######### SPLUNK FEED ########
    [splunk_hec_feed]
    .
    .


    Jun 22 14:58:31 chdtx1mn06.corpdev.transunion.com resilient-circuits[11923]: 2021-06-22 14:58:31,617 INFO [feed_ingest] ingesting object
    Jun 22 14:58:31 chdtx1mn06.corpdev.transunion.com resilient-circuits[11923]: 2021-06-22 14:58:31,617 WARNING [co3] Unverified HTTPS requests (cafile=false).
    Jun 22 14:58:32 chdtx1mn06.corpdev.transunion.com resilient-circuits[11923]: 2021-06-22 14:58:32,406 ERROR [feed_ingest] Traceback Traceback (most recent call last):
    Jun 22 14:58:32 chdtx1mn06.corpdev.transunion.com resilient-circuits[11923]: File "build/bdist.linux-x86_64/egg/rc_data_feed/components/feed_ingest.py", line 190, in _feed_ingest_data
    Jun 22 14:58:32 chdtx1mn06.corpdev.transunion.com resilient-circuits[11923]: self.feed_outputs, is_deleted, self.incl_attachment_data)
    Jun 22 14:58:32 chdtx1mn06.corpdev.transunion.com resilient-circuits[11923]: AttributeError: 'FeedComponent' object has no attribute 'feed_outputs'
    Jun 22 14:58:32 chdtx1mn06.corpdev.transunion.com resilient-circuits[11923]: 2021-06-22 14:58:32,407 ERROR [feed_ingest] Failure on action modified object 0 type_info {u'incident

    Any suggestions?



    ------------------------------
    Tim Gray
    ------------------------------


  • 2.  RE: data feeder error

    Posted 06/23/21 09:37 PM
    Hi Tim,

    The issue may be that the rc-data-feed-plugin-splunkfeed package is not installed. Confirm that package by running 'resilient-circuits list'.

    Regards,
    Mark

    ------------------------------
    Mark Scherfling
    ------------------------------



  • 3.  RE: data feeder error

    Posted 09/24/21 11:08 AM
    I came across the same error and the 'resilient-circuits list' output is as follows:

    rc-data-feed-plugin-odbcfeed==1.0.5:

    (Package does not define any components)

    rc-data-feed-plugin-splunkfeed==1.0.3:

    (Package does not define any components)

    rc-data-feed==2.1.0:

    FeedComponent

    SyncIncidentsFunctionComponent


    Does Package does not define any components mean the package was incorrectly installed?

    ------------------------------
    Priyanka Mane
    ------------------------------

    Original Message


Related Content