IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Error installing fn-utilities 1.0.11

    Posted 01/22/20 01:17 PM
    Hi all,

    Trying to install fn-utilities 1.0.11, running the latest version of Circuits, and Resilient is 35.0.5470.

    After installing with pip3 which installs OK with no errors, but when I run resilient-circuits customize if fails:

    [integration@integrations ~]$ resilient-circuits customize -y -l fn-utilities
    /usr/local/lib/python3.6/site-packages/urllib3/connection.py:418: SubjectAltNameWarning: Certificate for resilient.localdomain has no `subjectAltName`, falling back to check for a `commonName` for now. This feature is being removed by major browsers and deprecated by RFC 2818. (See https://github.com/urllib3/urllib3/issues/497 for details.)
    SubjectAltNameWarning,
    Package 'fn-utilities 1.0.11':
    Failed, importing customizations from 'fn-utilities 1.0.11'
    Traceback (most recent call last):
    File "/usr/local/lib/python3.6/site-packages/resilient/co3.py", line 306, in post
    response = super(SimpleClient, self).post(uri, payload, co3_context_token, timeout)
    File "/usr/local/lib/python3.6/site-packages/resilient/co3base.py", line 351, in post
    BasicHTTPException.raise_if_error(response)
    File "/usr/local/lib/python3.6/site-packages/resilient/co3base.py", line 62, in raise_if_error
    raise BasicHTTPException(response)
    resilient.co3base.BasicHTTPException: Bad Request: {"success":false,"title":null,"message":"Unable to import configuration settings because of a conflict with the following Function Inputs: Exported object '__function/incident_id' type - 'NUMBER' do not match with the object in this organization. The valid types are 'TEXTAREA, TEXT'. Remove the conflicting field or change the API Name and try the import again.","hints":[],"error_code":"generic"}

    During handling of the above exception, another exception occurred:

    Traceback (most recent call last):
    File "/usr/local/bin/resilient-circuits", line 11, in <module>
    load_entry_point('resilient-circuits==34.0.195', 'console_scripts', 'resilient-circuits')()
    File "/usr/local/lib/python3.6/site-packages/resilient_circuits/bin/resilient_circuits_cmd.py", line 694, in main
    customize_resilient(args)
    File "/usr/local/lib/python3.6/site-packages/resilient_circuits/util/resilient_customize.py", line 119, in customize_resilient
    do_customize_resilient(client, entry_points, args.yflag, args.install_list)
    File "/usr/local/lib/python3.6/site-packages/resilient_circuits/util/resilient_customize.py", line 156, in do_customize_resilient
    customizations.load_import(definition, dist)
    File "/usr/local/lib/python3.6/site-packages/resilient_circuits/util/resilient_customize.py", line 211, in load_import
    result = self.client.post(uri, import_data)
    File "/usr/local/lib/python3.6/site-packages/resilient/co3.py", line 308, in post
    _raise_if_error(ex.get_response())
    File "/usr/local/lib/python3.6/site-packages/resilient/co3.py", line 171, in _raise_if_error
    raise SimpleHTTPException(response)
    resilient.co3.SimpleHTTPException: Bad Request: {"success":false,"title":null,"message":"Unable to import configuration settings because of a conflict with the following Function Inputs: Exported object '__function/incident_id' type - 'NUMBER' do not match with the object in this organization. The valid types are 'TEXTAREA, TEXT'. Remove the conflicting field or change the API Name and try the import again.","hints":[],"error_code":"generic"}

    Any help much appreciated :-)


  • 2.  RE: Error installing fn-utilities 1.0.11

    Posted 01/24/20 06:21 AM
    Hi James
    Welcome to the community forum.

    I have seen this arise before and I think I have a fix for you.
    To give some context, fields defined in functions have a number of types. Generally fields that are identifiers such as incident_id are Numbers. We have seen at times an incident_id field created as either a text or textarea type. The issue is that incident_id is a generic field name with the intention of reusing it elsewhere and it appears that at some point an incident_id field was created or imported that is either text or a text area type. In this case it won't import because of this preexisting incident_id

    To fix, head into your Customization Settings, open up any Function for editing and you should see the fields in this view like so :


    Have a look to see if there is already an incident_id field and if there is attempt to delete it. After which you can then customise fn_utilities again and it will pull in the new incident_id. Note that if any functions use that old incident_id they will need to be briefly checked to ensure it works with Numbers. 


    If this is helpful and solves your issue let me know so we can mark as the accepted answer.


    ------------------------------
    Ryan Gordon
    Security Software Engineer
    IBM
    ------------------------------



Related Content