IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Errors when configuring integration with MISP(fn_misp)

    Posted 11/21/22 09:39 AM
    Good afternoon! I wanted to integrate SOAR with MISP through the fn_misp application, but after setting up, an error comes out when checking the configuration (I'll attach a screenshot). You can look at it and give recommendations, or tell me who to contact. Thanks!




    ------------------------------
    Almaz Nadirov
    ------------------------------


  • 2.  RE: Errors when configuring integration with MISP(fn_misp)

    Posted 11/22/22 08:43 AM
    Hi Almaz,

    The issue you're experiencing seems to be with the connection back to SOAR. If using a FQDN, perhaps try an IP address to see if that resolves the issue.

    Regards,
    Mark

    ------------------------------
    Mark Scherfling
    ------------------------------



  • 3.  RE: Errors when configuring integration with MISP(fn_misp)

    Posted 11/23/22 02:36 AM
    Hi Almaz,

    "Name or service is not known" means that it cannot resolve the hostname. Containers do not pick up host file entries so if the hostname you have chosen to use is not in your DNS then it will not resolve it from hosts file.

    In https://www.ibm.com/docs/en/sqsp/47?topic=installation-create-app-hosts is the following command which you can use to create a IP/hostname mapping from within App Host. You could use this to map the hostname to an IP address and try again.

    manageAppHost dns --set --ip <ip_address> --hostname <hostname1> --hostname <hostname2>


    ------------------------------
    BEN WILLIAMS
    ------------------------------



Related Content